I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad idea because of XSS attacks or a user could be socially engineered to go to the console, get the token and give it away.

So I use this JavaScript library called 'secure-ls', which uses localStorage but encrypts the data. The encryption key is randomly generated for each instance of the application, so I don't store it as plain text in the code.

This is what it looks like:

private static _instance: SecureStorage = new SecureStorage({
    encryptionSecret: crypto.randomBytes(60).toString(),

This is what the encrypted data in the console looks like:

encrypted data

The plain-text data in localStorage is only available to the code. I believe this is sufficiently secure and I can't see how a hacker could get the plain-text data.

So it leaves me to wonder why more people don't use this method? Or is there some loophole I'm missing in how a hacker could get the data?

  • 2
    Why an XSS or social engineer hacker cannot fish out the encryption key the same way they would fish out unencrypted data?
    – Greendrake
    Jan 7, 2020 at 3:01

1 Answer 1


An attacker has full control over the client, and therefore has complete access to the encryption keys and methods. In short, this cannot actually protect anything from an attacker.

Normally client-side encryption at least provides a small layer of protection to slow down attackers, but protections around client-side JavaScript tend to be the easier to circumvent than similar steps in apps or desktop applications.

It is unlikely to be helpful

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .