Secure Enclave
Last verified
The Secure Enclave is an isolated hardware coprocessor with its own boot process and encrypted memory. It handles biometric matching and key operations without exposing key material to the main processor or the OS.
For credential storage this means a Keychain item protected by the Enclave is bound to that physical device — extraction requires the hardware, not just a copy of the filesystem.
It is why "keys stay on your device" is a meaningfully stronger claim on iOS than a general promise about encryption.