Stop Using FLAG_SECURE — Here's a Better Way to Protect Sensitive Screens in Jetpack Compose
Article Summary
Sanath Sajeeva Kumara from PickMe Engineering reveals why FLAG_SECURE is killing your Android app's UX. Banking apps block screenshots entirely—but there's a smarter way to hide sensitive data in Recent Apps while keeping screenshots enabled.
FLAG_SECURE is the standard Android solution for protecting sensitive screens, but it's a blunt instrument that blocks all screenshots and screen recordings. This deep dive presents a Compose-friendly alternative using window focus detection and overlays that protects Recent Apps thumbnails while preserving full screenshot capability in the foreground.
Key Takeaways
- Window focus detection triggers overlay before Recent Apps thumbnail capture
- ModalBottomSheet requires FLAG_SECURE fallback due to separate window rendering
- Single line MarkAsSecureScreen() composable enables per-screen protection
- Lifecycle events like onResume miss edge cases that onWindowFocusChanged catches
- Solution works across all API levels with automatic cleanup on navigation
Replace FLAG_SECURE with a window focus overlay pattern that hides content in Recent Apps while allowing users to take screenshots and record screens when the app is active.
About This Article
Android developers often use FLAG_SECURE to block all screenshots and screen recordings. This prevents users from capturing transaction confirmations or recording support tickets, which creates real problems for fintech and banking apps.
Sanath Sajeeva Kumara's approach uses onWindowFocusChanged() to show a full-screen white overlay before the Recent Apps thumbnail captures. A ScreenSecurityManager singleton detects when ModalBottomSheet is visible and only falls back to FLAG_SECURE when overlay windows are present.
This solution lets users take screenshots and record video in the foreground while hiding sensitive content from Recent Apps. It works across all API levels and uses Compose's DisposableEffect for automatic cleanup. You get the security benefits of FLAG_SECURE without blocking screenshots entirely.