diff --git a/main/io/io.h b/main/io/io.h
index 4ac8b11..ad396f9 100644
--- a/main/io/io.h
+++ b/main/io/io.h
@@ -1,6 +1,7 @@
 #pragma once
 #include "freertos/FreeRTOS.h"
 #include "freertos/event_groups.h"
+#include <memory>
 
 typedef bool(*FilterFunc)(const char* const& key);
 typedef void (*KeyValueProcessor)(void* arg, const char* const& key, const char* const& value);
@@ -16,7 +17,7 @@ public:
 
   // Retrieve a value by key, returns nullptr if key not found
   // The caller is responsible for freeing the returned memory
-  virtual char* get(const char* const& key) const = 0;
+  virtual std::unique_ptr<char[]> get(const char* const& key) const = 0;
   virtual esp_err_t process_all(KeyValueProcessor processor, void* arg) const = 0;
   virtual esp_err_t process_filtered(const char* const& key_prefix, KeyValueProcessor processor, void* arg) const = 0;
   virtual esp_err_t process_filtered(FilterFunc filter_func, KeyValueProcessor processor, void* arg) const = 0;
diff --git a/main/io/nvs_handler.cpp b/main/io/nvs_handler.cpp
index 2803f2d..2a0ad9a 100644
--- a/main/io/nvs_handler.cpp
+++ b/main/io/nvs_handler.cpp
@@ -46,7 +46,7 @@ void NVSStorageHandler::put(const char* const& key, const char* const& value) {
   }
 }
 
-char* NVSStorageHandler::get(const char* const& key) const {
+std::unique_ptr<char[]> NVSStorageHandler::get(const char* const& key) const {
   if (this->nvsHandle == 0) {
     printf("NVS handle is not initialized.\n");
     return nullptr;
@@ -62,11 +62,10 @@ char* NVSStorageHandler::get(const char* const& key) const {
     return nullptr;
   }
 
-  char* value = (char*)malloc(required_size);
-  err = nvs_get_str(this->nvsHandle, key, value, &required_size);
+  std::unique_ptr<char[]> value(new char[required_size]);
+  err = nvs_get_str(this->nvsHandle, key, value.get(), &required_size);
   if (err != ESP_OK) {
     printf("Error (%s) getting value for key %s from NVS!\n", esp_err_to_name(err), key);
-    free(value);
     return nullptr;
   }
 
@@ -106,7 +105,7 @@ esp_err_t NVSStorageHandler::process_all(KeyValueProcessor processor, void* arg)
     }
 
     // call the processor with the key and value
-    processor(arg, info.key, this->get(info.key));
+    processor(arg, info.key, this->get(info.key).get());
   }
   return ESP_OK;
 }
@@ -133,7 +132,7 @@ esp_err_t NVSStorageHandler::process_filtered(const char* const& key_prefix, Key
         return err;
       }
       // call the processor with the key and value
-      processor(arg, info.key, this->get(info.key));
+      processor(arg, info.key, this->get(info.key).get());
     }
   }
   return ESP_OK;
@@ -162,7 +161,7 @@ esp_err_t NVSStorageHandler::process_filtered(FilterFunc filter_func, KeyValuePr
         return err;
       }
       // call the processor with the key and value
-      processor(arg, info.key, this->get(info.key));
+      processor(arg, info.key, this->get(info.key).get());
     }
   }
   return ESP_OK;
diff --git a/main/io/nvs_handler.h b/main/io/nvs_handler.h
index 66ae0af..2761551 100644
--- a/main/io/nvs_handler.h
+++ b/main/io/nvs_handler.h
@@ -3,31 +3,6 @@
 #include "freertos/FreeRTOS.h"
 #include "nvs.h"
 
-class NVSStorageHandler : public KVStorageHandler {
-public:
-  NVSStorageHandler(
-    const char* name_space
-  );
-  ~NVSStorageHandler() override;
-
-  void init(const EventGroupHandle_t& system_event_group) override;
-
-  void put(const char* const& key, const char* const& value) override;
-
-  char* get(const char* const& key) const override;
-  esp_err_t process_all(KeyValueProcessor processor, void* arg) const override;
-  esp_err_t process_filtered(const char* const& key_prefix, KeyValueProcessor processor, void* arg) const override;
-  esp_err_t process_filtered(FilterFunc filter_func, KeyValueProcessor processor, void* arg) const override;
-
-  void remove(const char* const& key) override;
-
-private:
-  NVSIteratorGuard create_iterator() const;
-
-  nvs_handle_t nvsHandle = 0;
-  const char* name_space;
-};
-
 struct NVSIteratorGuard {
 public:
   ~NVSIteratorGuard() {
@@ -35,9 +10,14 @@ public:
       nvs_release_iterator(iterator);
     }
   }
-  const nvs_iterator_t const& get_iterator() const {
+
+  // accessors to the iterator, the internal state should not be modified directly
+  // The iterator is advanced using advance_iter(), and is changed to nullptr on error or end
+  // Caller MUST NOT release the iterator manually nor call get_iterator after advance_iter
+  const nvs_iterator_t& get_iterator() const {
     return iterator;
   }
+
   void advance_iter() {
     if (iterator) {
       // advance the iterator and update the internal state
@@ -63,3 +43,28 @@ private:
   nvs_iterator_t iterator;
   esp_err_t error;
 };
+
+class NVSStorageHandler : public KVStorageHandler {
+public:
+  NVSStorageHandler(
+    const char* name_space
+  );
+  ~NVSStorageHandler() override;
+
+  void init(const EventGroupHandle_t& system_event_group) override;
+
+  void put(const char* const& key, const char* const& value) override;
+
+  std::unique_ptr<char[]> get(const char* const& key) const override;
+  esp_err_t process_all(KeyValueProcessor processor, void* arg) const override;
+  esp_err_t process_filtered(const char* const& key_prefix, KeyValueProcessor processor, void* arg) const override;
+  esp_err_t process_filtered(FilterFunc filter_func, KeyValueProcessor processor, void* arg) const override;
+
+  void remove(const char* const& key) override;
+
+private:
+  NVSIteratorGuard create_iterator() const;
+
+  nvs_handle_t nvsHandle = 0;
+  const char* name_space;
+};
diff --git a/main/network/wifi_handler.cpp b/main/network/wifi_handler.cpp
index 4a13241..4697985 100644
--- a/main/network/wifi_handler.cpp
+++ b/main/network/wifi_handler.cpp
@@ -278,7 +278,7 @@ void WifiHandler::get_wifi_credentials(char*& ssid, char*& password) {
     ESP_LOGW(TAG, "KVStorageHandler not set, cannot get WiFi credentials");
     return;
   }
-  ssid = kvs->get(WIFI_SSID_KEY);
+  ssid = kvs->get(WIFI_SSID_KEY).get();
   if (!ssid) {
     ssid = nullptr;
     password = nullptr;
@@ -286,7 +286,7 @@ void WifiHandler::get_wifi_credentials(char*& ssid, char*& password) {
   }
   // password is from KV storage, may be nullptr
   char* password_key = this->build_password_key(ssid);
-  password = kvs->get(password_key);
+  password = kvs->get(password_key).get();
   delete[] password_key;
 }