# kotlin:S6291: Android SharedPreferences security recommendation is out-of-date

**URL:** <https://community.sonarsource.com/t/kotlin-android-sharedpreferences-security-recommendation-is-out-of-date/140574>\
**Category:** Rules and Languages\
**Tags:** security-hotspot, android, security, kotlin\
**Created:** [May 7, 2025, 2:22pm UTC](https://community.sonarsource.com/t/kotlin-android-sharedpreferences-security-recommendation-is-out-of-date/140574 "2025-05-07T14:22:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonnyandrewgds](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jonnyandrewgds/32/68229_2.png) [@jonnyandrewgds](https://community.sonarsource.com/u/jonnyandrewgds)\
**Post date:** [May 7, 2025, 2:22pm UTC](https://community.sonarsource.com/t/kotlin-android-sharedpreferences-security-recommendation-is-out-of-date/140574/1 "2025-05-07T14:22:05Z")

</div>

When using `SharedPreferences` in an Android app with `minSdk` set to API 29 (Android 10), Sonar raises the following security hotspot:

> **Make sure using an unencrypted database is safe here.**  
> Using unencrypted databases in mobile applications is security-sensitive (kotlin:S6291)

In Sonar, I clicked “How can I fix it” and the “Recommended Secure Coding Practices” states:

> Instead of SharedPreferences you can use [EncryptedSharedPreferences](https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences)

However, this recommendation is out-of-date as the solution is deprecated.

Please can you update the security recommendations around `SharedPreferences` usage?

---

<div class="post-metadata">

**Author:** ![antonio.aversa](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/antonio.aversa/32/40757_2.png) [@antonio.aversa](https://community.sonarsource.com/u/antonio.aversa)\
**Post date:** [May 7, 2025, 3:37pm UTC](https://community.sonarsource.com/t/kotlin-android-sharedpreferences-security-recommendation-is-out-of-date/140574/3 "2025-05-07T15:37:39Z")

</div>

Hi @jonnyandrewgds,

Thanks for taking the time to report this issue on our community.

Rule [S6291](https://sonarsource.github.io/rspec/#/rspec/S6291) is not relevant anymore since [Android 10](https://source.android.com/docs/security/features/encryption/file-based#:~:text=All%20devices%20launching%20with%20Android%2010%20and%20higher%20are%20required%20to%20use%20file-based%20encryption).

Android 10+ (as well as iOS) has encryption by default, so databases don’t need to provide encryption features themselves anymore. See [this article](https://www.spght.dev/articles/28-05-2024/jetsec-deprecation) for further details about the deprecation of `Encrypted Shared Preferences`.

We had this rule under our radar, and we planned its deprecation, both for Kotlin and Java. We just could not do it yet.

While waiting for the deprecation of the rule to be done and released, you can mark all issues detected by this hotspot as Safe, or remove the rule from your profile, if it is really noisy.

Hope it helps,  
Antonio

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [July 2, 2025, 2:22pm UTC](https://community.sonarsource.com/t/kotlin-android-sharedpreferences-security-recommendation-is-out-of-date/140574/4 "2025-07-02T14:22:18Z")

</div>

The rule is now [deprecated](https://next.sonarqube.com/sonarqube/coding_rules?q=S6291&selected=kotlin%3AS6291). 🙂