> and then use a hardcoded key to encrypt them Ask this question instead: Why bother to encrypt them in the first place? What is the attack scenario you are t

> and then use a hardcoded key to encrypt them Ask this question instead: Why bother to encrypt them in the first place? What is the attack scenario you are trying to defend against? This is local software - it need to be able to decrypt the key and use it to login. So at the end of the day it's the same machine with the password and the key to decrypt the password. It seems pretty pointless to even encrypt them in the first place. So why do it? I don't know, maybe just to make it marginally harder to see the password. If that's the entire goal, there isn't really any reason no to use a hardcoded key - it accomplishes that goal just fine. Ask yourself this: What attack scenario would a different key per machine defend against that a hardcoded key would not?