--- description: Use the Capacitor Biometrics plugin and Secure Preferences to store credentials and authenticate with Face ID or fingerprint on Android and iOS. title: How to Securely Store Credentials with Capacitor - Capawesome image: https://capawesome.io/docs/assets/images/social/blog/how-to-securely-store-credentials-with-capacitor.png --- [Skip to content ](#how-to-securely-store-credentials-with-capacitor) [🖥️ Introducing the **Capacitor Electron Platform** — build desktop apps for macOS, Windows, and Linux. Free & open source. ](/blog/announcing-the-capacitor-electron-platform/) * [ SDKs ](/docs/sdks/) * [ Formbricks ](/docs/sdks/capacitor/formbricks/) * [ Geocoder ](/docs/sdks/capacitor/geocoder/) * [ Google Sign-In ](/docs/sdks/capacitor/google-sign-in/) * [ Grafana Faro ](/docs/sdks/capacitor/grafana-faro/) * [ Gyroscope ](/docs/sdks/capacitor/gyroscope/) * [ Haptics ](/docs/sdks/capacitor/haptics/) * [ Home Indicator ](/docs/sdks/capacitor/home-indicator/) * [ In-App Browser ](/docs/sdks/capacitor/in-app-browser/) * [ Install Referrer ](/docs/sdks/capacitor/install-referrer/) * [ Intercom ](/docs/sdks/capacitor/intercom/) * [ Intune ](/docs/sdks/capacitor/intune/) * [ Keep Awake ](/docs/sdks/capacitor/keep-awake/) * [ libSQL ](/docs/sdks/capacitor/libsql/) * [ Light Sensor ](/docs/sdks/capacitor/light-sensor/) * [ Live Update ](/docs/sdks/capacitor/live-update/) * [ Localization ](/docs/sdks/capacitor/localization/) * [ Mail Composer ](/docs/sdks/capacitor/mail-composer/) * [ Managed Configurations ](/docs/sdks/capacitor/managed-configurations/) * [ Maps Launcher ](/docs/sdks/capacitor/maps-launcher/) * [ Media Session ](/docs/sdks/capacitor/media-session/) * [ ML Kit ](/docs/sdks/capacitor/mlkit/) * [ Navigation Bar ](/docs/sdks/capacitor/navigation-bar/) * [ Network ](/docs/sdks/capacitor/network/) * [ NFC ](/docs/sdks/capacitor/nfc/) * [ Node.js ](/docs/sdks/capacitor/nodejs/) * [ OAuth ](/docs/sdks/capacitor/oauth/) * [ Passkeys ](/docs/sdks/capacitor/passkeys/) * [ Password Autofill ](/docs/sdks/capacitor/password-autofill/) * [ PDF Generator ](/docs/sdks/capacitor/pdf-generator/) * [ PDF Viewer ](/docs/sdks/capacitor/pdf-viewer/) * [ Pedometer ](/docs/sdks/capacitor/pedometer/) * [ Permissions ](/docs/sdks/capacitor/permissions/) * [ Phone Dialer ](/docs/sdks/capacitor/phone-dialer/) * [ Photo Editor ](/docs/sdks/capacitor/photo-editor/) * [ Photo Manipulator ](/docs/sdks/capacitor/photo-manipulator/) * [ PixLive ](/docs/sdks/capacitor/pixlive/) * [ PostHog ](/docs/sdks/capacitor/posthog/) * [ Printer ](/docs/sdks/capacitor/printer/) * [ Privacy Screen ](/docs/sdks/capacitor/privacy-screen/) * [ Proximity Sensor ](/docs/sdks/capacitor/proximity-sensor/) * [ Purchases ](/docs/sdks/capacitor/purchases/) * [ RealtimeKit ](/docs/sdks/capacitor/realtimekit/) * [ Root Detection ](/docs/sdks/capacitor/root-detection/) * [ Screen Brightness ](/docs/sdks/capacitor/screen-brightness/) * [ Screen Orientation ](/docs/sdks/capacitor/screen-orientation/) * [ Screen Reader ](/docs/sdks/capacitor/screen-reader/) * [ Screenshot ](/docs/sdks/capacitor/screenshot/) * [ Secure Preferences ](/docs/sdks/capacitor/secure-preferences/) * [ Settings Launcher ](/docs/sdks/capacitor/settings-launcher/) * [ Shake ](/docs/sdks/capacitor/shake/) * [ Silent Mode ](/docs/sdks/capacitor/silent-mode/) * [ SIM ](/docs/sdks/capacitor/sim/) * [ SMS Composer ](/docs/sdks/capacitor/sms-composer/) * [ Speech Recognition ](/docs/sdks/capacitor/speech-recognition/) * [ Speech Synthesis ](/docs/sdks/capacitor/speech-synthesis/) * [ Share Target ](/docs/sdks/capacitor/share-target/) * [ Square Mobile Payments ](/docs/sdks/capacitor/square-mobile-payments/) * [ SQLite ](/docs/sdks/capacitor/sqlite/) * [ Superwall ](/docs/sdks/capacitor/superwall/) * [ System WebView ](/docs/sdks/capacitor/system-webview/) * [ Tauri ](/docs/sdks/capacitor/tauri/) * [ Text Interaction ](/docs/sdks/capacitor/text-interaction/) * [ Text Zoom ](/docs/sdks/capacitor/text-zoom/) * [ Thermal State ](/docs/sdks/capacitor/thermal-state/) * [ Toast ](/docs/sdks/capacitor/toast/) * [ Torch ](/docs/sdks/capacitor/torch/) * [ Vault ](/docs/sdks/capacitor/vault/) * [ Volume ](/docs/sdks/capacitor/volume/) * [ Wallet ](/docs/sdks/capacitor/wallet/) * [ Wifi ](/docs/sdks/capacitor/wifi/) * [ YouTube Player ](/docs/sdks/capacitor/youtube-player/) * [ Zip ](/docs/sdks/capacitor/zip/) * [ Cordova ](/docs/sdks/cordova/) * [ Cloud ](/docs/cloud/) * [ Integrations ](/docs/cloud/live-updates/integrations/) * Concepts * Reference * [ Troubleshooting ](/docs/cloud/live-updates/troubleshooting/) * [ FAQ ](/docs/cloud/live-updates/faq/) * [ Native Builds ](/docs/cloud/native-builds/) * [ Set Up Environments ](/docs/cloud/native-builds/environments/) * [ Overwrite Native Configurations ](/docs/cloud/native-builds/native-configurations/) * [ Auto-Increment Build Numbers ](/docs/cloud/native-builds/auto-incrementing-build-numbers/) * [ Configure the Web Build Script ](/docs/cloud/native-builds/web-build-script/) * [ Build from a Monorepo ](/docs/cloud/native-builds/monorepo/) * [ Use pnpm, Yarn, or bun ](/docs/cloud/native-builds/package-managers/) * [ Install Private npm Packages ](/docs/cloud/native-builds/npm-private-registry/) * [ Override the Java Version ](/docs/cloud/native-builds/override-java-version/) * [ Custom iOS Provisioning Profiles ](/docs/cloud/native-builds/custom-ios-provisioning-profiles/) * [ Build without Git ](/docs/cloud/native-builds/build-without-git/) * [ Access Git Behind a Firewall ](/docs/cloud/native-builds/firewall-access/) * [ Integrations ](/docs/cloud/native-builds/integrations/) * Reference * [ Troubleshooting ](/docs/cloud/native-builds/troubleshooting/) * [ FAQ ](/docs/cloud/native-builds/faq/) * [ App Store Publishing ](/docs/cloud/app-store-publishing/) * [ Submit a Build ](/docs/cloud/app-store-publishing/submit-a-build/) * [ Submit Automatically After a Build ](/docs/cloud/app-store-publishing/submit-automatically/) * [ Troubleshooting ](/docs/cloud/app-store-publishing/troubleshooting/) * [ FAQ ](/docs/cloud/app-store-publishing/faq/) * [ Automations ](/docs/cloud/automations/) * [ Reference ](/docs/cloud/automations/reference/) * [ Troubleshooting ](/docs/cloud/automations/troubleshooting/) * [ FAQ ](/docs/cloud/automations/faq/) * [ Assist ](/docs/cloud/assist/) * [ CLI ](/docs/cloud/cli/) * APIs and SDKs * [ Webhooks ](/docs/cloud/webhooks/) * [ Integrations ](/docs/cloud/integrations/) * Account * [ Organization ](/docs/cloud/organizations/) * [ Two-Factor Enforcement ](/docs/cloud/organizations/two-factor-authentication/) * [ Audit Logs ](/docs/cloud/organizations/audit-logs/) * [ Billing ](/docs/cloud/organizations/billing/) * [ License Keys ](/docs/cloud/license-keys/) * [ AI ](/docs/ai/) * [ Insiders ](/docs/insiders/) * [ Billing & Plans ](/docs/insiders/billing-and-plans/) * [ FAQ ](/docs/insiders/faq/) * [ License ](https://capawesome.io/legal/eula/) * [ Support ](/docs/support/) * [ Contributing ](/docs/contributing/) * Contributing code * [ Code of Conduct ](/docs/contributing/code-of-conduct/) * [ Questions ](https://docs.github.com/en/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion#creating-a-discussion) * [ Blog ](/blog/) * Categories * [ Usage ](#usage) * [ Hardening the Rest of Your App ](#hardening-the-rest-of-your-app) * [ Going Passwordless with Passkeys ](#going-passwordless-with-passkeys) * [ FAQ ](#faq) * [ Conclusion ](#conclusion) * Related links # How to Securely Store Credentials with Capacitor[¶](#how-to-securely-store-credentials-with-capacitor "Permanent link") A common requirement for mobile apps is secure storage of credentials (passwords, tokens, API keys) and user authentication via **biometrics** (fingerprint, Face ID). With Ionic's Identity Vault and Secure Storage [no longer maintained](https://ionic.io/blog/important-announcement-the-future-of-ionics-commercial-products), you can achieve the same with the [Capacitor Biometrics plugin](/docs/sdks/capacitor/biometrics/) and [Capacitor Secure Preferences plugin](/docs/sdks/capacitor/secure-preferences/). For a complete walkthrough on the Biometrcis plugin make sure to read [Exploring the Capacitor Biometrics API](/blog/exploring-the-capacitor-biometrics-api/). ## Introduction[¶](#introduction "Permanent link") In this guide, we will show you how to securely store credentials and authenticate users using the Capacitor Biometrics and Secure Preferences plugins. This solution is cross-platform and works on both Android and iOS. ## Installation[¶](#installation "Permanent link") First, you need to install these two plugins in your Capacitor app. ### Biometrics[¶](#biometrics "Permanent link") Refer to [Getting Started with Insiders](/docs/insiders/getting-started/?plugin=capacitor-biometrics) and follow the instructions to install the plugin. After installation, follow the platform-specific instructions in the [Android](/docs/sdks/capacitor/biometrics/#android) and [iOS](/docs/sdks/capacitor/biometrics/#ios) sections. ### Secure Preferences[¶](#secure-preferences "Permanent link") Refer to [Getting Started with Insiders](/docs/insiders/getting-started/?plugin=capacitor-secure-preferences) and follow the instructions to install the plugin. After installation, follow the platform-specific instructions in the [Android](/docs/sdks/capacitor/secure-preferences/#android) section. ## Usage[¶](#usage "Permanent link") The following example demonstrates how to use the plugins to securely store credentials and authenticate users with biometrics. ### Storing Credentials[¶](#storing-credentials "Permanent link") First, we need to implement the functionality for storing credentials. The example below shows how to sign in a user with a username and password and securely store the credentials: `[](#%5F%5Fcodelineno-0-1)import { SecurePreferences } from '@capawesome-team/capacitor-secure-preferences'; [](#%5F%5Fcodelineno-0-2) [](#%5F%5Fcodelineno-0-3)const signInWithCredentials = async (username: string, password: string) => { [](#%5F%5Fcodelineno-0-4) const isValid = validateCredentials(username, password); [](#%5F%5Fcodelineno-0-5) if (isValid) { [](#%5F%5Fcodelineno-0-6) await storeCredentials(username, password); [](#%5F%5Fcodelineno-0-7) return true; [](#%5F%5Fcodelineno-0-8) } else { [](#%5F%5Fcodelineno-0-9) return false; [](#%5F%5Fcodelineno-0-10) } [](#%5F%5Fcodelineno-0-11)}; [](#%5F%5Fcodelineno-0-12) [](#%5F%5Fcodelineno-0-13)const validateCredentials = (username: string, password: string): boolean => { [](#%5F%5Fcodelineno-0-14) // Validate the credentials (e.g. perform a network request to your backend). [](#%5F%5Fcodelineno-0-15) return username === 'user' && password === 'password'; [](#%5F%5Fcodelineno-0-16)}; [](#%5F%5Fcodelineno-0-17) [](#%5F%5Fcodelineno-0-18)const storeCredentials = async (username: string, password: string) => { [](#%5F%5Fcodelineno-0-19) // Recommended: Prompt the user for biometric authentication before storing the credentials. [](#%5F%5Fcodelineno-0-20) await SecurePreferences.set({ [](#%5F%5Fcodelineno-0-21) key: 'credentials', [](#%5F%5Fcodelineno-0-22) value: JSON.stringify({ username, password }), [](#%5F%5Fcodelineno-0-23) }); [](#%5F%5Fcodelineno-0-24)}; ` The `signInWithCredentials(...)