flutter_secure_storage: Secure Key-Value Pairs
flutter_secure_storage is your go-to for saving sensitive data like API tokens. Think of it as an encrypted, cross-platform key-value store that uses native Keychain on iOS and strong ciphers on Android. The footgun: it's slower and meant only for secrets.
Why it exists
Apps often need to persist sensitive information like auth tokens or user credentials after closing. Storing this in plain text using a simple key-value store like SharedPreferences is a major security risk. flutter_secure_storage provides a simple, cross-platform API for storing this data securely, encrypted at rest.
The mental model
Think of flutter_secure_storage as a secure, persistent Map<String, String>. It has a familiar API (read, write, delete), but under the hood, it handles the complex, platform-specific work of encrypting data and storing it in the most secure location available on the device, like the iOS Keychain or Android's encrypted storage.
How it works
The library acts as a bridge to native secure storage mechanisms. On iOS and macOS, it uses the battle-tested Keychain services. On Android, it implements a custom solution using RSA OAEP for key encryption and AES-GCM for data encryption, a strong, modern standard. For other platforms like Web, Windows, and Linux, it uses their respective secure storage solutions. The API is asynchronous because these operations involve disk I/O and cryptographic processing.
When to use it
Use it for small, sensitive pieces of data that must persist between app sessions. Canonical examples include user authentication tokens (JWTs, OAuth tokens), API keys, and private keys for encryption. It's also the right choice when you need to add an optional layer of biometric protection before accessing a stored secret.
When not to use it
Do not use it as a general-purpose database or for storing large amounts of data. The encryption and decryption overhead on every read/write makes it significantly slower than non-secure alternatives like SharedPreferences or a local database. It is not for storing general application state, user preferences, or cached data. On the web, it only works over HTTPS or on localhost.
One canonical example
A mobile app needs to store a user's JWT after they log in so they remain authenticated when they reopen the app. Instead of saving it to a plain text file, the developer uses flutter_secure_storage. They call await storage.write(key: 'jwt_token', value: userToken). When the app starts next, it calls await storage.read(key: 'jwt_token') to retrieve the token and authenticate API calls, ensuring the token was never stored in an unencrypted state on the device.
Interview question
Which scenario best justifies using flutter_secure_storage instead of SharedPreferences?
- a.Saving the current state of a complex form to resume later.
- b.Persisting an authentication token (JWT) to maintain user login status.Correct
- c.Storing a user's preferred theme setting for quick retrieval.
- d.Caching a large list of product images to improve app performance.
Why? this is the answer
flutter_secure_storage is designed for small, sensitive data like authentication tokens, which the card explicitly lists as a canonical example. Using SharedPreferences for such data is a security risk, and flutter_secure_storage's encryption protects it. It is not suitable for large data, general app state, or performance-critical caching due to its overhead.
Just read this? Test yourself on what you have been reading.
Read the original → pub.dev
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on flutter — each one lists the topics its interview covers.
See open roles