Android Realm database Security

Question

Simple question. Is Realm database safe? Is there any way to receive data outside of the application? If not:

I have very sensitive data, that I have to remember - How to keep them secure?

Answer 1

The Realm file can be stored encrypted on disk by passing a 512-bit encryption key (64 bytes) to RealmConfiguration.Builder.encryptionKey():

byte[] key = new byte[64];
new SecureRandom().nextBytes(key);
RealmConfiguration config = new RealmConfiguration.Builder(context)
  .encryptionKey(key)
  .build();

Realm realm = Realm.getInstance(config);

This ensures that all data persisted to disk is transparently encrypted and decrypted with standard AES-256 encryption. The same encryption key must be supplied each time a Realm instance for the file is created.

See below link for a complete example of how to securely store keys between runs in the Android KeyStore so that other applications cannot read them:

https://github.com/realm/realm-java/tree/master/examples/encryptionExample