` function first validates the credentials and then securely stores them using the [set(...)](/docs/sdks/capacitor/secure-preferences/#set) method of the Secure Preferences plugin. The credentials are stored as a JSON string because the Secure Preferences plugin only accepts strings as values. The `validateCredentials()` function is a placeholder for your own logic to validate the credentials, such as making a network request to your backend. You should replace it with your own implementation. ### Retrieving Credentials[¶](#retrieving-credentials "Permanent link") Next, we need to implement the functionality for retrieving credentials and authenticating the user with biometrics. The `signInWithBiometrics(...)` function first checks if credentials are stored and then authenticates the user with biometrics using the Biometrics plugin: `[](#%5F%5Fcodelineno-1-1)import { Biometrics, ErrorCode } from '@capawesome-team/capacitor-biometrics'; [](#%5F%5Fcodelineno-1-2)import { SecurePreferences } from '@capawesome-team/capacitor-secure-preferences'; [](#%5F%5Fcodelineno-1-3) [](#%5F%5Fcodelineno-1-4)const signInWithBiometrics = async () => { [](#%5F%5Fcodelineno-1-5) const areCredentialsStored = await areCredentialsStored(); [](#%5F%5Fcodelineno-1-6) if (!areCredentialsStored) { [](#%5F%5Fcodelineno-1-7) return false; [](#%5F%5Fcodelineno-1-8) } [](#%5F%5Fcodelineno-1-9) try { [](#%5F%5Fcodelineno-1-10) await Biometrics.authenticate(); [](#%5F%5Fcodelineno-1-11) } catch (error) { [](#%5F%5Fcodelineno-1-12) return false; [](#%5F%5Fcodelineno-1-13) } [](#%5F%5Fcodelineno-1-14) const credentials = await retrieveCredentials(); [](#%5F%5Fcodelineno-1-15) return signInWithCredentials(credentials.username, credentials.password); [](#%5F%5Fcodelineno-1-16)}; [](#%5F%5Fcodelineno-1-17) [](#%5F%5Fcodelineno-1-18)const areCredentialsStored = async () => { [](#%5F%5Fcodelineno-1-19) const { value } = await SecurePreferences.get({ key: 'credentials' }); [](#%5F%5Fcodelineno-1-20) return !!value; [](#%5F%5Fcodelineno-1-21)}; [](#%5F%5Fcodelineno-1-22) [](#%5F%5Fcodelineno-1-23)const retrieveCredentials = async () => { [](#%5F%5Fcodelineno-1-24) const { value } = await SecurePreferences.get({ key: 'credentials' }); [](#%5F%5Fcodelineno-1-25) return JSON.parse(value); [](#%5F%5Fcodelineno-1-26)}; ` If biometric authentication is successful, the credentials are retrieved from the Secure Preferences plugin using the [get(...)](/docs/sdks/capacitor/secure-preferences/#get) method and passed to the `signInWithCredentials(...)` function to sign in the user. If authentication fails, the function simply returns `false`. ## Hardening the Rest of Your App[¶](#hardening-the-rest-of-your-app "Permanent link") Secure storage protects the credentials at rest, but the surrounding runtime matters just as much. A few complementary plugins help you close the remaining gaps: * **Detect compromised devices.** On a rooted or jailbroken device, the OS-level guarantees behind secure storage can no longer be trusted. The [Capacitor Root Detection plugin](/docs/sdks/capacitor/root-detection/) detects rooted and jailbroken devices, emulators, and developer mode, so you can warn the user or limit sensitive features. * **Verify app and device integrity.** To make sure requests to your backend come from a genuine, untampered build of your app, the [Capacitor App Integrity plugin](/docs/sdks/capacitor/app-integrity/) uses the Play Integrity API on Android and App Attest on iOS, with server-side verification. * **Hide sensitive content from prying eyes.