String Encryption

Protection ID: string_encryption

String Encryption encrypts all string literals embedded in your application binary so they cannot be extracted by simply scanning the file. Strings are decrypted at runtime in an optimized manner when accessed by your code.

Configuration

{
  "protections": {
    "string_encryption": true
  }
}

{
  "protections": {
    "string_encryption": true
  }
}

For additional options:

{
  "protections": {
    "string_encryption": {
      "enabled": true,
      "algorithm": "xor",
      "exclude": ["http://*", "https://*"]
    }
  }
}

{
  "protections": {
    "string_encryption": {
      "enabled": true,
      "algorithm": "xor",
      "exclude": ["http://*", "https://*"]
    }
  }
}

How It Works

Unprotected iOS binaries contain all string literals in plain text within the __cstring and __ustring sections of the Mach-O file. Anyone can extract them with a simple strings command, immediately revealing API endpoints, error messages, database queries, encryption keys, feature flags, and other sensitive information.

String Encryption transforms these plain text strings into encrypted data in the binary. When your code accesses a string at runtime, it is decrypted transparently. The process is optimized so there is no noticeable performance impact.

Before Shield

$ strings MyApp | grep -i "api"
https://api.example.com/v2/payments
Authorization: Bearer
api_secret_key_production

$ strings MyApp | grep -i "api"
https://api.example.com/v2/payments
Authorization: Bearer
api_secret_key_production

After Shield

$ strings MyApp | grep -i "api"
# (no readable results)

$ strings MyApp | grep -i "api"
# (no readable results)

Algorithm Options

Exclusions

You can exclude specific strings from encryption using wildcard patterns. This is useful for strings that need to remain readable for debugging tools or network monitoring:

{
  "string_encryption": {
    "enabled": true,
    "exclude": ["http://*", "https://*", "ftp://*"]
  }
}

{
  "string_encryption": {
    "enabled": true,
    "exclude": ["http://*", "https://*", "ftp://*"]
  }
}

When to Use

String encryption is recommended for all production applications. It is one of the highest-value protections because string extraction is the simplest and most common first step in reverse engineering an application. It is essential for applications containing API keys or endpoint URLs, database connection strings, error messages that reveal internal logic, feature flags or configuration values, and encryption keys or secrets.

Related

• Resource Encryption - Encrypt bundled assets
• Symbol Renaming - Rename identifiers
• Protections Overview - All available protections