Mobile Security Patterns

Security best practices for Android.

Secure Storage

EncryptedSharedPreferences is dead — use Keystore directly

⚠️ Deprecated. Jetpack Security Crypto (androidx.security:security-crypto) — EncryptedSharedPreferences, EncryptedFile, MasterKey — was deprecated in 1.1.0-alpha07 (April 2025) "in favour of existing platform APIs and direct use of Android Keystore"; 1.1.0 stable (July 30, 2025) ships with the deprecation in place and no successor artifact is planned. Do not build new secure storage on it. Current approach: encrypt with an Android Keystore key and persist only IV || ciphertext in plain DataStore/SharedPreferences. Google's Tink is the maintained library if you need envelope encryption, key rotation, or deterministic AEAD.

Exclude the ciphertext store from backup/transfer as well — a Keystore key never leaves the device, so a restored blob is undecryptable garbage, and a restored plaintext pref is a leak: