v10.0.0

This major release brings significant security improvements, platform updates, and modernization across all supported platforms.

Android

Due to the deprecation of Jetpack Security library, the Android implementation has been largely rewritten with custom secure ciphers, enhanced biometrics support, and migration tools.

Breaking Changes:

• AndroidOptions().encryptedSharedPreferences is now deprecated due to Jetpack Crypto package deprecation
  • Migration will automatically happen due to migrateOnAlgorithmChange: true, which can also be set to false if not wanted.
• ResetOnError will now automatically be true, because most errors are unrecoverable due to key storage problems. It can still be disabled with resetOnError: false
• Default key cipher changed to RSA_ECB_OAEPwithSHA_256andMGF1Padding
• Default storage cipher changed to AES_GCM_NoPadding
• Minimum Android SDK changed from 19 to 23
• Target SDK updated to 36
• Migrated from deprecated Jetpack Crypto library to custom cipher implementation (Tink doesn't support biometrics)
• Migrated to Java Version 17

New Features:

• New named constructors: AndroidOptions(), AndroidOptions.biometric()
• AndroidOptions().migrateOnAlgorithmChange automatically migrates data to new ciphers when enabled
• Improved biometric authentication with graceful degradation when device has no security setup
• Migration tools for transitioning from deprecated encryptedSharedPreferences
• Enhanced error handling with proper exception messages for biometric unavailability

Fixes:

• Fixed biometric authentication on devices without security (PIN/pattern/password) - now gracefully degrades when enforceBiometrics=false
• Fixed storage cipher and key cipher pairing validation
• Fixed migration checks for encrypted shared preferences
• Fixed biometric permission handling
• Fixed exception when reading data after boot

Other Changes:

• Updated Gradle, Kotlin, and Tink dependencies
• Refactored custom cipher implementations for better maintainability
• Added delete key functions for proper reset handling
• Migrated to new analyzer and code cleanup

iOS / macOS (darwin)

• Merged iOS and macOS implementations into unified flutter_secure_storage_darwin package
• Added support for Swift Package Manager
• Remove keys regardless of synchronizable state or accessibility constraints
• Change minimum iOS version from 9 to 12
• Change minimum macOS version to 10.14
• Use serial queue for execution of keychain operations
• Added privacy manifest
• Refactored code and added missing options to IOSOptions and MacOSOptions
• Fixed warnings with Privacy Manifest
• Fixed delete and deleteAll when synchronizable is set
• Fixed migration when value is saved while key already exists with different accessibility option
• Use accessibility option for all operations
• Migrated to new analyzer and code cleanup

Web

• Web is now compatible with WASM
• Updated code style and migrated to very_good_analysis
• Add check for secure context (operations only allowed with secure context)
• Remove dart:io to support WASM build
• Migrated away from html to web package
• Removed js in favor of using js-interop
• Added useSessionStorage parameter to WebOptions for saving in session storage instead of local storage
• Updated web dependency support to <2.0.0
• Migrated to new analyzer and code cleanup

Windows

• Upgrades deprecated member usage of win32
• Migrated to win32 version 5.5.4 to support Dart 3.4 / Flutter 3.22.0
• Migrated to new analyzer and code cleanup
• Write encrypted data to files instead of the Windows credential system

Linux

• Fixed whitespace deprecation warning
• Reverted json.dump with indentations due to problems
• Fixed search with schemas fails in cold keyrings
• Fixed erase called on null
• Fixed memory management issue
• Remove and replace libjsoncpp1 dependency
• Migrated to new analyzer and code cleanup

Platform Interface

• Remove dart:io to support WASM build of web
• Migrated to new analyzer and code cleanup

General Improvements

• Listener functionality via FlutterSecureStorage().registerListener()
• All platforms updated to support Dart SDK <4.0.0
• Comprehensive test coverage improvements
• Documentation updates across all platforms

v10.0.0-beta.5

Due to security issues regarding the handling of biometrics in v10.0.0-beta.4, together with the deprecation
of Jetpack Security library, it took me some time to find a secure alternative. My apologies for the delay.

The Android part has been largely rewritten, reintroducing the customer cipher construction from before,
but with secure ciphers, biometrics support, updated default ciphers and migration tools.

