Encrypted Databases on Mobile

Instructions

Plain SQLite and plain Realm files are readable by anyone with filesystem access — including forensic tools and, on rooted/jailbroken devices, other apps. Encrypt at rest for anything sensitive.

1. When to Encrypt

Encrypt when the DB contains:

• Session tokens, refresh tokens, or API credentials.
• PII (email, phone, address, national IDs).
• Financial / health records.
• User-generated content marked private.

Do not encrypt purely public / cached content; it wastes CPU and complicates debugging.

2. Key Management (The Actual Hard Part)