Protecting credentials.
WHAT THE KEYCHAIN IS
An encrypted store for passwords, tokens, keys and certificates.
WHAT IT PROVIDES
Encryption at rest Access controlled by the application that stored the item Optional requirement of device unlock or biometrics
WHAT TO STORE THERE
Authentication tokens Passwords Encryption keys Anything sensitive
WHAT NOT TO STORE ELSEWHERE
Any of those.
WHY NOT PREFERENCE STORAGE
It is unencrypted and included in backups.
WHAT ACCESSIBILITY SETTINGS CONTROL
When an item can be read: always, after first unlock, or only while unlocked.
WHAT TO CHOOSE
The most restrictive that works.
WHAT THE THIS-DEVICE-ONLY VARIANTS DO
Prevent an item being included in backups or synchronised.
WHAT TO USE THEM FOR
Anything that must not leave the device.
WHAT SHARING BETWEEN APPLICATIONS REQUIRES
A shared access group, and matching team identity.
WHAT THE SECURE ENCLAVE ADDS
Keys generated and used inside dedicated hardware, never extractable.
WHAT TO USE IT FOR
Keys protecting anything valuable.
