How to Block Screenshots in an Android TWA App

When converting a Progressive Web App (PWA) to an Android application using a Trusted Web Activity (TWA), security and content protection are often top priorities. For SaaS founders, financial applications, health platforms, and premium content providers, preventing users from taking screenshots or recording the screen is a critical requirement. This prevents sensitive data leakage, intellectual property theft, and unauthorised sharing of paid content.

The Limitation of Web-Based Security APIs

In a standard desktop or mobile web browser, a PWA has no direct control over the operating system's screenshot mechanisms. Standard HTML5, CSS, and JavaScript APIs cannot detect, intercept, or block when a user presses the system-level hardware buttons to take a screenshot. While the Page Visibility API can detect when a user switches tabs or minimises the browser, it cannot prevent a user from capturing the active screen. To enforce this level of security, you must implement native Android window flags within the TWA wrapper that launches your web app.

Understanding Android FLAG_SECURE

In the native Android development ecosystem, the standard way to protect window content from being captured is by using the WindowManager.LayoutParams.FLAG_SECURE flag. This flag instructs the Android operating system to treat the content of the window as secure, preventing it from appearing in screenshots, video screen recordings, and non-secure displays. When this flag is active on an Android activity, the system blocks screenshots by displaying a security policy warning to the user. Additionally, any attempt to record the screen will result in a black video stream being captured instead of the app interface. The system also automatically blurs or blanks out the app preview in the recent apps switcher, preventing accidental exposure of sensitive layout data.

Implementing FLAG_SECURE in a TWA Wrapper

To apply this security measure, you must modify the native Android code that wraps your TWA. This code resides in the Java or Kotlin files of the Android Studio project used to compile your APK and Google Play ready AAB. Inside the main activity class that launches the Trusted Web Activity, you must add the secure flag before the content is rendered. Below is an example of how to implement this in the onCreate method of your main activity using Java:

package com.example.twa;

import android.os.Bundle;
import android.view.WindowManager;
import com.google.androidcode.trusted.LauncherActivity;

public class MainActivity extends LauncherActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
getWindow().setFlags(
WindowManager.LayoutParams.FLAG_SECURE,
WindowManager.LayoutParams.FLAG_SECURE
);
super.onCreate(savedInstanceState);
}
}

If your TWA wrapper is written in Kotlin, the implementation follows the same logic but uses Kotlin syntax to set the window flags:

package com.example.twa

import android.os.Bundle;
import android.view.WindowManager;
import com.google.androidcode.trusted.LauncherActivity;

class MainActivity : LauncherActivity() {
override fun onCreate(savedInstanceState: Bundle?) {
window.setFlags(
WindowManager.LayoutParams.FLAG_SECURE,
WindowManager.LayoutParams.FLAG_SECURE
)
super.onCreate(savedInstanceState)
}
}

By placing this code directly before the call to the superclass onCreate method, the Android system configures the window layer to be secure before the Chrome Custom Tab that powers your TWA is loaded. This ensures that the security coverage is active from the very moment the splash screen appears.

The Impact of Secure Flags on User Experience

Implementing FLAG_SECURE has several direct consequences on how your application behaves on an Android device. Developers should understand these side effects to ensure they align with the overall user experience strategy. The primary modifications to system behaviour include:

Testing the Screenshot Blocking Implementation

To verify that the secure flag is working correctly, you must compile and run your application on a physical Android device or an Android Emulator. Testing cannot be done in a standard desktop browser because the FLAG_SECURE setting is exclusive to the Android OS layer. If you are testing on an Android Emulator, you can attempt to use the built-in screen capture tool in Android Studio or the emulator's control panel. If the flag is active, the screenshot tool will fail or capture a blank image. On a physical testing device, attempting to take a screenshot via the hardware buttons (usually Volume Down + Power) should display a system message stating that screenshots are not allowed by the app or your organisation.

Web-Side Defense-in-Depth Measures

While native flags are the only absolute way to block screenshots on Android, developers can combine this with web-side strategies to secure other platforms where the app might be accessed, such as desktop browsers. You can monitor the visibilitychange event in your JavaScript application code to detect when the browser window loses focus, allowing you to blur the interface or clear sensitive state variables:

document.addEventListener('visibilitychange', () => {
if (document.hidden) {
document.body.style.filter = 'blur(10px)';
} else {
document.body.style.filter = 'none';
}
});

Combining native wrapper configurations like FLAG_SECURE with responsive web security features gives your PWA-based Android app a robust security posture, protecting user data across all entry points.