** The [Capacitor Privacy Screen plugin](/docs/sdks/capacitor/privacy-screen/) blurs your app in the app switcher, blocks screenshots, and can detect when a screenshot is taken — useful on screens that display tokens, recovery codes, or personal data. ## Going Passwordless with Passkeys[¶](#going-passwordless-with-passkeys "Permanent link") The most secure credential is the one you never have to store. Passkeys replace passwords with a public–private key pair backed by the device's biometric hardware, so there is nothing for an attacker to phish or steal from your storage. If you're starting a new sign-in flow, consider the [Capacitor Passkeys plugin](/docs/sdks/capacitor/passkeys/), which lets users create and authenticate with passkeys based on the WebAuthn standard on Android, iOS, and the web. If you do keep username-and-password login, you can still lean on the operating system's own credential manager instead of rolling everything yourself. The [Capacitor Password Autofill plugin](/docs/sdks/capacitor/password-autofill/) saves passwords to the platform credential store after a successful in-app login, so the OS can offer to autofill them the next time the user signs in. ## FAQ[¶](#faq "Permanent link") ### How is Secure Preferences different from the Capacitor Preferences API?[¶](#how-is-secure-preferences-different-from-the-capacitor-preferences-api "Permanent link") The official Preferences API stores values in plain, unencrypted storage. The [Capacitor Secure Preferences plugin](/docs/sdks/capacitor/secure-preferences/) encrypts them at rest using the platform keystore — the Android Keystore and the iOS Keychain — so sensitive values like tokens and passwords aren't readable if the device storage is inspected. ### Does biometric authentication store the credentials for me?[¶](#does-biometric-authentication-store-the-credentials-for-me "Permanent link") No. Biometrics and secure storage do two different jobs: the [Capacitor Biometrics plugin](/docs/sdks/capacitor/biometrics/) gates _access_ with Face ID or fingerprint, while the [Capacitor Secure Preferences plugin](/docs/sdks/capacitor/secure-preferences/) _stores_ the credentials encrypted. You combine them — authenticate, then read from secure storage — as shown in [Retrieving Credentials](#retrieving-credentials). ### What happens on devices without biometric hardware?[¶](#what-happens-on-devices-without-biometric-hardware "Permanent link") Check availability before prompting and provide a fallback — typically the device passcode or your own password screen. Handle the "not available" or "not enrolled" result from the Biometrics plugin so the flow degrades gracefully instead of throwing an error. ### Should I store passwords at all?[¶](#should-i-store-passwords-at-all "Permanent link") Often you don't need to. Passwordless sign-in with passkeys removes stored secrets entirely, and letting the OS credential manager autofill passwords keeps them out of your own storage. See [Going Passwordless with Passkeys](#going-passwordless-with-passkeys). ## Conclusion[¶](#conclusion "Permanent link") This guide showed how to store credentials and authenticate users with the [Capacitor Biometrics plugin](/docs/sdks/capacitor/biometrics/) and [Capacitor Secure Preferences plugin](/docs/sdks/capacitor/secure-preferences/). Please note that this is a basic example — adapt it to your requirements and consider prompting for biometric authentication before storing credentials. For the full plugin documentation, see the [API Reference](/docs/sdks/capacitor/biometrics/#api). **Additional resources:** * [Capacitor Biometrics Demo App](https://github.com/capawesome-team/capacitor-biometrics-demo) * [Step-by-step