This distinction is particularly relevant for developers building wallet integrations or features involving sensitive user state. Storing recovery phrases in DeviceStorage is not allowed or safe. Even SecureStorage does not constitute a secure vault; if the user’s device is compromised or subject to phishing, contents may be at risk. Storage behaviors can also vary depending on the user's hardware or Telegram client version, so robust error handling is necessary.
TON Drop Hub recommendation: Use DeviceStorage only for non-sensitive settings and preferences. Private keys and recovery phrases should be managed via hardware wallets or secure external modules. Users should confirm all requests and permissions directly within the Telegram interface.
DeviceStorage vs SecureStorage: Key Differences
DeviceStorage is suitable for persisting basic user preferences, UI state, or similar non-critical data on a per-device basis. This storage does not synchronize across devices or cloud, and all information is lost if a user uninstalls the app, clears Telegram storage, or resets the device.
SecureStorage has stricter access controls and uses the device’s secure enclave or platform sandbox. However, it is still local to the device and does not protect against scenarios where the hardware or operating system is compromised. Telegram’s documentation explicitly states that neither storage method is safe for recovery phrases, private keys, or confidential credentials.
Developers handling wallets or DeFi flows must avoid using DeviceStorage or SecureStorage for cryptographic key material. Sensitive credentials need external management—typically requiring the user to authenticate or manage wallets outside of the Telegram Mini App context. Device-local storage is not a substitute for true cryptographic security.
Handling Sensitive App State and User Data
DeviceStorage allows developers to retain routine session data, UI preferences, and similar non-sensitive state within Telegram Mini Apps. SecureStorage increases isolation but does not provide robust defense against physical or software-based attacks on the device.
Telegram guidance is explicit: do not save wallet seed phrases, bot credentials, or similar secrets in either storage method. Developers should employ architectures that limit persistent sensitive data, ensuring all critical keys and recovery phrases are secured externally.
For wallet or DeFi Mini Apps, this means never prompting users to enter or save recovery phrases in-session. App interfaces should be designed to route sensitive actions—like wallet recovery—through dedicated, external flows, relying on tested wallet applications and not Mini App interfaces for key management.
TON Drop Hub recommendation: Minimize persistent app state and avoid storing anything sensitive in local storage. Route all wallet-specific or credentialed flows through trusted integrations and design Mini Apps for convenience, not custody.
Practical Safety Checklist for Mini App Developers
- Use DeviceStorage strictly for non-sensitive, quality-of-life settings (e.g., UI themes, display preferences).
- Never store wallet recovery phrases, mnemonic seeds, private keys, or bot credentials in DeviceStorage or SecureStorage.
- Recognize that app storage is always device-bound: data will not follow users if they switch devices or clear app data.
- Expect possible storage errors or inconsistencies across different client versions, devices, and operating systems—handle runtime failures securely.
- Harden flows by reducing storage of persistent credentials to zero; require secure authentication from external, dedicated wallet solutions.
- If any Mini App requests to save or handle sensitive credential data locally, treat this as a critical red flag.
DeviceStorage, while functional, is not built for secrets. SecureStorage improves technical barriers but cannot protect against loss or device compromise. Telegram Mini Apps are convenience layers, not secure storage solutions.
TON Drop Hub guidance: Never build wallet custody or secret management into Telegram Mini Apps via local storage. Design for explicit user approval, rely on purpose-built wallet infrastructure, and ensure users never enter recovery phrases or private keys into Mini App interfaces.
For further details on practical Mini App design and security, see TON guides.
Source reference: original source.