The database key is encrypted with a key derived from the user's password. This is vulnerable to brute force attacks; scrypt makes them more expensive but doesn't prevent them. When a hardware key store is available, we could add another layer of security by encrypting the database key with a hardware-backed key as well as the password-derived key. https://nelenkov.blogspot.co.uk/2013/08/credential-storage-enhancements-android-43.html https://nelenkov.blogspot.co.uk/2015/06/keystore-redesign-in-android-m.html ~~https://developer.android.com/preview/features/security.html#hardware-security-module~~ https://developer.android.com/training/articles/keystore.html Related to #257.