---
title: "How do you store tokens securely in a web or mobile app?"  
description: "How do you store tokens securely in a web or mobile app?"  
author: "ICSM Computer"  
published: 2025-06-10  
updated: 2025-06-10  
canonical: https://www.mindstick.com/interview/34228/how-do-you-store-tokens-securely-in-a-web-or-mobile-app  
category: "c#"  
tags: ["c#", "authentication", "authorization"]  
reading_time: 5 minutes  

---

# How do you store tokens securely in a web or mobile app?

Storing authentication tokens (like **JWTs**, **OAuth access tokens**, **refresh tokens**, or **API keys**) securely is crucial to preventing unauthorized access and token theft.

Here’s a breakdown based on **platform**:

## 1. Web Apps (Browser-based)

### Tokens to Store

- Access token (short-lived)
- Refresh token (optional)

### Best Practices

| Storage | Secure? | Comments |
| --- | --- | --- |
| `Memory` (JavaScript variable) | Yes | Safest — not persisted. Use in SPAs. But token lost on refresh. |
| `HttpOnly Cookie` | Yes | Can’t be read by JavaScript (protects from XSS). Needs `SameSite`, `Secure`, `HttpOnly`. |
| `localStorage` / `sessionStorage` | NO | Vulnerable to XSS attacks. Should be avoided for long-lived tokens. |

### Recommendation

- **Use** `HttpOnly` **secure cookies** for session-based tokens (with CORS configured properly).
- Or store **access token in memory only** (short-lived).
- Never store tokens in `localStorage` unless absolutely necessary and XSS risk is well mitigated.

## 2. Mobile Apps (iOS, Android, etc.)

### Best Practices

| Platform | Storage API | Comments |
| --- | --- | --- |
| Android | **EncryptedSharedPreferences** or **Android Keystore** | Keys are encrypted and stored securely. |
| iOS | **Keychain Services** | Secure, encrypted storage for credentials and tokens. |
| Flutter / React Native | Use plugins like `flutter_secure_storage`, `react-native-keychain` | Wraps native secure storage. |

### Tips

- Don’t store access tokens in plain storage or logs.
- Use short-lived access tokens and refresh tokens with strong rotation policies.
- Protect against reverse engineering — obfuscate code, don’t hardcode secrets.

## 3. Desktop Apps (Electron, WPF, etc.)

| Framework | Secure Storage |
| --- | --- |
| Electron | OS keychain (via Node.js modules like `keytar`) |
| .NET (WPF/WinForms) | Windows DPAPI (`ProtectedData`) |

Example in C#:

```cs
byte[] encrypted = ProtectedData.Protect(
    Encoding.UTF8.GetBytes(token),
    null,
    DataProtectionScope.CurrentUser);
```

## Bonus: Refresh Token Strategy

For SPAs or mobile apps:

- Store **access token in memory**
- Store **refresh token** securely (cookie or secure storage)
- Rotate access token frequently
- On expiration, send refresh token to renew access token

## What Not to Do

- Don’t store tokens in `localStorage` or `sessionStorage` if you care about **XSS protection**.
- Don’t hardcode API keys or secrets in frontend JavaScript or mobile app binaries.
- Don’t store tokens in plain files or logs.

## Summary

| Platform | Best Storage |
| --- | --- |
| Web SPA | Memory (access), HttpOnly cookie (refresh) |
| Web (traditional) | HttpOnly secure cookie |
| Android | EncryptedSharedPreferences or Keystore |
| iOS | Keychain |
| Desktop | DPAPI / Keytar |

## Answers

### Answer by ICSM Computer

Storing authentication tokens (like **JWTs**, **OAuth access tokens**, **refresh tokens**, or **API keys**) securely is crucial to preventing unauthorized access and token theft.

Here’s a breakdown based on **platform**:

## 1. Web Apps (Browser-based)

### Tokens to Store

- Access token (short-lived)
- Refresh token (optional)

### Best Practices

| Storage | Secure? | Comments |
| --- | --- | --- |
| `Memory` (JavaScript variable) | Yes | Safest — not persisted. Use in SPAs. But token lost on refresh. |
| `HttpOnly Cookie` | Yes | Can’t be read by JavaScript (protects from XSS). Needs `SameSite`, `Secure`, `HttpOnly`. |
| `localStorage` / `sessionStorage` | NO | Vulnerable to XSS attacks. Should be avoided for long-lived tokens. |

### Recommendation

- **Use** `HttpOnly` **secure cookies** for session-based tokens (with CORS configured properly).
- Or store **access token in memory only** (short-lived).
- Never store tokens in `localStorage` unless absolutely necessary and XSS risk is well mitigated.

## 2. Mobile Apps (iOS, Android, etc.)

### Best Practices

| Platform | Storage API | Comments |
| --- | --- | --- |
| Android | **EncryptedSharedPreferences** or **Android Keystore** | Keys are encrypted and stored securely. |
| iOS | **Keychain Services** | Secure, encrypted storage for credentials and tokens. |
| Flutter / React Native | Use plugins like `flutter_secure_storage`, `react-native-keychain` | Wraps native secure storage. |

### Tips

- Don’t store access tokens in plain storage or logs.
- Use short-lived access tokens and refresh tokens with strong rotation policies.
- Protect against reverse engineering — obfuscate code, don’t hardcode secrets.

## 3. Desktop Apps (Electron, WPF, etc.)

| Framework | Secure Storage |
| --- | --- |
| Electron | OS keychain (via Node.js modules like `keytar`) |
| .NET (WPF/WinForms) | Windows DPAPI (`ProtectedData`) |

Example in C#:

```cs
byte[] encrypted = ProtectedData.Protect(
    Encoding.UTF8.GetBytes(token),
    null,
    DataProtectionScope.CurrentUser);
```

## Bonus: Refresh Token Strategy

For SPAs or mobile apps:

- Store **access token in memory**
- Store **refresh token** securely (cookie or secure storage)
- Rotate access token frequently
- On expiration, send refresh token to renew access token

## What Not to Do

- Don’t store tokens in `localStorage` or `sessionStorage` if you care about **XSS protection**.
- Don’t hardcode API keys or secrets in frontend JavaScript or mobile app binaries.
- Don’t store tokens in plain files or logs.

## Summary

| Platform | Best Storage |
| --- | --- |
| Web SPA | Memory (access), HttpOnly cookie (refresh) |
| Web (traditional) | HttpOnly secure cookie |
| Android | EncryptedSharedPreferences or Keystore |
| iOS | Keychain |
| Desktop | DPAPI / Keytar |


---

Original Source: https://www.mindstick.com/interview/34228/how-do-you-store-tokens-securely-in-a-web-or-mobile-app

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.