Secure Authentication in Kotlin: A Developer's Guide

Introduction: Why "Rolling Your Own" Authentication is a Risk?

Imagine: you're writing an application in Kotlin — whether it's an Android client or a backend on Ktor/Spring Boot. You quickly throw together a login form, save the password in SharedPreferences, and are happy that everything works. A week later, you get a message: "Your application has been hacked, data leaked." Sound familiar? Unfortunately, this is a classic scenario.

Secure authentication in Kotlin is not just "check the password." It's a whole ecosystem: hashing, tokens, protection against request forgery, secure secret storage. In this article, we'll break down how to avoid common mistakes and build a reliable login system. Let's go!

1. Password Hashing: bcrypt and Its Friends

The first rule of security: never store passwords in plain text. Even if you use HTTPS, the database can be compromised. Your task is to store only the hash.

Why are MD5 and SHA Evil?

These algorithms are fast. And fast hashes are a cracker's dream: they can brute-force billions of combinations per second. Instead, use bcrypt, scrypt, or Argon2. They are intentionally slow and resistant to GPU attacks.

Example in Kotlin using the jbcrypt library:

import org.mindrot.jbcrypt.BCrypt\n\nfun hashPassword(password: String): String {\n    val salt = BCrypt.gensalt(12) // cost factor 12 — optimal\n    return BCrypt.hashpw(password, salt)\n}\n\nfun checkPassword(password: String, hashed: String): Boolean {\n    return BCrypt.checkpw(password, hashed)\n}

Important: the salt is generated automatically and embedded in the hash. You don't need to store it separately.

2. JWT: Lightweight and Secure Authentication

JSON Web Token (JWT) is a standard for transmitting claims between parties. In Kotlin, you can use the java-jwt (Auth0) or jsonwebtoken (jjwt) library.

Generating JWT in Kotlin

import io.jsonwebtoken.Jwts\nimport io.jsonwebtoken.SignatureAlgorithm\nimport io.jsonwebtoken.security.Keys\nimport java.util.Date\n\nfun generateToken(userId: String, secretKey: String): String {\n    val key = Keys.hmacShaKeyFor(secretKey.toByteArray())\n    return Jwts.builder()\n        .setSubject(userId)\n        .setIssuedAt(Date())\n        .setExpiration(Date(System.currentTimeMillis() + 3600_000)) // 1 hour\n        .signWith(key, SignatureAlgorithm.HS256)\n        .compact()\n}

Token Validation

fun validateToken(token: String, secretKey: String): String? {\n    return try {\n        val key = Keys.hmacShaKeyFor(secretKey.toByteArray())\n        val claims = Jwts.parserBuilder()\n            .setSigningKey(key)\n            .build()\n            .parseClaimsJws(token)\n            .body\n        claims.subject // return userId\n    } catch (e: Exception) {\n        null // token is invalid or expired\n    }\n}

Tip: don't store the secret key in code. Use environment variables or Vault.

3. Secure Token Storage on Android

If you're writing a mobile application in Kotlin, the access token cannot be stored in SharedPreferences — it's an open file that other applications or an attacker with root access can read.

Use EncryptedSharedPreferences (from AndroidX Security) or Keystore:

import androidx.security.crypto.EncryptedSharedPreferences\nimport androidx.security.crypto.MasterKey\n\nfun saveToken(context: Context, token: String) {\n    val masterKey = MasterKey.Builder(context)\n        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)\n        .build()\n\n    val sharedPreferences = EncryptedSharedPreferences.create(\n        context,\n        "secure_prefs",\n        masterKey,\n