Windows Hello unlock support for PearPass Desktop on Windows

Hi PearPass team,

I would like to request Windows Hello support for the PearPass Desktop app on Windows.

Requested feature

Please consider adding an option to unlock PearPass Desktop on Windows using Windows Hello, including fingerprint, face recognition, or Windows Hello PIN where available.

Suggested behavior:

• After the user unlocks the vault with the master password once, allow enabling Windows Hello unlock in Settings.

• On subsequent unlocks, allow the user to unlock the vault with Windows Hello instead of typing the master password every time.

• Keep the master password as the fallback and primary recovery method.

• Require the master password again after security-sensitive events, for example:

  • system reboot;

  • app restart, depending on the chosen security model;

  • failed or cancelled Windows Hello attempts;

  • Windows Hello being disabled or changed in Windows settings;

  • vault timeout or manual lock, depending on the configured policy.

• Add a clear setting such as:

  • Unlock with Windows Hello

  • optional timeout controls, for example Require master password after X minutes / after restart.

Security expectations

Since PearPass is a password manager, Windows Hello should only be used as a local unlock mechanism and should preserve the existing vault security model.

Ideally:

• Unlock material should be protected using Windows-native secure storage mechanisms where appropriate, for example Windows Hello / TPM-backed APIs / platform-protected key storage.

• The master password should not be stored, logged, or exposed in plaintext.

• The renderer process should not be able to bypass the Windows Hello gate.

• Users should be able to disable Windows Hello unlock at any time.

• If Windows Hello is unavailable, fails, or is cancelled, PearPass should fall back to the vault master password.

Why this matters

PearPass already focuses on local-first, privacy-preserving password management. Windows Hello unlock would make the Windows desktop experience much more practical for everyday use, especially when the vault locks frequently.

This would also bring Windows closer to the biometric unlock experience available on mobile platforms and to the Touch ID support being discussed for macOS.

Thanks for considering this.