Secure Storage
Sensitive data such as authentication tokens, passwords, or personal information should never be stored using plain AsyncStorage. This tutorial covers secure storage solutions for React Native applications.
Why AsyncStorage is Not Secure
AsyncStorage stores data in plain text on the device’s file system, making it accessible to anyone with root or jailbreak access to the device, which is unsuitable for sensitive information.
Using react-native-keychain
react-native-keychain leverages the native iOS Keychain and Android Keystore to securely store sensitive credentials with hardware-backed encryption.
Storing Credentials Securely
Retrieving Stored Credentials
Removing Stored Credentials
Using react-native-encrypted-storage
An alternative library, react-native-encrypted-storage, offers a key-value API similar to AsyncStorage but with encryption backed by the same native secure storage mechanisms.
What Belongs in Secure Storage
- Authentication and refresh tokens
- Biometric-related credentials
- Payment-related identifiers
Conclusion
Using dedicated secure storage libraries like react-native-keychain protects sensitive user data from unauthorized access, an essential security practice for any production React Native application.
