diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9cc3824..22bcafe 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,6 @@ jobs:
   build:
     name: Build and Test
     runs-on: windows-latest
-    if: "!contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-java@v4
@@ -26,7 +25,7 @@ jobs:
         run: mvn -B versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
       - name: Build and Test
         id: buildAndTest
-        run: mvn -B clean test
+        run: mvn -B clean test -DdevCommandFileDir="${{ vars.MSVC_DEV_FILES_DIR }}"
       - name: Codesign DLL on release
         if: startsWith(github.ref, 'refs/tags/')
         uses: skymatic/code-sign-action@v3
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e786bc1..645b5c9 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,6 +13,9 @@ defaults:
   run:
     shell: bash
 
+env:
+  MSVC_DEV_FILES_DIR: ${{ vars.MSVC_DEV_FILES_DIR ||'C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\VC\\Auxiliary\\Build\\' }}
+
 jobs:
   analyse:
     name: Analyse
@@ -32,6 +35,6 @@ jobs:
       with:
         languages: java
     - name: Build
-      run: mvn -B compile
+      run: mvn -B compile -DdevCommandFileDir="${{ env.MSVC_DEV_FILES_DIR }}"
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v3
\ No newline at end of file
diff --git a/.github/workflows/publish-central.yml b/.github/workflows/publish-central.yml
index f445539..c8026ed 100644
--- a/.github/workflows/publish-central.yml
+++ b/.github/workflows/publish-central.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Enforce project version ${{ github.event.inputs.tag }}
         run: mvn versions:set -B -DnewVersion="${{ github.event.inputs.tag }}"
       - name: Deploy
-        run: mvn deploy -B -DskipTests -Psign,deploy-central --no-transfer-progress
+        run: mvn deploy -B -DskipTests -Psign,deploy-central --no-transfer-progress -DdevCommandFileDir="${{ vars.MSVC_DEV_FILES_DIR }}"
         env:
           MAVEN_OPTS: >
             --add-opens=java.base/java.util=ALL-UNNAMED
diff --git a/.github/workflows/publish-github.yml b/.github/workflows/publish-github.yml
index 95fe4b8..9b46bd6 100644
--- a/.github/workflows/publish-github.yml
+++ b/.github/workflows/publish-github.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Enforce project version ${{ github.event.release.tag_name }}
         run: mvn versions:set -B -DnewVersion="${{ github.event.release.tag_name }}"
       - name: Deploy
-        run: mvn deploy -B -DskipTests -Psign,deploy-github --no-transfer-progress
+        run: mvn deploy -B -DskipTests -Psign,deploy-github --no-transfer-progress -DdevCommandFileDir="${{ vars.MSVC_DEV_FILES_DIR }}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
diff --git a/.gitignore b/.gitignore
index f74150f..9a3e2cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,9 @@
 *.class
 *.jar
 *.dll
+*.obj
+*.lib
+*.exp
 
 # Maven #
 target/
@@ -16,3 +19,73 @@ pom.xml.versionsBackup
 .idea/compiler.xml
 .idea/jarRepositories.xml
 *.iml
+
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+##
+## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore
+
+# User-specific files
+*.rsuser
+*.suo
+*.user
+*.userosscache
+*.sln.docstates
+
+# User-specific files (MonoDevelop/Xamarin Studio)
+*.userprefs
+
+# Build results
+[Dd]ebug/
+[Dd]ebugPublic/
+[Rr]elease/
+[Rr]eleases/
+x64/
+x86/
+[Ww][Ii][Nn]32/
+[Aa][Rr][Mm]/
+[Aa][Rr][Mm]64/
+bld/
+[Bb]in/
+[Oo]bj/
+[Ll]og/
+[Ll]ogs/
+
+# Visual Studio 2015/2017 cache/options directory
+.vs/
+
+# Files built by Visual Studio
+*_i.c
+*_p.c
+*_h.h
+*.ilk
+*.meta
+*.obj
+*.iobj
+*.pch
+*.pdb
+*.ipdb
+*.pgc
+*.pgd
+*.rsp
+# but not Directory.Build.rsp, as it configures directory-level build defaults
+!Directory.Build.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*_wpftmp.csproj
+*.log
+*.tlog
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.svclog
+*.scc
+
+# exclude compile outputs not used by projects
+*.exp
+*.lib
\ No newline at end of file
diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml
index 7056c82..ae42c80 100644
--- a/.idea/codeStyles/Project.xml
+++ b/.idea/codeStyles/Project.xml
@@ -1,5 +1,10 @@
 <component name="ProjectCodeStyleConfiguration">
   <code_scheme name="Project" version="173">
+    <option name="OTHER_INDENT_OPTIONS">
+      <value>
+        <option name="TAB_SIZE" value="2" />
+      </value>
+    </option>
     <JavaCodeStyleSettings>
       <option name="VISIBILITY" value="packageLocal" />
       <option name="CLASS_COUNT_TO_USE_IMPORT_ON_DEMAND" value="99" />
diff --git a/Makefile b/Makefile
index 09525fb..3002902 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,10 @@
-HEADERS := -I"src/main/headers" -I"${JAVA_HOME}\include" -I"${JAVA_HOME}\include\win32"
+# Note: make apparently thinks, that options specified with "/" are absolute paths and resolves them. see also https://stackoverflow.com/questions/17012419/d9024-make-unrecognized-source-file-type
+WIN_SDK_VERSION ?= 10.0.22621.0
+MSVC_VERSION ?= 14.41.34120
+HEADERS := -I"src\main\headers" \
+	-I"${JAVA_HOME}\include" \
+	-I"${JAVA_HOME}\include\win32" \
+	-I"C:\Program Files (x86)\Windows Kits\10\Include\$(WIN_SDK_VERSION)\cppwinrt"
 SOURCES := $(wildcard src/main/native/*.cpp)
 
