I've been told that the SD card is a terrible place to store secure data because any app can read it. How else can my phone store my private key I use to log into my home PC ssh server?

  • Which app uses the private key? Is your device rooted?
    – Robert
    Dec 21, 2011 at 9:10
  • Which version of Android? More recent versions support disk encryption which will prevent certain types of attacks. I would recommend you protect the private key with a strong password in any event.
    – nwaltham
    Dec 21, 2011 at 12:35

3 Answers 3


I use ssh in a terminal.

$ ls -l .ssh
-rw-------    1 10106    10106          427 Jan  8 07:39 id_rsa
-rw-rw-rw-    1 10106    10106          319 Jan  8 07:39 id_rsa.pub
$ pwd

So the private key is protected simply by the unix filesystem and Android's user-per-app design: only Better Terminal Emulator Pro can read id_rsa, and only ssh and other programs I'm aware of run under it.

Whatever your app is, it need only do this to enjoy the same security from other apps. Full-sdcard encryption, unless it comes packaged with a filesystem having a comparable system of permissions, will not protect your data from other apps.


If your phone is rooted, you have the option of placing the key in a 'protected' area in which any application requesting to access the file would need to be given root access by you.

  • This provides very little protection in the case of an attacker gaining physical access to your phone.

You can also create a key that requires a pass-phrase to be entered in order to unlock and use the key.

  • You should consider spending four or five additional seconds in order to login to your server in order to protect your assets.

As previously mentioned, Android is moving towards full disk encryption, which will substantially increase security of the device in general.

  • The latest versions of Android now support full disk encryption. When setting it up, I'd recommend using a pin or passphrase that is not the same as your unlock pin.
    – earthmeLon
    Jun 23, 2013 at 22:14

JuiceSSH stores your keys in its private app directory. https://twitter.com/juicessh/status/514263527172112384

Screenshot of twitter conversation

Click image for larger version

In addition, it encrypts this info. https://twitter.com/juicessh/status/449123666471948288

Screenshot of twitter conversation

Click image for larger version

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .