Platforms
Overview
Which OS credential store each platform uses, and the limits that differ between them.
The plugin uses the native store of each platform through the official
keyring-core backend crates. There is no in-memory or file
fallback: if the store is missing, calls fail.
| Platform | Store | Crate |
|---|---|---|
| macOS | Login Keychain | apple-native-keyring-store (keychain) |
| Windows | Credential Manager | windows-native-keyring-store |
| Linux | Secret Service over D-Bus (GNOME Keyring, KWallet, KeePassXC, …) | dbus-secret-service-keyring-store (crypto-rust) |
| Android | Android Keystore + SharedPreferences | android-native-keyring-store |
| iOS | Data-protection Keychain | apple-native-keyring-store (protected) |
The store starts on the first call. If it fails to start (e.g. no D-Bus session yet), the error is not cached: the next call after a 2-second pause tries again.
Entries
Every entry has a service (your app identifier or the name set with Builder::service) and an
account: the name you pass to the password commands, or a hashed kp:v1:…
name for session records. Byte values are stored as
Base64 text.
Differences
| macOS | Windows | Linux | Android | iOS | |
|---|---|---|---|---|---|
| Size limit | — | 2560 bytes per secret, see Windows | — | — | — |
| Can prompt the user | yes (access) | no | yes (unlock) | no | with RequireUserPresence |
| Needs extra setup | no | no | a running Secret Service | no | a signed app |
| Locked device | — | — | locked collection prompts | — | KeychainLocked, see iOS |
Test on every platform you ship: the example app runs on all of them.