Android Developer interview question
How do you store sensitive data on Android?
Store sensitive Android data minimally, use platform-backed encrypted storage or Keystore keys, never hard-code secrets, protect exported components, validate deep links, and assume a compromised client cannot keep server secrets.
Direct answer
What a strong answer covers
How it works
Start by not storing what is not needed. For what remains, secrets such as tokens go into storage backed by the Android Keystore, where the key material never leaves secure hardware; EncryptedSharedPreferences or an encrypted database use those keys for data at rest. API keys compiled into the app are extractable by anyone with the APK, so anything that must stay secret lives on the server behind authenticated calls. Exported activities and content providers are locked down, deep-link parameters are validated, and the app never trusts its own client-side checks for authorisation.
Example
A banking app stores the refresh token in a Keystore-backed encrypted preferences file with user authentication required for key use, so even a rooted device cannot read it without the device unlock. The third-party maps key is restricted by package name and signing certificate in the provider console, because it cannot be hidden in the APK.
Common mistakes
- Putting secrets in BuildConfig or strings.xml and assuming obfuscation hides them.
- Writing tokens to plain SharedPreferences or logging them in debug builds.
- Leaving a content provider exported and letting other apps read the database.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.