Español – América Latina Português – Brasil Android Developers By making your app more secure, you help preserve user trust and device integrity. This page presents several best practices that have a significant, positive impact on your app's security. Enforce secure communication When you safeguard the data that you exchange between your app and other apps, or between your app and a website, you improve your app's stability and protect the data that you send and receive. Safeguard communication between apps To communicate between apps more safely, use implicit intents with an app chooser, signature-based permissions, and non-exported content providers. Show an app chooser If an implicit intent can launch at least two possible apps on a user's device, explicitly show an app chooser. This interaction strategy lets users transfer sensitive information to an app that they trust. Show an app chooser Apply signature-based permissions When sharing data between two apps that you control or own, use signature-based permissions. These permissions don't require user confirmation and instead check that the apps accessing the data are signed using the same signing key. Therefore, these permissions offer a more streamlined, secure user experience. android:protectionLevel Disallow access to your app's content providers Unless you intend to send data from your app to a different app that you don't own, explicitly disallow other developers' apps from accessing your app's ContentProvider objects. This setting is particularly important if your app can be installed on devices running Android 4.1.1 (API level 16) or lower, as the android:exported attribute of the <provider> element is true by default on those versions of Android. Ask for credentials before showing sensitive information When requesting credentials from users so that they can access sensitive information or premium content in your app, ask for either a PIN/password/pattern or a biometric credential, such as face recognition or fingerprint recognition. To learn more about how to request biometric credentials, see the guide about biometric authentication . Apply network security measures The following sections describe how you can improve your app's network security. Use TLS traffic If your app communicates with a web server that has a certificate issued by a well-known, trusted certificate authority (CA), use an HTTPS request like the following: Add a network security configuration If your app uses new or custom CAs, you can declare your network's security settings in a configuration file. This process lets you create the configuration without modifying any app code. To add a network security configuration file to your app, follow these steps: Declare the configuration in your app's manifest: Add an XML resource file, located at res/xml/network_security_config.xml . Specify that all traffic to particular domains must use HTTPS by disabling clear-text: <network-security-config> <domain-config cleartextTrafficPermitted="false" > <domain includeSubdomains="true">secure.example.com</domain> ... </domain-config> </network-security-config> During the development process, you can use the <debug-overrides> element to explicitly allow user-installed certificates. This element overrides your app's security-critical options during debugging and testing without affecting the app's release configuration. The following snippet shows how to define this element in your app's network security configuration XML file: <network-security-config> <debug-overrides> <trust-anchors> <certificates src="user" /> </trust-anchors> </debug-overrides> </network-security-config> Add an XML resource file, located at res/xml/network_security_config.xml . Specify that all traffic to particular domains must use HTTPS by disabling clear-text: During the development process, you can use the <debug-overrides> element to explicitly allow user-installed certificates. This element overrides your app's security-critical options during debugging and testing without affecting the app's release configuration. The following snippet shows how to define this element in your app's network security configuration XML file: Related info: Network security configuration Create your own trust manager Your TLS checker shouldn't accept every certificate. You might need to set up a trust manager and handle all TLS warnings that occur if one of the following conditions applies to your use case: You're communicating with a web server that has a certificate signed by a new or custom CA. That CA isn't trusted by the device you're using. You can't use a network security configuration . To learn more about how to complete these steps, see the discussion about handling an unknown certificate authority . Security with network protocols CertificateFactory HttpsURLConnection Use WebView objects carefully WebView objects in your app shouldn't let users navigate to sites that are outside of your control. Whenever possible, use an allowlist to restrict the content loaded by your app's WebView objects. In addition, never enable JavaScript interface support unless you completely control and trust the content in your app's WebView objects. Use HTML message channels If your app must use JavaScript interface support on devices running Android 6.0 (API level 23) and higher, use HTML message channels instead of communicating between a website and your app, as shown in the following code snippet: Provide the right permissions Request only the minimum number of permissions necessary for your app to function properly. When possible, relinquish permissions when your app no longer needs them. Use intents to defer permissions Whenever possible, don't add a permission to your app to complete an action that can be completed in another app. Instead, use an intent to defer the request to a different app that already has the necessary permission. The following example shows how to use an intent to direct users to a contacts app instead of requesting the READ_CONTACTS and WRITE_CONTACTS permissions: In addition, if your app needs to perform file-based I/O—such as accessing storage or choosing a file—it doesn't need special permissions because the system can complete the operations on your app's behalf. Better still, after a user selects content at a particular URI, the calling app gets granted permission to the selected resource. Share data securely across apps Follow these best practices to share your app's content with other apps in a more secure manner: Enforce read-only or write-only permissions as needed. Provide clients one-time access to data by using the FLAG_GRANT_READ_URI_PERMISSION and FLAG_GRANT_WRITE_URI_PERMISSION flags.

