title: Save sensitive data in React Native
body: <p>I am building a React Native application and I need to save some sensitive data like a token and a refresh token. The obvious solution is to save that information using <a href="https://facebook.github.io/react-native/docs/asyncstorage.html" rel="noreferrer">AsyncStorage</a>. The problem is the security level of the AsyncStorage. </p>
  
  <blockquote>
    <p>AsyncStorage provides a way to locally store tokens and data. It can
    be, in some ways, compared to a LocalStorage option. In full
    production applications, it is recommended to not access AsyncStorage
    directly, but instead, to use an abstraction layer, as AsyncStorage is
    shared with other apps using the same browser, and thus an
    ill-conceieved removal of all items from storage could impair the
    functioning of neighboring apps.</p>
  </blockquote>
  
  <p><a href="https://auth0.com/blog/adding-authentication-to-react-native-using-jwt/" rel="noreferrer">https://auth0.com/blog/adding-authentication-to-react-native-using-jwt/</a></p>
  
  <p>In a native app, I would go for <code>Keychain</code> in <code>iOS</code> and <code>Shared Preferences</code> in <strong>private mode</strong> in <code>Android</code>. </p>
  
  <p>For what I read in the documentation provided by React Native:</p>
  
  <blockquote>
    <p>On iOS, AsyncStorage is backed by native code that stores small values
    in a serialized dictionary and larger values in separate files. On
    Android, AsyncStorage will use either RocksDB or SQLite based on what
    is available.</p>
  </blockquote>
  
  <p><a href="https://facebook.github.io/react-native/docs/asyncstorage.html" rel="noreferrer">https://facebook.github.io/react-native/docs/asyncstorage.html</a></p>
  
  <p>They never talk about the security of that data. </p>
  
  <p>It is the best solution create a module for <code>Android</code> (that uses <code>Shared Preferences</code> in <strong>private mode</strong>) and another for <code>iOS</code> (that uses <strong>Keychain</strong>) to save the sensible data? Or it is safe to use the <code>AsyncStorage</code> methods provided?</p>