Windows equivalent of OS X Keychain?

Windows 8 has a notion of a keychain called Password Vault. Windows Runtime apps (Modern/Metro) as well as managed desktop apps can make use of it. According to the documentation:

Apps and services don't have access to credentials associated with other apps or services.

See How to store user credentials on MSDN.

Pre-Windows 8, Data Protection API (DPAPI) is the closest equivalent to a keychain. Arbitrary data can be encrypted using this API, although storing the encrypted data is up to the developer. The data is ultimately encrypted using the current user's password, however user or developer supplied "optional entropy" could be included to further protect the data from other software or users. The data can also be decrypted on different computers in a domain.

DPAPI can be accessed through native calls to Crypt32.dll's CryptProtectData and CryptUnprotectData functions or through .NET Framework's ProtectedData class, which is a limited feature wrapper for the former functions.

More information than you ever needed to know about DPAPI is available in Passcape's article DPAPI Secrets. Security analysis and data recovery in DPAPI.


Actually, looking through MSDN, the functions they recommend using (instead of Protected Storage) are:

  • CryptProtectData
  • CryptUnprotectData

The link for CryptProtectData is at CryptProtectData function.


It is year 2018, and Windows 10 has a "Credential Manager" that can be found in "Control Panel"


The "traditional" Windows equivalent would be the Protected Storage subsystem, used by IE (pre IE 7), Outlook Express, and a few other programs. I believe it's encrypted with your login password, which prevents some offline attacks, but once you're logged in, any program that wants to can read it. (See, for example, NirSoft's Protected Storage PassView.)

Windows also provides the CryptoAPI and Data Protection API that might help. Again, though, I don't think that Windows does anything to prevent processes running under the same account from seeing each other's passwords.

It looks like the book Mechanics of User Identification and Authentication provides more details on all of these.

Eclipse (via its Secure Storage feature) implements something like this, if you're interested in seeing how other software does it.