video](https://www.youtube.com/watch?v=ixUvTX6n7x8) **Related reading:** * [Exploring the Capacitor Biometrics API](/blog/exploring-the-capacitor-biometrics-api/) * [Announcing the Capacitor Biometrics Plugin](/blog/announcing-the-capacitor-biometrics-plugin/) * [Alternative to the Ionic Identity Vault plugin](/blog/alternative-to-ionic-identity-vault-plugin/) Follow [Capawesome on X](https://twitter.com/capawesomeio) and subscribe to the [Capawesome newsletter](/newsletter/) to stay updated. July 15, 2026 Back to top ```json { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "How to Securely Store Credentials with Capacitor", "description": "Use the Capacitor Biometrics plugin and Secure Preferences to store credentials and authenticate with Face ID or fingerprint on Android and iOS.", "image": "https://capawesome.io/assets/banners/cloud-build-and-deploy-capacitor-apps.png", "datePublished": "2025-05-03T00:00:00+00:00", "dateModified": "2026-07-14T00:00:00+00:00", "author": [ { "@type": "Person", "name": "Robin Genz", "url": "https://github.com/robingenz" } ], "publisher": { "@type": "Organization", "name": "Capawesome", "url": "https://capawesome.io", "logo": { "@type": "ImageObject", "url": "https://capawesome.io/assets/images/logo.svg" } }, "articleSection": "Capacitor", "keywords": ["Capacitor", "Guides", "SDKs"], "isPartOf": { "@type": "Blog", "@id": "https://capawesome.io/blog/#blog" }, "mainEntityOfPage": "https://capawesome.io/blog/how-to-securely-store-credentials-with-capacitor/", "url": "https://capawesome.io/blog/how-to-securely-store-credentials-with-capacitor/" } { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://capawesome.io/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://capawesome.io/blog/" }, { "@type": "ListItem", "position": 3, "name": "How to Securely Store Credentials with Capacitor", "item": "https://capawesome.io/blog/how-to-securely-store-credentials-with-capacitor/" } ] } {"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "How is Secure Preferences different from the Capacitor Preferences API?", "acceptedAnswer": {"@type": "Answer", "text": "The official Preferences API stores values in plain, unencrypted storage. The Capacitor Secure Preferences plugin encrypts them at rest using the platform keystore — the Android Keystore and the iOS Keychain — so sensitive values like tokens and passwords aren't readable if the device storage is inspected."}}, {"@type": "Question", "name": "Does biometric authentication store the credentials for me?", "acceptedAnswer": {"@type": "Answer", "text": "No. Biometrics and secure storage do two different jobs: the Capacitor Biometrics plugin gates access with Face ID or fingerprint, while the Capacitor Secure Preferences plugin stores the credentials encrypted. You combine them — authenticate, then read from secure storage — as shown in Retrieving Credentials."}}, {"@type": "Question", "name": "What happens on devices without biometric hardware?", "acceptedAnswer": {"@type": "Answer", "text": "Check availability before prompting and provide a fallback — typically the device passcode or your own password screen. Handle the \"not available\" or \"not enrolled\" result from the Biometrics plugin so the flow degrades gracefully instead of throwing an error."}}, {"@type": "Question", "name": "Should I store passwords at all?", "acceptedAnswer": {"@type": "Answer", "text": "Often you don't need to. Passwordless sign-in with passkeys removes stored secrets entirely, and letting the OS credential manager autofill passwords keeps them out of your own storage. See Going Passwordless with Passkeys."}}], "url": "https://capawesome.io/blog/how-to-securely-store-credentials-with-capacitor/"} ```