EncryptedSharedPreferences: Secure Key-Value Storage on Android
EncryptedSharedPreferences is a drop-in replacement for SharedPreferences that automatically encrypts keys and values, protecting sensitive data at rest. Use it to store small, sensitive data like API tokens. The main footgun is mismanaging the master key.
Why it exists
Standard SharedPreferences stores data in a plain-text XML file in an app's private directory. On a rooted device, this file is easily readable, exposing any sensitive information like API keys stored within. EncryptedSharedPreferences was created to mitigate this security vulnerability by providing encryption at rest by default.
The mental model
Think of it as a SharedPreferences object with a built-in, non-removable lockbox. You interact with it using the familiar edit(), putString(), and getString() methods, but behind the scenes, every piece of data is scrambled before being written to the file and unscrambled when read.
How it works
EncryptedSharedPreferences is part of the AndroidX Security library. When you create an instance, you provide a MasterKey. This key, ideally stored in the hardware-backed Android Keystore, is used to derive subkeys for encryption. It uses Google's robust Tink cryptography library to perform AES-256-GCM encryption for values and a deterministic encryption scheme for keys, ensuring both are unreadable in the stored XML file.
When to use it
Use it for storing small amounts of sensitive data that need to persist across app sessions. Good candidates include authentication tokens, refresh tokens, user identifiers, or small, sensitive user settings. It's a direct, secure replacement for SharedPreferences in these cases.
When not to use it
Avoid it for large datasets; the overhead of encrypting and decrypting large values can impact performance. For storing large structured data securely, use an encrypted database like Room with SQLCipher. Do not use it for non-sensitive data, as the performance cost is unnecessary.
One canonical example
Storing a user's OAuth 2.0 access token. This token grants access to a user's account on a remote service and must be kept secret. Storing it in standard SharedPreferences is a major security risk. Using EncryptedSharedPreferences ensures that even if an attacker gains root access and reads the app's files, the token remains encrypted and unusable.
Interview question
What is the main security problem EncryptedSharedPreferences solves that standard SharedPreferences does not?
- a.Ensuring that large databases are encrypted without any performance impact.
- b.Storing data exclusively within hardware-backed secure elements for maximum protection.
- c.Preventing unauthorized access to sensitive data stored in plain text on a rooted device.Correct
- d.Protecting data from being intercepted during network communication.
Why? this is the answer
The card states that standard SharedPreferences stores data in plain text, which is easily readable on a rooted device, and EncryptedSharedPreferences mitigates this by encrypting data at rest. Option C directly addresses this core security benefit. Options A, C, and D describe different security concerns or misrepresent EncryptedSharedPreferences' capabilities.
Just read this? Test yourself on what you have been reading.
Read the original → developer.android.com
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on android — each one lists the topics its interview covers.
See open roles