Is AsyncStorage secure? - react-native

Question

I'd like to persist a user's account credentials (i.e. username and password) in my React Native app. Should I use AsyncStorage?
In other words, I want to know if and how AsyncStorage protects its contents. The docs are silent on that.
(I'm using RN v0.28)

Answer 1

Is AsyncStorage secure?
No AsyncStorage is not secure, the docs says:
AsyncStorage is a simple, unencrypted, asynchronous, persistent,
key-value storage system that is global to the app. It should be used
instead of LocalStorage.
To store secure information on the native side, I really recommand you to use react-native-keychain with react-native
For iOS it use Keychain Sharing Capabilities
For Android it use:
API level 16-22 use Facebook Conceal
API level 23+ use Android Keystore
This is a simple example:
// Generic Password, service argument optional
Keychain
.setGenericPassword(username, password)
.then(function() {
console.log('Credentials saved successfully!');
});
// service argument optional
Keychain
.getGenericPassword()
.then(function(credentials) {
console.log('Credentials successfully loaded for user ' + credentials.username);
}).catch(function(error) {
console.log('Keychain couldn\'t be accessed! Maybe no value set?', error);
});

Answer 2

If you are using Expo sdk, you can use SecureStore for sensitive information.

Answer 3

NO (at least on iOS, RN v0.28)
AsyncStorage saves key-value pairs as a plaintext JSON file in the Documents directory.
If you run it in the iOS Simulator, you can find its contents on ~/Library/Developer/CoreSimulator/Devices
Should have been obvious from the source code for RCTAsyncLocalStorage

Answer 4

You should NEVER save the username and password in plain text in client applications. Please note, never save sensitive data in plain text. You should use a token to authenticate the user.
Regarding the security of the AsyncStorage read this answer. TL;DR the data is safe unless the attacker have access to the device or the device is rooted(android)/jailbroken(iOS). The data is not encrypted. So, with root or physical access to the device (and the device is not protected) it is possible to access to that data.