How to secure data storage in a mobile app

Insecure data storage is one of the most common and most damaging mobile findings. Apps keep tokens, personal data and cached files on the phone, and if that data is not protected, anyone with access to the device, a backup or a piece of malware can read it. This guide covers what not to do, where sensitive data belongs, and how to check.

Why storage is a top risk

The device is not a safe place by default. It can be shared, lost, backed up to a computer, or rooted or jailbroken. Anything an app writes in clear is reachable in one of those situations. That is why insecure storage sits high on the OWASP Mobile Top 10 and why it is worth getting right.

What not to do

• Do not write sensitive data to plain files or to shared preferences and user defaults in clear.
• Do not put secrets on external or shared storage, where other apps may reach them.
• Do not log sensitive values. Logs are easy to read and often collected.
• Do not assume the cache is safe. Cached responses can hold personal data long after they are needed.

Where sensitive data belongs

Keys and tokens belong in the platform secure storage: the Android Keystore or iOS Keychain, ideally backed by hardware such as the Secure Enclave. Other sensitive data should be encrypted with a key held there, not with a key sitting next to the data. And the safest data is the data you do not store at all, so keep only what the app actually needs and clear it when you are done.

How to test your storage

Run the app through its normal flows, then look at what it wrote: the files, databases, preferences and caches it created on the device. Anything sensitive sitting in clear is a finding. This is part of dynamic analysis, and it maps to the storage controls in OWASP MASVS.

For the full release routine, see a mobile app security checklist before you ship.

Common questions