It depends on the implementation, but I think that's the general idea. https://developer.android.com/privacy-and-security/keystore for Android, for example.