Android - Storing sensitive data in the sqlite database

You said...

I don't want to ask the user to fill in a key either, I just want it to work on it's own. Because I am afraid of reverse engineering I don't want to put an encryption key in the code either.

Unfortunately, you need to do one of these things (well, probably). You can ask the user for a password and then derive a key from that using an algorithm designed for that purpose (that's known as Password Based Encryption - PBE - and Android includes some good PBE algorithms standard). You could store the key in your code or as a resource within your APK, but then someone would be able to reverse engineer it. You can do so and obfuscate your code, which will slow down the reverse engineering process, but you cannot make it impossible (your code will need to determine the key at some point so it's just a matter of an attacker figuring out how it is doing it).

Other approaches that have been tried here include forcing your client to connect back to a server to retrieve the key over the network...but then what happens if network connectivity is interrupted and what prevents the server from giving the key out to anyone, like an attacker? Well, then you could use mutually-authenticated SSL to ensure only your client is allowed to get it...but then you need to store the client-side SSL private key...which is exactly the same problem you have now. :)

So...the bottom line is that you need a key (or something equivalent) to encrypt/decrypt the data. You can store it and make it harder for someone to reverse engineer it. You can inconvenience the user and make them type in a password. But...you need that secret knowledge somehow.

Symmetric cryptography requires a key to encrypt and the same key to decrypt. There is no way around it.

Do not store the key in the code because it can be decompiled (Like you've said).

Ask the user for a password on the first use and use PBKDF2 to derive a cryptographically secure key to use in the encryption.

Either the user has to enter the password or you need to store it in the memory. What I'd do is, ask the user to specify a duration where the key will be cached in the memory to use for decryption.

And if the duration is expired, the user WILL have to enter the password again.

I didn't check SQLCipher thoroughly but it says it uses AES-256. AES is a symmetric cryptographic algorithm and it needs a key to encrypt and the same key to decrypt.

Is it possible to let apps auto gen a random password? May be gen from place,time or others information this will no need to ask user's pass.