Electron's safeStorage encrypts strings using the operating system's key facilities, so the protection depends on the platform. It guards against other users and, on macOS, other apps. On Windows other apps in your user session can still decrypt, and on Linux it can silently fall back to a hardcoded password.
What the docs say per platform
On macOS, keys are held in Keychain in a way that, in the docs' words, prevents other applications from loading them without user override. On Windows, keys come from DPAPI. That protects against other users on the machine, but not against other apps running in the same user space. On Linux, the key lives in a secret store that depends on the desktop: kwallet variants or libsecret.
The Linux trap
If no secret store is available, the docs say items are encrypted with a hardcoded plaintext password, which makes them effectively unprotected. You can detect this: getSelectedStorageBackend() returns basic_text in that case. It also returns basic_text when the desktop environment is not recognized.
Treat basic_text as "not encrypted." Options when you see it: refuse to store the secret, ask the user to sign in again each session, or tell the user that a keyring is needed.
Code signing affects behavior on macOS
The docs say unsigned or ad hoc signed builds can behave inconsistently, and that Keychain may prompt again after every update. If you see odd Keychain prompts in testing, check signing first before filing a bug.
Use the async API
The docs state that the synchronous methods may be deprecated in a future version and recommend the async ones. They also note that the async decrypt can return a flag asking you to re-encrypt after key rotation, so handle it.
What to store at all
safeStorage is a decent place for a refresh token or a local database key. It does not make a long lived, powerful credential safe on a shared or compromised machine. Prefer short lived tokens, server side revocation and per device credentials. For a bigger picture on desktop credentials, see credential helpers by OS.
Checklist
- Check
isEncryptionAvailable()before relying on it. - On Linux, check the selected backend and reject
basic_textfor secrets. - Sign your macOS builds so Keychain behaves predictably.
- Use the async API.
- Keep what you store short lived and revocable.
Quick check
Does safeStorage stop malware running as the same user on Windows?
Not according to the docs. DPAPI protects from other users, not from other apps in the same user space. Limit the lifetime and scope of what you store.
Sources
Last reviewed: 19 October 2026.
