How to Build Encrypted Storage in SwiftUI

import SwiftUI
import CryptoKit
import Security

// MARK: - Keychain Helper

enum KeychainError: Error, LocalizedError {
    case unexpectedStatus(OSStatus)
    case itemNotFound

    var errorDescription: String? {
        switch self {
        case .itemNotFound:            return "No item found in Keychain."
        case .unexpectedStatus(let s): return "Keychain OSStatus \(s)."
        }
    }
}

struct KeychainHelper {
    static func save(_ data: Data, service: String, account: String) throws {
        let query: [CFString: Any] = [
            kSecClass:       kSecClassGenericPassword,
            kSecAttrService: service,
            kSecAttrAccount: account,
            kSecValueData:   data
        ]
        // Delete existing item first to allow updates
        SecItemDelete(query as CFDictionary)
        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw KeychainError.unexpectedStatus(status)
        }
    }

    static func load(service: String, account: String) throws -> Data {
        let query: [CFString: Any] = [
            kSecClass:            kSecClassGenericPassword,
            kSecAttrService:      service,
            kSecAttrAccount:      account,
            kSecReturnData:       true,
            kSecMatchLimit:       kSecMatchLimitOne
        ]
        var item: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &item)
        guard status == errSecSuccess else {
            if status == errSecItemNotFound { throw KeychainError.itemNotFound }
            throw KeychainError.unexpectedStatus(status)
        }
        return item as! Data
    }
}

// MARK: - Encrypted Store

struct EncryptedStore {
    private let keyService  = "com.yourapp.encryptedstore"
    private let keyAccount  = "symmetricKey"
    private let dataService = "com.yourapp.encryptedstore"
    private let dataAccount = "payload"

    /// Returns existing key from Keychain or generates + persists a new one.
    func symmetricKey() throws -> SymmetricKey {
        if let raw = try? KeychainHelper.load(service: keyService, account: keyAccount) {
            return SymmetricKey(data: raw)
        }
        let key = SymmetricKey(size: .bits256)
        let raw = key.withUnsafeBytes { Data($0) }
        try KeychainHelper.save(raw, service: keyService, account: keyAccount)
        return key
    }

    func save(_ string: String) throws {
        guard let plaintext = string.data(using: .utf8) else { return }
        let key  = try symmetricKey()
        let box  = try AES.GCM.seal(plaintext, using: key)
        try KeychainHelper.save(box.combined!, service: dataService, account: dataAccount)
    }

    func load() throws -> String {
        let key        = try symmetricKey()
        let combined   = try KeychainHelper.load(service: dataService, account: dataAccount)
        let box        = try AES.GCM.SealedBox(combined: combined)
        let plaintext  = try AES.GCM.open(box, using: key)
        return String(data: plaintext, encoding: .utf8) ?? ""
    }
}

// MARK: - SwiftUI View

struct EncryptedStorageView: View {
    @State private var inputText   = ""
    @State private var loadedText  = ""
    @State private var errorMsg    = ""
    @State private var store       = EncryptedStore()

    var body: some View {
        NavigationStack {
            Form {
                Section("Save Secret") {
                    TextField("Enter secret text…", text: $inputText)
                        .accessibilityLabel("Secret text input")
                    Button("Encrypt & Save") {
                        do {
                            try store.save(inputText)
                            errorMsg = ""
                        } catch {
                            errorMsg = error.localizedDescription
                        }
                    }
                    .disabled(inputText.isEmpty)
                }

                Section("Load Secret") {
                    Button("Decrypt & Load") {
                        do {
                            loadedText = try store.load()
                            errorMsg   = ""
                        } catch {
                            errorMsg   = error.localizedDescription
                        }
                    }
                    if !loadedText.isEmpty {
                        Text(loadedText)
                            .font(.body.monospaced())
                            .accessibilityLabel("Decrypted secret: \(loadedText)")
                    }
                }

                if !errorMsg.isEmpty {
                    Section {
                        Label(errorMsg, systemImage: "exclamationmark.triangle")
                            .foregroundStyle(.red)
                    }
                }
            }
            .navigationTitle("Encrypted Storage")
        }
    }
}

#Preview {
    EncryptedStorageView()
}