---
title: Avoid storing sensitive data in SharedPreferences
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid storing sensitive data in SharedPreferences
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid storing sensitive data in SharedPreferences

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/insecure-shared-preferences`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [922](https://cwe.mitre.org/data/definitions/922.html)

**Related CWEs**:

- [312](https://cwe.mitre.org/data/definitions/312.html)
- [921](https://cwe.mitre.org/data/definitions/921.html)

## Description{% #description %}

`SharedPreferences` stores data in an unencrypted file on the device. Storing sensitive values such as passwords, tokens, or secrets there exposes them to any app on a rooted or compromised device.

Use `flutter_secure_storage` to protect values that must persist on-device.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
import 'package:shared_preferences/shared_preferences.dart';

Future<void> savePassword(String password) async {
  final prefs = await SharedPreferences.getInstance();
  await prefs.setString('password', password);
}
```

```dart
import 'package:shared_preferences/shared_preferences.dart';

Future<void> saveSession(String token, String refreshToken) async {
  final prefs = await SharedPreferences.getInstance();
  await prefs.setString('auth_token', token);
  await prefs.setString('refresh_token', refreshToken);
}
```

```dart
import 'package:shared_preferences/shared_preferences.dart';

void cacheSecret(SharedPreferences prefs, String secret) {
  prefs.setString('secret', secret);
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

Future<void> saveCredentials(String token) async {
  const storage = FlutterSecureStorage();
  await storage.write(key: 'auth_token', value: token);
}
```

```dart
import 'package:shared_preferences/shared_preferences.dart';

Future<void> saveSettings(String theme, bool darkMode) async {
  final prefs = await SharedPreferences.getInstance();
  await prefs.setString('theme', theme);
  await prefs.setBool('dark_mode', darkMode);
}
```

```dart
import 'package:shared_preferences/shared_preferences.dart';

// Safe key, sensitive-looking hardcoded value — must not flag (key is what matters)
Future<void> saveTheme(SharedPreferences prefs) async {
  await prefs.setString('theme', 'token_value');
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}