Storing authentication tokens on iOS – NSUserDefaults vs Keychain?

I would highly recommend you use the keychain – it’s exactly what Facebook do for storing their session tokens.

NSUserDefaults is not secure or encrypted – it can be easily opened and read, both on device and when synced to a Mac. So whilst user defaults is a good place for things like preferences and config info, it’s not a good place for anything sensitive, like passwords.

Session tokens should almost always treated the same as passwords, so you should store them securely in the keychain, where they’ll be encrypted. Apple have some sample code (GenericKeychain) that shows a basic implementation, and you’ll find other examples by searching StackOverflow. Hope that’s helped you out.

Leave a Comment