How do you securely store sensitive tokens and secrets using Keychain (iOS) and Keystore (Android)?

Short answer

Use specialized libraries such as expo-secure-store or react-native-keychain to save secrets in the phone's secure hardware-backed storage instead of ordinary local storage.

Explanation

Never store passwords or JWT tokens in AsyncStorage or unencrypted storage, where they can be extracted from rooted or jailbroken phones or through unencrypted backups. These libraries use the iOS Keychain and Android EncryptedSharedPreferences, protected by the device's hardware security processor (Secure Enclave/TEE).

Code example

import * as SecureStore from 'expo-secure-store';

async function saveAuthToken(token: string) {
  await SecureStore.setItemAsync('auth_jwt', token, {
    keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
  });
}

async function getAuthToken(): Promise<string | null> {
  return await SecureStore.getItemAsync('auth_jwt');
}

Common mistakes

• Storing authentication tokens or banking data in AsyncStorage or Redux Persist without hardware-backed encryption.

Follow-up questions

• How do you completely clear user data on logout?

Sources

• Expo docs — SecureStore