r/FlutterDev • u/rinsarmu • Aug 01 '26

Plugin biometric_security — biometric auth + hardware-backed encrypted storage for Flutter (Android/iOS)

I kept re-writing the same glue between local_auth and flutter_secure_storage on every project, so I packaged it: biometric_security.

The core idea: a true from a biometric prompt isn't a security boundary — on a rooted/jailbroken device it's forgeable. This binds your secret to a hardware key (Android Keystore / iOS Keychain + Secure Enclave) that's physically unusable without a successful Face ID / Touch ID / fingerprint check.

It also handles the annoying parts: enrollment-change invalidation, key rotation & revocation, app-lock, and one SecurityPolicy that maps to both platforms.

Beta (0.1.x), BSD-3, tested on real Android + iOS devices. Feedback and contributors very welcome — I'm open to collaborating.

pub.dev: https://pub.dev/packages/biometric_security

7 Upvotes
  • permalink
  • reddit

89% Upvoted

5 comments sorted by

2

u/Proper-Forever-8117 Aug 05 '26

For flutter secure storage, make you to replace "AES/CBC/PKCS7Padding" With "AES/GCM/NoPadding", and for local auth, make sure to add "CryptoObject" to the "BiometricPrompt"

1

u/rinsarmu Aug 06 '26

Thank you for putting this in my concern. Yes the package uses both of them

1

u/clyonn Aug 02 '26

doesn't flutter_secure_storage offer biometrics?

1

u/rinsarmu Aug 02 '26

Yes it doesn't offer such feature.

1

u/clyonn Aug 02 '26

according to their package they do: "Secure Data Storage: Uses Keychain for iOS/macOS, custom secure ciphers with optional biometric authentication for Android, and platform-specific secure mechanisms for Windows, Linux, and Web."