To secure an Android app, collect less data, keep what you store private to the app, expose only the components you mean to share, send traffic over HTTPS with normal certificate validation, use Android’s standard cryptography and Keystore rather than custom code, and request only the permissions a feature needs. Then review integrity, dependencies and risky platform features, such as WebViews, deep links, pending intents and debug settings, for the whole life of the app, not just at release.
Android gives you a strong base: Android Developers’ “Design for Safety” documentation says that “Android is secure by default and private by design.” Your design decisions still determine what data exists, where it lives, who can reach it and which code you trust. This guide follows the five OWASP MASVS categories used in Android’s own risk catalog (storage, cryptography, network communication, platform interaction and code quality), with privacy and authentication/integrity as cross-cutting concerns. A checklist removes common mistakes. It does not prove an app secure.
Start with the lifecycle mindset
Android’s “Design for Safety” guidance (updated 2026-03-06 UTC) tells developers to “design for security by following best practices for encryption, integrity, and authentication,” and pairs that with privacy minimization. In practice that gives you three questions to ask at every stage of design, build and release:
- Data: what is collected, persisted, logged, backed up or handed to another app?
- Boundaries: which components, intents, links and WebView bridges can an outside caller reach, and is that access scoped and validated?
- Trust: which networks, libraries, SDKs and server signals are you relying on, and what happens when one fails?
The cheapest security fix is deleting data you never needed. The platform sandbox already isolates your app’s private files from other apps, so lean on it instead of inventing your own access-control scheme.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
How the checklist maps to your app
| Area | Core question | Key actions |
|---|---|---|
| Storage | Can another app read what I saved? | Use app-private storage; keep sensitive data out of external storage and logs; unexport providers; use scoped storage |
| Cryptography | Am I using vetted primitives and protecting keys? | Standard Android APIs; AES-GCM/CBC with 256-bit keys, SHA-2, HMAC-SHA-2, ECDSA with SHA-2 where compatible; Android Keystore; no hardcoded secrets |
| Network | Can someone on the path read or change traffic? | HTTPS; Network Security Configuration; narrow cleartext exceptions; never trust all certificates |
| Platform interaction | Who can invoke my components and what do I pass out? | Review exported components, deep links, pending intents, WebViews, explicit intents, permissions |
| Code quality | Could my code or dependencies be turned against me? | Validate input; parameterized queries; audit libraries and SDKs; remove debug and test paths; avoid unsafe dynamic loading and deserialization |
| Cross-cutting: privacy | Do I take only what the feature needs? | Minimal permissions, coarse location, resettable identifiers, accurate disclosure |
| Cross-cutting: authentication and integrity | Does the backend know who and what is calling? | Credential Manager; Play Integrity API as a risk signal; server-side authorization |
Storage and inter-app data sharing
Android’s security checklist says the most common storage concern is whether data saved on the device can be read by other apps. It separates three places data can live: internal storage, external storage and content providers.
Internal versus external storage
Keep private data in app-private (internal) storage. External storage may be globally readable and writable, so it is the wrong home for tokens, personal data or anything you would not publish. Do not write sensitive information to Logcat or log files either; Android’s privacy checklist calls this out explicitly.
For apps targeting Android 10 (API level 29) and higher, the privacy checklist describes scoped storage as the model for shared files. Prefer system pickers and scoped access over broad storage permissions.
Content providers
If a provider is not meant to be shared, mark it so in the manifest:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors<provider
android:name=".NotesProvider"
android:authorities="com.example.app.notes"
android:exported="false" />If sharing is intended, set appropriate read and write permissions and use URI permission grants as narrowly as practical, for one URI and one recipient rather than a whole provider.
Validate input and parameterize queries
Treat anything arriving from another app, a deep link, a file or the network as untrusted. When querying a provider or database, do not build the selection string by concatenating user-controlled values. Use placeholders:
// Risky: user input becomes part of the SQL
val cursor = db.rawQuery("SELECT * FROM notes WHERE title = '" + input + "'", null)
// Safer: input is bound as a parameter
val cursor = db.query(
"notes", null, "title = ?", arrayOf(input), null, null, null
)Passing data to other apps
The privacy checklist recommends explicit intents and one-time access when sending sensitive data to another app. An implicit intent can be intercepted by any app that declares a matching filter, which is the intent hijacking and redirection issue listed in Android’s risk catalog.
Network communication
Use HTTPS for every endpoint that supports it. Android’s cleartext-traffic guidance explains that network observers can read cleartext traffic and can also modify it, including through attacks that change app behavior. That makes cleartext a risk even when the payload does not look sensitive.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBlock cleartext by default
A Network Security Configuration lets you declare policy outside application code. A strict baseline looks like this, referenced from the manifest with android:networkSecurityConfig="@xml/network_security_config":
<network-security-config>
<base-config cleartextTrafficPermitted="false" />
</network-security-config>If you must allow cleartext for a specific host, such as a legacy device on a closed network, scope the exception to that domain instead of loosening the whole app, and re-evaluate it regularly.
Never “fix” certificate errors by trusting everything
Android’s guidance warns against permissive trust managers that accept arbitrary certificates. A common failure is a development workaround for a self-signed server certificate that ships to production, silently removing the protection of TLS. Keep certificate validation and hostname verification intact. If you need to talk to a server with a private CA during development, configure that trust narrowly and keep it out of release builds. Android’s risk catalog lists unsafe hostname verification as a code-quality issue for this reason.
Cryptography and secrets
Use Android’s standard cryptographic APIs and do not write your own algorithms. When the choice is yours and compatibility allows, Android’s cryptography guide recommends:
- AES in CBC or GCM mode with 256-bit keys
- SHA-2 family digests
- HMAC using SHA-2
- ECDSA with SHA-2 for signatures
These are platform recommendations, not a design. The right choice still depends on your protocol, key lifecycle, threat model and any interoperability constraints.
Keep keys in Android Keystore
If you need stronger key protection, Android directs you to Android Keystore. Generating a key there means the app works with a handle to the key rather than raw key bytes it must store itself. A minimal AES-GCM example:
val keyGenerator = KeyGenerator.getInstance(
KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore"
)
keyGenerator.init(
KeyGenParameterSpec.Builder(
"notes_key",
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
)
.setBlockModes(KeyProperties.BLOCK_MODE_GCM)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
.setKeySize(256)
.build()
)
val key = keyGenerator.generateKey()Note that “AndroidKeyStore” is the one provider you should name explicitly. The cryptography guide cautions against specifying a provider in other cases, because Android does not guarantee a particular provider and hardcoding one can create compatibility problems.
Secrets and randomness
Do not embed API secrets, passwords or private keys in the APK; anyone can unpack it. Anything that must stay secret belongs on a server. Avoid weak random number generation, as Android’s risk catalog flags it, and use the platform’s secure random sources for tokens, IVs and nonces.
Permissions and privacy
Android’s privacy checklist (updated 2026-03-06 UTC) boils down to taking less and being honest about it.
- Request the minimum. Ask only for permissions the current feature needs, and ask in context, at the moment the user triggers the feature, with a clear reason.
- Degrade gracefully. Users can deny or later revoke access. The app should continue with reduced functionality rather than crash or nag.
- Minimize location. Prefer coarse location when it is enough, and request background location only if the feature truly requires it.
- Audit your SDKs. Users generally attribute an SDK’s behavior to your app, so review which permissions and data each included library uses.
- Use safer identifiers. Prefer resettable, app-scoped identifiers. Do not read the IMEI or device serial number for ordinary app identity needs.
- Use data access auditing where available. The checklist states that apps targeting Android 11 (API level 30) and higher can perform data access auditing, which helps you see which code, including third-party code, touches sensitive data.
- Disclose accurately. If you distribute on Google Play, complete the Data safety form to match what the app and its SDKs actually do.