 ########
@@ -6,4 +12,10 @@ SOURCES := $(wildcard src/main/native/*.cpp)
 all: install
 
 install:
-	g++ -Wall -D_JNI_IMPLEMENTATION_ -Wl,--kill-at $(HEADERS) -shared -osrc/main/resources/integrations.dll $(SOURCES) -lcrypt32 -lshell32 -lole32 -luuid
\ No newline at end of file
+	cl -EHsc -std:c++17 -LD -W4 -guard:cf \
+		-Fe"src/main/resources/integrations.dll" \
+		-Fo"target/" \
+		$(HEADERS) $(SOURCES) \
+		-link -NXCOMPAT -DYNAMICBASE \
+		-implib:target/integrations.lib \
+		crypt32.lib shell32.lib ole32.lib uuid.lib user32.lib Advapi32.lib windowsapp.lib
diff --git a/README.md b/README.md
index 5bd462d..2f8217a 100644
--- a/README.md
+++ b/README.md
@@ -6,13 +6,23 @@ Windows-specific implementations of [integrations-api](https://github.com/crypto
 
 This project uses the following JVM properties:
 * `cryptomator.integrationsWin.autoStartShellLinkName` - Name of the shell link, which is placed in the Windows startup folder to start application on user login
+* `cryptomator.integrationsWin.windowsHelloKeyId` - Identifier for the Windows Hello keypair
+* `cryptomator.integrationsWin.windowsHelloKeychainPaths` - Locations of the file-based windowsHello keychain 
 * `cryptomator.integrationsWin.keychainPaths` - List of file paths, which are checked for data encrypted with the Windows data protection api
 
 ## Building
 
-This project uses JNI, hence you'll nedd Java as well as GCC build tools:
+### Requirements
 