Breaking Changes:

• AndroidOptions().encryptedSharedPreferences is now deprecated due to Jetpack Crypto package being deprecated
  For now you can still use deprecated encryptedSharedPreferences by setting encryptedSharedPreferences: true
  and migrateOnAlgorithmChange: false. If encryptedSharedPreferences is true and migrateOnAlgorithmChange
  is true, data will be automatically migrated to the new cipher, and encryptedSharedPreferences
  cannot be used anymore.
• Google recommends using Tink library, but Tink does not support biometrics, so custom ciphers have been reintroduced
• Default key cipher changed to RSA_ECB_OAEPwithSHA_256andMGF1Padding
• Default storage cipher changed to AES_GCM_NoPadding

New Features:

• New named constructors: AndroidOptions(), AndroidOptions.biometric()
• AndroidOptions().migrateOnAlgorithmChange automatically migrates data to new ciphers when enabled
• Improved biometric authentication with graceful degradation when device has no security setup
• Migration tools for transitioning from deprecated encryptedSharedPreferences
• Enhanced error handling with proper exception messages for biometric unavailability

Key Fixes:

• Fixed biometric authentication on devices without security (PIN/pattern/password) - now gracefully degrades when enforceBiometrics=false
• Fixed storage cipher and key cipher pairing validation
• Fixed migration checks for encrypted shared preferences
• Fixed biometric permission handling
• Fixed default resetOnError behavior (now defaults to true)

Other Changes:

• Target SDK 36
• Updated Gradle, Kotlin, and Tink dependencies
• Updated minimum SDK according to Flutter requirements
• Refactored custom cipher implementations for better maintainability
• Added delete key functions for proper reset handling

v10.0.0-beta.4

• [Apple] Merged iOS and macOS implementation into a new package flutter_secure_storage_darwin
• [Apple] Refactored code and added missing options
• [Apple] Added support for swift package manager
• [Web] Update flutter_secure_storage_platform_interface to be compatible with WASM.

v10.0.0-beta.3

• [iOS] Fix delete and deleteAll when synchronizable is set.
• [iOS] Update migration when value is saved while key already exists with different accessibility option.
• [Android] Fix deprecation warning.

v9.2.4

• [Android] Fix errors when building for release by upgrading Tink to 1.9.0.
• [iOS] Fix delete and deleteAll when synchronizable is set.
• [iOS] Update migration when value is saved while key already exists with different accessibility option.

v10.0.0-beta.2

[Web] Update flutter_secure_storage_platform_interface to be compatible with WASM.

v10.0.0-beta.1

This new major release has some big changes. This plugin requires a minimum dart SDK of 3.3.0 or higher
and a minimum flutter version of 3.19.0.

Android

• By default, encryptedSharedPreferences will be enabled, and cannot be disabled. If there is still
  data saved by previous versions using encryptedSharedPreferences = false, it will be automatically
  transferred to encryptedSharedPreferences.
• Migrated from deprecated Jetpack Crypto library to Google Tink Crypto library.
• Migrated to Android SDK 35
• Migrated to Java Version 17
• Minimum Android SDK is changed from 19 to 23.
• Migrated to new analyzer and clean-up code.
• Lots of minor code improvements

iOS

• Change minimum iOS version from 9 to 12
• Use serial queue for execution of iOS keychain operations
• Migrated to new analyzer and clean-up code.

Web

• Web is now migrated to be compatible with WASM.
• The parameter useSessionStorage is added to WebOptions, which you can use to save in session storage
  instead of local storage.
• Migrated to new analyzer and clean-up code.

Windows

• Migrates to win32 version 5.5.4 to support Dart 3.4 / Flutter 3.22.0.
• Migrated to new analyzer and clean-up code.

Platform Interface

• Migrated to new analyzer and clean-up code.

v9.2.3

• [iOS] Fix for issue #711: The specified item already exists in the keychain.
• [Linux] Fix json.dump with indentations.
• [Web] Update web dependency support to support <2.0.0 instead of <1.0.0.
• [Web] Add wrapKey and wrapKeyIv parameters to webOptions. See readme for more information.
• [macOS] Added useDataProtectionKeyChain parameter.

v9.2.2

[iOS, macOS] Fixed an issue which caused the readAll and deleteAll to not work properly.

v9.2.1

• Fix async race condition bug in storage operations.
• [macOS] Return nil on macOS if key is not found.