Authentication and integrity
Credential Manager
Android’s safety guidance identifies Credential Manager as the modern Jetpack authentication library. It supports passkeys, federated sign-in such as Sign in with Google, and legacy username/password flows through one API. Where you control the sign-in design, passkeys reduce the phishing and credential-reuse risks of passwords.
Play Integrity API
The same guidance describes the Play Integrity API as a way for your backend to assess whether a request comes from a genuine app binary on a genuine Android-powered device, and to respond to detected risk. Treat the result as one risk signal and a layer of defense in depth. It does not replace server-side authorization, account protections or secure implementation, and the decision logic should run on your server, not in the client where it can be patched out.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Platform interaction: where apps most often expose themselves
Android’s “Mitigate security risks in your app” catalog (page last updated 2024-11-26 UTC) groups issues by MASVS category. Its platform-interaction items work well as a pre-release review list:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Exported components
Activities, services, receivers and providers that are exported can be called by other apps. Keep components unexported unless sharing is intentional, and protect intentionally exported ones with permissions and input validation. Check that intent filters have not exported a component unintentionally.
Intent hijacking and pending intents
Use explicit intents for sensitive data. Review any PendingIntent you hand to another app, since it lets that app act with your app’s identity; keep it as specific and restricted as possible.
Deep links
Treat every parameter in a link as attacker-controlled. Validate it, and do not let a link trigger sensitive actions or skip authentication.
WebViews
The risk catalog lists WebView native bridges. Any JavaScript interface you expose is reachable by the content the WebView loads, so load only content you trust, over HTTPS, and expose the smallest possible bridge.
Free tools Windows power users keep installed
One-click scans. No signup required.
Debuggable builds
android:debuggable must not be enabled in release builds. Make sure test endpoints, verbose logging and debug-only trust settings are excluded from the release variant.
Code quality and dependencies
The code-quality entries in Android’s catalog include insecure APIs or libraries, dynamic code loading, unsafe deserialization, SQL injection, unsafe hostname verification and leftover debug or test features. Practical consequences:
- Track your dependencies. Keep a list of libraries and SDKs, the permissions and data they use, and who watches for their security updates.
- Avoid loading code you did not ship. Dynamic code loading from a writable or remote location lets an attacker substitute their own code.
- Be careful deserializing. Do not deserialize untrusted data into rich object graphs; prefer simple data formats with explicit validation.
- Gate release builds. Make “no debuggable flag, no cleartext exceptions, no trust-all code, no test endpoints” a release checklist item or an automated check.
A pre-release checklist
- List every kind of data the app collects. Remove what the feature does not need.
- Confirm sensitive data is in app-private storage and absent from external storage, logs and intents sent to other apps.
- Review the manifest: every
exportedcomponent is deliberate, and providers that are not shared areexported="false". - Check that all provider and database queries use bound parameters.
- Confirm cleartext is disabled except for documented, domain-scoped exceptions, and that no custom trust manager or hostname verifier accepts everything.
- Check crypto against the Android recommendations, with keys in Android Keystore where stronger protection is needed and no hardcoded secrets.
- Confirm each permission maps to a user-visible feature and that denial and revocation are handled.
- Review the permissions and data behavior of every SDK, then compare the Play Data safety form with reality.
- Walk through deep links, pending intents and WebView bridges against Android’s risk catalog.
- Verify the release build has no debuggable flag, debug endpoints or test features.
- If your backend needs assurance about callers, decide how Play Integrity verdicts feed server-side risk decisions.
Keeping it current
Android’s requirements shift with platform releases, target SDK levels and Google Play policy, and a few behaviors above are tied to API levels (scoped storage at API 29, data access auditing at API 30). Check your targetSdk and re-read the current official pages (Design for Safety, Privacy checklist, Security checklist, Cryptography, Cleartext communications and Mitigate security risks in your app) at each major release. The Security checklist, Cryptography and Cleartext pages do not show an update date, so verify details against the current version of each.
A checklist like this catches the common, well-understood mistakes. It does not replace threat modeling for your specific app, code review, or independent testing of apps that handle high-value data such as payments or health records.
Recommended Free Tools