 * JDK 22
 * Maven
-* MinGW GCC compiler (`choco install mingw --version=10.2.0`)
-* Make (`choco install make`)
\ No newline at end of file
+* MSVC 2022 toolset (e.g. by installing Visual Studio 2022, Workset "Desktop development with C++")
+* Make (`choco install make`)
+
+### Build
+Open a terminal and run
+```
+mvn clean verify
+```
+
+If building the dll fails with "cl.exe cannot be found", you have to specify the developer command file directory as a property, e.g. `-DdevCommandFileDir=C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\"`.
\ No newline at end of file
diff --git a/integrations-win.sln b/integrations-win.sln
new file mode 100644
index 0000000..2e4e468
--- /dev/null
+++ b/integrations-win.sln
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.11.35327.3
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "integrations-win", "integrations-win.vcxproj", "{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Debug|x64.ActiveCfg = Debug|x64
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Debug|x64.Build.0 = Debug|x64
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Debug|x86.ActiveCfg = Debug|Win32
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Debug|x86.Build.0 = Debug|Win32
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Release|x64.ActiveCfg = Release|x64
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Release|x64.Build.0 = Release|x64
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Release|x86.ActiveCfg = Release|Win32
+		{CF96ACE0-9471-4BD6-AD0E-BE32AF14C358}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {DCEB853F-9857-4F7D-A508-A7390F37BC50}
+	EndGlobalSection
+EndGlobal
diff --git a/integrations-win.vcxproj b/integrations-win.vcxproj
new file mode 100644
index 0000000..4ae64ff
--- /dev/null
+++ b/integrations-win.vcxproj
@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>17.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{cf96ace0-9471-4bd6-ad0e-be32af14c358}</ProjectGuid>
+    <RootNamespace>integrationswin</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.22621.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <IncludePath>$(ProjectDir)src\main\headers;$(JAVA_HOME)include;$(JAVA_HOME)include\win32;$(IncludePath)</IncludePath>
+    <IntDir>$(SolutionDir)target\native\$(Platform)\$(Configuration)\</IntDir>
+    <TargetName>integrations</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;INTEGRATIONSWIN_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <PrecompiledHeaderFile>
+      </PrecompiledHeaderFile>
+      <LanguageStandard>stdcpp17</LanguageStandard>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+      <ForceSymbolReferences>%(ForceSymbolReferences)</ForceSymbolReferences>
+      <AdditionalDependencies>crypt32.lib;shell32.lib;ole32.lib;uuid.lib;user32.lib;windowsapp.lib</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;INTEGRATIONSWIN_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="src\main\headers\org_cryptomator_windows_autostart_WinShellLinks_Native.h" />
+    <ClInclude Include="src\main\headers\org_cryptomator_windows_keychain_WinDataProtection_Native.h" />
+    <ClInclude Include="src\main\headers\org_cryptomator_windows_keychain_WindowsHello_Native.h" />
+    <ClInclude Include="src\main\headers\org_cryptomator_windows_uiappearance_WinAppearance_Native.h" />
+    <ClInclude Include="src\main\resources\ktmw32_helper.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="src\main\native\org_cryptomator_windows_autostart_WinShellLinks_Native.cpp" />
+    <ClCompile Include="src\main\native\org_cryptomator_windows_keychain_WinDataProtection_Native.cpp" />
+    <ClCompile Include="src\main\native\org_cryptomator_windows_keychain_WindowsHello_Native.cpp" />
+    <ClCompile Include="src\main\native\org_cryptomator_windows_uiappearnce_WinAppearance_Native.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index b4ffdbf..208d251 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.cryptomator</groupId>
 	<artifactId>integrations-win</artifactId>
-	<version>1.3.0</version>
+	<version>1.4.0</version>
 
 	<name>Cryptomator Integrations for Windows</name>
 	<description>Provides optional Windows services used by Cryptomator</description>
@@ -37,16 +37,16 @@
 		<project.jdk.version>22</project.jdk.version>
 
 		<!-- runtime dependencies -->
-		<api.version>1.4.0</api.version>
+		<api.version>1.5.0</api.version>
 		<slf4j.version>2.0.16</slf4j.version>
-		<jackson.version>2.17.2</jackson.version>
+		<jackson.version>2.18.2</jackson.version>
 
 		<!-- test dependencies -->
-		<junit.jupiter.version>5.10.3</junit.jupiter.version>
-		<mockito.version>5.12.0</mockito.version>
+		<junit.jupiter.version>5.11.4</junit.jupiter.version>
+		<mockito.version>5.15.2</mockito.version>
 
 		<!-- build plugin dependencies -->
-		<dependency-check.version>10.0.3</dependency-check.version>
+		<dependency-check.version>11.1.1</dependency-check.version>
 		<nexus-staging.version>1.7.0</nexus-staging.version>
 		<jextract-maven.version>0.4.1</jextract-maven.version>
 
