Latest post of the previous page:I agree with Ariman:
1) Save the passwords in a separate database, encrypted with a master key.
2) The master key should be randomly generated and also encrypted. As for the key to this, give the user a choice:
a) Password entered by the user on first access in the session.
b) Password read from the Windows credential store.
c) Password read from DPAPI.
d) Key decrypted using a private key stored in the Windows certificate store (this will give the user an opportunity to store the data on a smartcard).
3) In all of the cases above, if you are using a password (=user-entered data rather than randomly generated), process it using a secure (and slow!) key derivation function (e.g. Argon or scrypt - with user-configurable parameters).
4) When the user asks for a protected password for the first time in a session, read whatever data is necessary to decrypt the master key and, based on configuration:
a) Forget it after first use.
b) Forget it after the specified number of seconds since the last use.
c) Forget it when Windows session is locked.
d) Keep it in memory indefinitely.
e) Provide a UI to forget the remembered value right now.