I have different client applications running on different OS (iOS, Android, Windows Desktop, Windows Phone, Mac, Windows Store -All Native Apps-) I have to decrypt (AES-128) some files (thousands of them) on the clients so i need to store Encryption Keys in the client side. Currently i am keeping it as hardcoded string which is bad. So what is the best way to store Encryption keys in the client safe and secure?

1 Answer 1


For each of the operating systems you've listed, you should leverage the operating system's built-in secure storage for the keys rather than attempt to "roll your own" solution.

In general, it is not seen as a best practice to use your own encryption as you will continue to have to support, and debug your implementation which may have unforseen vulnerabilities. Instead, it's a best practice to leverage the native tools at your disposal for secure storage.

For iOS, this would be the keychain. For Android, this is known as the keystore. For Windows Phone 8.1+, this is known as the "Credential Locker."

These systems generally work by encrypting the private data in a small database on the device, and then restricting access to it to authorized applications only. This makes it much more difficult to get the private key off of the device without rooting/jailbreaking the device, etc.

You should also be generating unique keys for each device that receives these files. Having a hardcoded string in the app (rather than in a config file) is dangerous because once that key is compromised, all users are compromised. Check for correct use of SecureRandom or similar cryptographic libraries to ensure you're generating unique, near-impossible-to-crack keys.

  • Hi; I am trying to decrypt many files that is encrypted on the server, so i must use same keys with the server on the client to decrypt files. That is why i cannot change this keys and i have to use it same in all clients. Unless if there is a smart way to do it. I did not check built-in OS secure storage but even putting this keys in to secure storage i have to first put it in my code so my keys will be hardcoded anyway. Isn't it?
    – Walt S.
    Jul 24, 2015 at 21:32
  • The encryption practice you describe is insecure and should be implemented differently. I'm not sure what you're doing/what the process looks like to be able to advise as to what method should be used. Jul 24, 2015 at 21:38
  • Hi. What i am trying to do is to let my members obtain encrypted files from server (which is encrypted by my server) and decrypt in the client part. I am using AES-128 on the server so i need to use same keys in the client to decrypt this files therefor i need to let my client applications know those keys. All files on the server encrypting by using same keys.
    – Walt S.
    Jul 24, 2015 at 21:48
  • The server may have files encrypted at rest with its own key. When a user downloads a file, it should be first decrypted if encrypted, and then encrypted with a private key known only to/generated on the user's device. Encryption keys like this should not be shared -- the model you are describing does not offer very effective security. Jul 25, 2015 at 0:39
  • Hi again. I will consider your suggestion but even in that situation i have to store keys in the client therefor i have to store it safe. So the point is how can i store my keys secure in the client?
    – Walt S.
    Jul 25, 2015 at 9:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .