public enum Protection

One protection a store or a key either has or does not have.

These are deliberately independent flags rather than points on a scale. A single number – “security level 3” – reads as though every property below it is implied, and on the browser that is exactly the misreading this package exists to prevent: an entry can be encrypted at rest under a key that cannot be exported, and still be readable by any script the page runs. Encryption and isolation from the page are different questions, so they are different flags.

Every flag is reported through ProtectionReport, which answers YES, NO or UNKNOWN for each one. UNKNOWN is a real answer and not a polite NO: a browser cannot tell an application whether its key ended up in a secure element, and a report that guessed would be the same lie in a different place.

Enum constants

`PERSISTENT`	The value survives the process.
`ENCRYPTED_AT_REST`	What is written to disk is ciphertext under a key held somewhere else.
`NON_EXTRACTABLE_KEY`	The key that protects the data cannot be exported through the platform’s normal API.
`OS_PROTECTED`	The key lives in an operating system secret store – the iOS keychain, the Android keystore, the desktop credential store – rather than in storage the application itself can enumerate.
`HARDWARE_BACKED`	The key is held by a secure element, a TEE or a StrongBox, and the platform said so in a way that can be checked.
`USER_VERIFICATION`	Access is gated on the user proving they are present – a biometric, a device passcode, a passkey with user verification.
`ISOLATED_FROM_APPLICATION_CODE`	Code running in the application’s own origin or process cannot read the protected value while the vault is unlocked.

Methods

`public static` `Protection[] values()`
`public static` `Protection valueOf(String name)`

Inherited methods

From Enum

clone, setEnumValues, getEnumValues, valueOf, equals, hashCode, toString, compareTo, name, ordinal, getDeclaringClass

From Object

getClass, notify, notifyAll, wait, wait, wait

Enum constant details

PERSISTENT

PERSISTENT

The value survives the process. On a native port that means an application restart; in a browser it means a page reload, and only for as long as the browser keeps the origin’s storage – see VaultError.QUOTA_EXCEEDED and the eviction discussion in Vault.

ENCRYPTED_AT_REST

ENCRYPTED_AT_REST

What is written to disk is ciphertext under a key held somewhere else. Someone who reads the storage pool, the profile directory or a backup finds no plaintext.

This says nothing about who can ask for a decryption. See ISOLATED_FROM_APPLICATION_CODE.

NON_EXTRACTABLE_KEY

NON_EXTRACTABLE_KEY

The key that protects the data cannot be exported through the platform’s normal API. A browser CryptoKey created with extractable: false has this; a raw 32 byte string in local storage does not.

Non-extractability is not hardware backing and not isolation. The key still performs operations for whatever code asks.

OS_PROTECTED

OS_PROTECTED

The key lives in an operating system secret store – the iOS keychain, the Android keystore, the desktop credential store – rather than in storage the application itself can enumerate.

No browser reports this. IndexedDB is application-visible storage no matter what it holds.

HARDWARE_BACKED

HARDWARE_BACKED

The key is held by a secure element, a TEE or a StrongBox, and the platform said so in a way that can be checked. Inferring this from a platform name, from non-extractability or from the fact that a biometric prompt appeared is how an application ends up claiming a guarantee it does not have, so a port that cannot verify reports UNKNOWN.

USER_VERIFICATION

USER_VERIFICATION

Access is gated on the user proving they are present – a biometric, a device passcode, a passkey with user verification. Distinct from OS_PROTECTED: a keychain item with no access control is protected by the OS and asks nothing of the user.

ISOLATED_FROM_APPLICATION_CODE

ISOLATED_FROM_APPLICATION_CODE

Code running in the application’s own origin or process cannot read the protected value while the vault is unlocked.

No Codename One port reports YES for this, and the browser cannot. It is listed because the question gets asked, and because an application that needs it needs to be told NO rather than left to infer an answer from the flags above. Web Workers do not provide it; neither does non-extractability, which stops a key being copied and not a key being used. Once hostile script runs in an unlocked application’s origin it can call the same decrypt the application calls.

Method details

values

public static Protection[] values()

valueOf

public static Protection valueOf(String name)