C. Engelke

Oops. Sry. Thic can be closed. Thank you very much Paul.

The purpose of the winkee plugin is to unlock a database without password, just by using the windows account. This configuration is standard when using this plugin I suppose.

If you login to Windows via Hello then you are using the same level of security.! This is true only if you always log out of Windows when leaving your PC unattendet. If you leave your computer (e.g. while time consuming calculations run in background), anyone can open keepass with two keystrokes on the enter key. This is the situation where I believe additional security is added. Are you proposing using Windows Hello as the master key to open a KeePass database? No I am not. As you stated correctly...

I do believe using just your windows user account to encode your database password is inferior to encrypting it with the pin (Windows Hello Security Key. Prompting the user's pin should be possible in c# (Github Windows Passport example). Don't know how to contact Theo about this. Do you think it's worth a try?