A protocol that enables encoding and decoding in a manner that is robust against object substitution attacks.


protocol NSSecureCoding


Historically, many classes decoded instances of themselves like this:

if let object = decoder.decodeObjectForKey("myKey") as MyClass {
    // ...succeeds...
} else {

This technique is potentially unsafe because by the time you can verify the class type, the object has already been constructed, and if this is part of a collection class, potentially inserted into an object graph.

In order to conform to NSSecureCoding:

  • An object that does not override init(coder:) can conform to NSSecureCoding without any changes (assuming that it is a subclass of another class that conforms).

  • An object that does override init(coder:) must decode any enclosed objects using the decodeObjectOfClass:forKey: method. For example:

    let obj = decoder.decodeObject(of:MyClass.self, forKey: "myKey")

    In addition, the class must override the getter for its supportsSecureCoding property to return true.

For more information about how this relates to the NSXPC API, see Creating XPC Services in Daemons and Services Programming Guide.


Checking for Secure Coding

static var supportsSecureCoding: Bool

A Boolean value that indicates whether or not the class supports secure coding.



Inherits From

Conforming Types

See Also

First Steps

Encoding and Decoding Custom Types

Make your data types encodable and decodable for compatibility with external representations such as JSON.

typealias Codable

A type that can convert itself into and out of an external representation.

protocol NSCoding

A protocol that enables an object to be encoded and decoded for archiving and distribution.