Moving from @aparajita/capacitor-secure-storage

Stay if you use iCloud Keychain sync or per-item keychain access. Strata's secure adapter offers neither, and copying wouldn't bring them along. Move when you don't need those, and the secure store is one of several your app writes to.

The calls

@aparajita/capacitor-secure-storage	Strata Storage
SecureStorage.set(key, data)	storage.set(key, data, { storage: 'secure' })
SecureStorage.get(key)	storage.get(key, { storage: 'secure' })
SecureStorage.remove(key)	storage.remove(key, { storage: 'secure' })
SecureStorage.keys()	storage.keys(undefined, { storage: 'secure' })
SecureStorage.clear()	storage.clear({ storage: 'secure' })
SecureStorage.setKeyPrefix(prefix)	{ namespace } on each call

Both take JSON-style data, so values don't need reshaping.

Copy on the device

import { SecureStorage } from '@aparajita/capacitor-secure-storage';
import { defineStorage } from 'strata-storage';
import { registerCapacitorAdapters } from 'strata-storage/capacitor';

export const storage = defineStorage();

export async function moveSecrets(): Promise<void> {
  await registerCapacitorAdapters(storage);
  if (await storage.get<boolean>('moved:aparajita', { storage: 'secure' })) return;
  for (const key of await SecureStorage.keys()) {
    const value = await SecureStorage.get(key);
    if (value !== null) await storage.set(key, value, { storage: 'secure' });
  }
  await storage.set('moved:aparajita', true, { storage: 'secure' });
}

If you set a key prefix or sync option on the old plugin, set the same ones before this runs: keys() only lists the current prefix.

On the web

The plugin's README says not to use it on the web in production. On Strata the secure adapter is native only too. For a web build, pick a browser store and turn on encryption. Encryption needs a password from somewhere, and one shipped inside your bundle protects nothing, so that's a design decision you'll have to make.

Check the moved values on each device before you clear the old entries in a later release.

@aparajita/capacitor-secure-storage as we checked it

Last checked 7 Nov 2026. "Not stated" means the pages we checked don't mention it, not that the library can't do it. Check @aparajita/capacitor-secure-storage yourself, or see the side-by-side page.

Store or capability	@aparajita/capacitor-secure-storage	Strata Storage
localStorage	Partly. On the web data is stored unencrypted in localStorage for debugging only; the README says not to use it on the web in production (source, 7 Nov 2026)	Yes
IndexedDB	Not stated on the pages we checked	Yes
sessionStorage	Not stated on the pages we checked	Yes
Cookies	Not stated on the pages we checked	Yes
URL parameters as a store	Not stated on the pages we checked	Yes
iOS Keychain	Yes (source, 7 Nov 2026)	Yes
Android secure storage (Keystore-backed)	Yes (source, 7 Nov 2026)	Yes
Native preferences (UserDefaults / SharedPreferences)	Not stated on the pages we checked	Yes
Web and native stores behind one API	Partly. One API for the secure store only (source, 7 Nov 2026)	Yes
No runtime dependencies	No. Depends on @capacitor/app, @capacitor/ios, @capacitor/core, @capacitor/android and @capacitor/keyboard (source, 7 Nov 2026)	Yes

Package fact	@aparajita/capacitor-secure-storage	Strata Storage
Licence	MIT (source)	MIT (source)
npm version	8.0.1	3.1.4
Bundle size	3,535 bytes gzipped, 8,954 minified, version 8.0.1, 7 Nov 2026. JavaScript side only; the native code is not counted by bundlephobia (source)	21,468 bytes gzipped, 79,645 minified, version 3.1.4, 7 Nov 2026 (source)
Weekly downloads	607,888, 31 Oct 2026 to 6 Nov 2026 (source)	486, 31 Oct 2026 to 6 Nov 2026 (source)