Security
Apple devices, platforms, and services provide world-class security and privacy to our users, with powerful APIs for you to leverage in your own apps.
| [ Web Proxy ] |
| Viewing: https://developer.apple.com/security/ | [Back] [Original] |
Apple devices, platforms, and services provide world-class security and privacy to our users, with powerful APIs for you to leverage in your own apps.
These secure ways to unlock, authenticate, and pay let users quickly access your app with just a glance or a touch of their finger. The Secure Enclave, a hardware-based security processor isolated from the rest of the system, encrypts and protects the users data.
Apple Pay provides an easy and secure way to pay using Face ID or Touch ID, or by double-clicking Apple Watch. Users can quickly provide their payment, shipping, and contact information to check out. And because you dont receive any credit or debit card numbers, you don't need to handle sensitive data when customers use Apple Pay.
Apple Wallet on iPhone and Apple Watch securely and conveniently stores eligible credit and debit cards, transit passes, boarding passes, tickets, identity cards, keys, order tracking details, rewards cards, and more all in one place.
Your users can easily sign in to your apps and websites using their Apple Account. Instead of filling out forms, verifying email addresses, and choosing new passwords, they can use Sign in with Apple to set up an account and start using your app right away.
Password AutoFill simplifies login and account creation tasks for iOS and iPadOS apps, as well as websites. With just a few taps, your users can create and save unique, strong passwords or log in to an existing account. They dont even need to know their password the system handles everything.
Based on industry standards for account authentication, passkeys replace passwords with cryptographic key pairs, making them easier to use and far more secure. Adopt passkeys to give people a simple, secure way to sign in to your apps and websites across platforms with no passwords required.
A range of APIs on Apple platforms enables your apps to employ secure network connections and to benefit from OS-level security policies.
ATS establishes best-practice policies for secure network communications using Apple platforms, employing Transport Layer Security (TLS) version 1.2, forward secrecy, and strong cryptography.
Use Apples secure transport API to employ current versions of the Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Datagram Transport Layer Security (DTLS) cryptographic protocols for network communications.
Starting with iOS 10 and macOS 10.12, the RC4 cipher suite is disabled by default. In addition, Apple recommends that your servers use certificates signed with the SHA-2 cryptographic function.
Protect against security threats to your iOS, iPadOS, and tvOS apps and reduce fraudulent use of your services by managing device states and asserting app integrity. The DeviceCheck services provide information that you can integrate into an overall antifraud strategy for your app and risk assessment for a given device.
Using the DeviceCheck service, a token on your server can set and query two binary digits of data per device — for example, to flag a device youve determined to be fraudulent — while maintaining user privacy. And with App Attest, you can generate a special cryptographic key on a device running iOS 14, iPadOS 14, and tvOS 15 or later, and use that key to validate the integrity of your app before your server provides access to sensitive data.
Strong encryption for your network connections is not enough. To help ensure your app is connecting to the right server, employ Apples Certificate Trust APIs and Certificate Transparency.
Apple platforms provide a variety of features for protecting user data.
Purpose strings let you statically declare the sensitive data and resources your app employs.
Take advantage of privacy options when allowing users to copy and paste sensitive data in your apps on iPhone or iPad.
Keychain and iCloud Keychain provide a secure repository for sensitive user data, such as certificates, keys, passwords, and notes.
Protect Mac systems and users by limiting the privileges of an app to its intended functionality, increasing the difficulty for malicious software to compromise users systems.
Apple platforms protect users with secure code execution. Xcode, Apples integrated development environment (IDE), directly provides code signing for iOS, iPadOS, macOS, tvOS, and watchOS apps that you distribute on the App Store.
Gatekeeper on macOS helps protect users from downloading and installing malicious software distributed outside the Mac App Store by checking for a Developer ID certificate.
If distributing your Mac app outside of the Mac App Store, sign and upload your app to Apple to be notarized to certify your app is genuine and to perform a security check.
Apple platforms offer a comprehensive set of low-level APIs for developing cryptographic solutions within your apps.
Perform cryptographic operations securely and efficiently in your app.
The Common Crypto library supports symmetric encryption, hash-based message authentication codes, and digests.
SecKey provides a unified asymmetric key API across Apple platforms.
The CryptoTokenKit framework provides first-class access for working with smart cards and other cryptographic devices in macOS.
These resources provide background information and support for security on Apple platforms.
The Security framework, CryptoKit, and CommonCrypto rely on the corecrypto library to provide implementations of low-level cryptographic primitives. Although corecrypto does not directly provide programming interfaces for developers and should not be used by iOS, iPadOS, or macOS apps, the source code is available to allow for verification of its security characteristics and correct functioning. This is also the library submitted for validation of compliance with U.S. Federal Information Processing Standards (FIPS) 140-2/-3.
Visit Apple Platform Certifications for up-to-date information on corecrypto validations.
| Web Proxy Viewer | New URL | Original Page |
![[]](https://developer.apple.com/security/images/security-mbp14-iphone15-large_2x.png){kind=link}