pub.dev

biometric_security

0.1.15rinsarmu/biometric_security ↗New releases in your daily digest, changelog included.

Biometric security for Flutter: Face ID, Touch ID & fingerprint authentication with hardware-backed encrypted storage and app-lock, on Android and iOS.

Last release 2 months ago
04 Aug 2026
Too new to tell
only 1 release windows
Some releases are documented
notes for 3 of 6 stable releases
Nothing withdrawn
no release was ever pulled
2 months old
6 releases · first in 2026

Release timeline

6 releases since 2026

2026

20262026

One column per month.

Releases

0.1.154 Aug 2026
Nothing published for this version
0.1.141 Aug 20262 sources agree
Added isInvalidated(key:) — a lightweight, non-prompting boolean check for whether a secret's biometric-bound key was invalidated (e.g. by an enrollme
Added isInvalidated(key:) — a lightweight, non-prompting boolean check for whether a secret's biometric-bound key was invalidated (e.g. by an enrollment change). Android uses a Cipher.init probe; iOS uses the biometric domain-state. Returns false for absent or non-gated secrets.

Improved pub.dev discoverability: keyword-rich package description and README opening (Face ID, Touch ID, fingerprint, Keystore, Keychain, Secure Enclave), pub.dev badges, and a "how it compares" table vs local_auth / flutter_secure_storage.
Open source →
0.1.1331 Jul 2026

0.1.1231 Jul 20262 sources agree

Initial public beta. Every implemented flow is validated on physical Android and iOS devices; a few APIs remain stubs (see the "Platform limitations"

Initial public beta. Every implemented flow is validated on physical Android and iOS devices; a few APIs remain stubs (see the "Platform limitations" section of the README). As a pre-1.0 release, the public API may still change.

Added

Availability detection — getAvailability() reports supported vs enrolled modalities, biometric strength, secure-hardware presence, and what the device can actually enforce (EnforceableGuarantees).
Biometric authentication — authenticate() backed by a real hardware key operation (Android BiometricPrompt + CryptoObject; iOS Secure Enclave signing), not a bare boolean.
Secure encrypted storage — write/read/contains/delete/deleteAll using AES-256-GCM envelope encryption with a per-secret data-encryption key held in the Android Keystore / iOS Keychain.
Biometric-protected storage — reads are gated by the OS biometric prompt when the policy requires it.
App-lock and feature-level protection sub-APIs.
Key lifecycle — versioned metadata, migration, rotateKey, revoke, revokeAll, and resetInvalidated for recovery after invalidation.
Normalized SecurityPolicy mapping one intent to both platforms (strength, device-credential fallback, enrollment binding, auth validity, hardware requirement, accessibility).
Typed error model — a sealed BiometricSecurityException hierarchy; failures never return plaintext or silently regenerate keys.

Security

Enforced requireSecureHardware on both platforms (rejects software-backed keys / software auth fallback).
Serialized per-key storage operations to prevent a concurrent-write DEK/ciphertext mismatch.
All high-risk findings from an independent security review are fixed.

Known limitations

Every implemented flow is validated by unit tests and on physical Android and iOS devices.
signChallenge, lifecycle-event emission, enableProtection/ disableProtection, and policyOf are declared but not yet implemented.
macOS, Windows, and Linux are not yet supported.
Root/jailbreak behavior cannot be exercised on a standard device; integrity signals are advisory only.

Open source →