# Secure Storage

**URL:** <https://forums.fusetools.com/t/secure-storage/4070>\
**Category:** How-to Discussions\
**Created:** [June 9, 2017, 11:54am UTC](https://forums.fusetools.com/t/secure-storage/4070 "2017-06-09T11:54:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wander.araujo.fernan](https://avatars.discourse-cdn.com/v4/letter/w/ac91a4/32.png) [@wander.araujo.fernan](https://forums.fusetools.com/u/wander.araujo.fernan)\
**Post date:** [June 9, 2017, 11:54am UTC](https://forums.fusetools.com/t/secure-storage/4070/1 "2017-06-09T11:54:24Z")

</div>

How secure is Storage Module for important data such as username and password. So far I have not seen any answer or solution to this problem. Sqlite more secure ?

---

<div class="post-metadata">

**Author:** ![Uldis](https://yyz1.discourse-cdn.com/flex035/user_avatar/forums.fusetools.com/uldis/32/657_2.png) [@Uldis](https://forums.fusetools.com/u/Uldis)\
**Post date:** [June 9, 2017, 11:58am UTC](https://forums.fusetools.com/t/secure-storage/4070/2 "2017-06-09T11:58:12Z")

</div>

Hi,

any kind of local storage should be considered _insecure_. You should never store a username and a password on device.

---

<div class="post-metadata">

**Author:** ![wander.araujo.fernan](https://avatars.discourse-cdn.com/v4/letter/w/ac91a4/32.png) [@wander.araujo.fernan](https://forums.fusetools.com/u/wander.araujo.fernan)\
**Post date:** [June 9, 2017, 12:27pm UTC](https://forums.fusetools.com/t/secure-storage/4070/3 "2017-06-09T12:27:03Z")

</div>

Thanks for the quick reply.

Remenber login data is very common function in mobile applications.

What approach take in this situation ?

---

<div class="post-metadata">

**Author:** ![Uldis](https://yyz1.discourse-cdn.com/flex035/user_avatar/forums.fusetools.com/uldis/32/657_2.png) [@Uldis](https://forums.fusetools.com/u/Uldis)\
**Post date:** [June 9, 2017, 12:33pm UTC](https://forums.fusetools.com/t/secure-storage/4070/4 "2017-06-09T12:33:06Z")

</div>

If you’re looking for a properly secure local storage, you should consider using [Android Keystore](https://developer.android.com/reference/java/security/KeyStore.html) and [Apple Keychain](https://developer.apple.com/library/content/documentation/Security/Conceptual/keychainServConcepts/01introduction/introduction.html).

If you’re only building an authentication mechanism against an external API, you should consider an approach where you do not store username and password, but instead rely on sending those to the backend, then receiving a token and storing that instead. A popular implementation you’ve probably seen elsewhere is the [OAuth2 protocol](https://aaronparecki.com/oauth-2-simplified/).

Hope this helps!