Long story short: “StrongBox” means that the keys are stored in a Secure Element (“Titan M” chip in the Pixel 3 phones), whereas “hardware-backed” means something more generic like “somewhere outside of the Android OS” (the standard implementation of it being in a TEE).

What does Android KeyChain do?

The KeyChain class provides access to private keys and their corresponding certificate chains in credential storage. Call getPrivateKey(Context, String) and getCertificateChain(Context, String) to retrieve the credentials to return to the corresponding X509KeyManager callbacks. …

Is Android keystore safe?

A strongbox backed Android Keystore is currently the most secure and recommended type of keystore. … For example the Android Keystore uses a hardware chip to store the keys in a secure way, while the Bouncy Castle Keystore (BKS) is a software keystore and uses an encrypted file placed on the file system.