When sharing data, use content:// URIs, not file:// URIs. Instances of FileProvider do this for you. The following code snippet shows how to use URI permission grant flags and content provider permissions to display an app's PDF file in a separate PDF viewer app: Note: Executing files from the writable app home directory is a W^X violation . For this reason, untrusted apps that target Android 10 (API level 29) and higher can't invoke exec() on files within the app's home directory, only the binary code that's embedded within an app's APK file. In addition, apps that target Android 10 and higher can't, in memory, modify executable code from files that have been opened with dlopen() . This includes any shared object ( .so ) files with text relocations. Related info: android:grantUriPermissions Store data safely Although your app might require access to sensitive user information, users grant your app access to their data only if they trust that you safeguard it properly. Store private data within internal storage Store all private user data within the device's internal storage, which is sandboxed per app. Your app doesn't need to request permission to view these files, and other apps can't access the files. As an added security measure, when the user uninstalls an app, the device deletes all files that the app saved within internal storage. The following code snippet demonstrates one way to write data to internal storage: The following code snippet shows the inverse operation, reading data from internal storage: Data and file storage overview FileInputStream FileOutputStream Context.MODE_PRIVATE Store data in external storage based on use case Use external storage for large, non-sensitive files that are specific to your app as well as files that your app shares with other apps. The specific APIs that you use depend on whether your app is designed to access app-specific files or access shared files. If a file doesn't contain private or sensitive information but provides value to the user only in your app, store the file in an app-specific directory on external storage . If your app needs to access or store a file that provides value to other apps, use one of the following APIs, depending on your use case: Media files: To store and access images, audio files, and videos that are shared between apps, use the Media Store API . Other files: To store and access other types of shared files, including downloaded files, use the Storage Access Framework . Check availability of storage volume If your app interacts with a removable external storage device, keep in mind that the user might remove the storage device while your app is trying to access it. Include logic to verify that the storage device is available . Check validity of data If your app uses data from external storage, make sure that the contents of the data haven't been corrupted or modified. Include logic to handle files that are no longer in a stable format. The following code snippet includes an example of a hash verifier: Use internal storage for sensitive cache data To provide faster access to app data, store it in the device's cache. For caches 1 MB or smaller, use getCacheDir() . For caches larger than 1 MB, use getExternalCacheDir() . Both methods provide you with the File object that contains your app's cached data. While the internal cache directory (provided by getCacheDir() ) is private to your app, the external cache directory is not. The following code snippet shows how to cache a file that your app recently downloaded: Note: If you use getExternalCacheDir() to place your app's cache within shared storage, the user might eject the media containing this storage while your app is running. Include logic to gracefully handle the cache miss that this user behavior causes. Caution: There is no security enforced on files in the external cache directory . Therefore, any app that targets Android 10 (API level 29) or lower and has the WRITE_EXTERNAL_STORAGE permission can access the contents of this cache. Related info: Data and file storage overview Use SharedPreferences in private mode When using getSharedPreferences() to create or access your app's SharedPreferences objects, use MODE_PRIVATE . That way, only your app can access the information within the shared preferences file. If you want to share data across apps, don't use SharedPreferences objects. Instead, follow the steps to share data securely across apps . Data and file storage overview Keep services and dependencies up to date Most apps use external libraries and device system information to complete specialized tasks. By keeping your app's dependencies up to date, you make these points of communication more secure. Check the Google Play services security provider Note: This section applies only to apps targeting devices that have Google Play services installed. If your app uses Google Play services, make sure that it's updated on the device where your app is installed. Perform the check asynchronously, off of the UI thread. If the device isn't up to date, trigger an authorization error. To determine whether Google Play services is up to date on the device where your app is installed, follow the steps in the guide about Updating your security provider to protect against SSL exploits . ProviderInstaller ProviderInstaller.ProviderInstallListener Update all app dependencies Before deploying your app, make sure that all libraries, SDKs, and other dependencies are up to date: For first-party dependencies, such as the Android SDK, use the updating tools found in Android Studio, such as the SDK Manager . For third-party dependencies, check the websites of the libraries that your app uses, and install any available updates and security patches. Related info: Add build dependencies More information To learn more about how to make your app more secure, view the following resources: Core app quality security checklist App security improvement program Android Developers channel on YouTube Android Protected Confirmation: Taking transaction security to the next level Content and code samples on this page are subject to the licenses described in the Content License . Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates. Last updated 2026-09-11 UTC.