Published capacitor-pq-secure-storage. It does ML-DSA signing and ML-KEM, with the private keys held
in the iOS Secure Enclave and the Android Keystore, gated by a biometric per operation. Also
AES-256-GCM at rest and a biometric-gated key-value store, plus a software fallback on the web for
development.
Install:
npm i capacitor-pq-secure-storage (Capacitor 8)
npm i capacitor-pq-secure-storage@7 (Capacitor 7)
Being straight about the state: iOS is verified on a physical iPhone 15 Pro / iOS 26. Android runs
but is only verified on an emulator, so the StrongBox attestation isn’t confirmed on real hardware
yet. getHardwareCapabilities() reports the real security level at runtime so you can gate on it.
MIT License.
Article: Post-quantum signing keys that never leave the Secure Enclave - DEV Community
NPM: https://www.npmjs.com/package/capacitor-pq-secure-storage