New to Firebase, have a few questions about custom user auth and storing data on Android. -

i'm implementing firebase in android app , have few questions.

1) i'll using custom auth , docs perform token generation on "secure server", because secret exposed. mean it's not safe within login activity class, or secure?

2) i'll sending several required values database upon registration (username, password, etc). done this...

var token = tokengenerator.createtoken(     {uid: "custom:1", username: "string", password: "string"}); 

? if so, how securely store passwords?

3) i'll saving images database, of quite large (iphone 6 , galaxy s6 take ridiculous pictures). fine store byte[], along other info image (uploader, data, etc)? or there better way it?

sorry long post, want make sure know i'm doing before diving in :)

1) i'll using custom auth , docs perform token generation on "secure server", because secret exposed. mean it's not safe within login activity class, or secure?

this means cannot stored in client, period. storing secret anywhere in android application insecure. token generation should take place on server.

if so, how securely store passwords?

if you're looking password-based authentication, try firebase's built-in password authentication remove need generate tokens in client app.

will fine store byte[], along other info image (uploader, data, etc)? or there better way it?

firebase allows storage of strings, booleans, , numbers, binary data need base64-encoded before storing. stay tuned though, more options coming!

update (20160519): firebase released new feature called firebase storage. allows upload images , other non-json data dedicated storage service. highly recommend use storing images, instead of storing them base64 encoded data in json database.