@@ -157,6 +157,19 @@
 					</execution>
 				</executions>
 			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-dependency-plugin</artifactId>
+				<version>3.8.1</version>
+				<executions>
+					<execution>
+						<id>jar-paths-to-properties</id>
+						<goals>
+							<goal>properties</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
 			<plugin>
 				<artifactId>maven-resources-plugin</artifactId>
 				<version>3.3.1</version>
@@ -185,7 +198,26 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
-				<version>3.3.1</version>
+				<version>3.5.2</version>
+				<dependencies>
+					<dependency>
+						<groupId>me.fabriciorby</groupId>
+						<artifactId>maven-surefire-junit5-tree-reporter</artifactId>
+						<version>1.4.0</version>
+					</dependency>
+				</dependencies>
+				<configuration>
+					<systemPropertyVariables>
+						<org.slf4j.simpleLogger.defaultLogLevel>ERROR</org.slf4j.simpleLogger.defaultLogLevel>
+					</systemPropertyVariables>
+					<consoleOutputReporter>
+						<disable>true</disable>
+					</consoleOutputReporter>
+					<statelessTestsetInfoReporter
+							implementation="org.apache.maven.plugin.surefire.extensions.junit5.JUnit5StatelessTestsetInfoTreeReporter">
+					</statelessTestsetInfoReporter>
+					<argLine>-javaagent:"${net.bytebuddy:byte-buddy-agent:jar}"</argLine>
+				</configuration>
 			</plugin>
 			<plugin>
 				<artifactId>maven-source-plugin</artifactId>
@@ -201,7 +233,7 @@
 			</plugin>
 			<plugin>
 				<artifactId>maven-javadoc-plugin</artifactId>
-				<version>3.8.0</version>
+				<version>3.11.2</version>
 				<executions>
 					<execution>
 						<id>attach-javadocs</id>
@@ -295,12 +327,15 @@
 					<name>!skipNativeCompile</name>
 				</property>
 			</activation>
+			<properties>
+				<devCommandFileDir>C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\</devCommandFileDir>
+			</properties>
 			<build>
 				<plugins>
 					<plugin>
 						<groupId>org.codehaus.mojo</groupId>
 						<artifactId>exec-maven-plugin</artifactId>
-						<version>3.3.0</version>
+						<version>3.5.0</version>
 						<executions>
 							<execution>
 								<goals>
@@ -308,13 +343,14 @@
 								</goals>
 								<phase>compile</phase>
 								<configuration>
-									<executable>make</executable>
+									<executable>cmd</executable>
 									<workingDirectory>${project.basedir}</workingDirectory>
 									<environmentVariables>
 										<JAVA_HOME>${java.home}</JAVA_HOME>
 									</environmentVariables>
 									<arguments>
-										<argument>install</argument>
+										<argument>/c</argument>
+										<argument>"${devCommandFileDir}\vcvars64.bat" &amp;&amp; make install</argument>
 									</arguments>
 								</configuration>
 							</execution>
@@ -330,7 +366,7 @@
 				<plugins>
 					<plugin>
 						<artifactId>maven-gpg-plugin</artifactId>
-						<version>3.2.4</version>
+						<version>3.2.7</version>
 						<executions>
 							<execution>
 								<id>sign-artifacts</id>
@@ -388,7 +424,7 @@
 					<plugin>
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-deploy-plugin</artifactId>
-						<version>3.1.2</version>
+						<version>3.1.3</version>
 					</plugin>
 				</plugins>
 			</build>
diff --git a/src/main/headers/org_cryptomator_windows_keychain_WindowsHello_Native.h b/src/main/headers/org_cryptomator_windows_keychain_WindowsHello_Native.h
new file mode 100644
index 0000000..70b464a
--- /dev/null
+++ b/src/main/headers/org_cryptomator_windows_keychain_WindowsHello_Native.h
@@ -0,0 +1,37 @@
+/* DO NOT EDIT THIS FILE - it is machine generated */
+#include <jni.h>
+/* Header for class org_cryptomator_windows_keychain_WindowsHello_Native */
+
+#ifndef _Included_org_cryptomator_windows_keychain_WindowsHello_Native
+#define _Included_org_cryptomator_windows_keychain_WindowsHello_Native
+#ifdef __cplusplus
+extern "C" {
+#endif
+/*
+ * Class:     org_cryptomator_windows_keychain_WindowsHello_Native
+ * Method:    isSupported
+ * Signature: ()Z
+ */
+JNIEXPORT jboolean JNICALL Java_org_cryptomator_windows_keychain_WindowsHello_00024Native_isSupported
+  (JNIEnv *, jobject);
+
+/*
+ * Class:     org_cryptomator_windows_keychain_WindowsHello_Native
+ * Method:    setEncryptionKey
+ * Signature: ([B[B[B)[B
+ */
+JNIEXPORT jbyteArray JNICALL Java_org_cryptomator_windows_keychain_WindowsHello_00024Native_setEncryptionKey
+  (JNIEnv *, jobject, jbyteArray, jbyteArray, jbyteArray);
+
+/*
+ * Class:     org_cryptomator_windows_keychain_WindowsHello_Native
+ * Method:    getEncryptionKey
+ * Signature: ([B[B[B)[B
+ */
+JNIEXPORT jbyteArray JNICALL Java_org_cryptomator_windows_keychain_WindowsHello_00024Native_getEncryptionKey
+  (JNIEnv *, jobject, jbyteArray, jbyteArray, jbyteArray);
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/src/main/java/module-info.java b/src/main/java/module-info.java
index 56cb5a5..0ebecda 100644
--- a/src/main/java/module-info.java
+++ b/src/main/java/module-info.java
@@ -4,6 +4,7 @@
 import org.cryptomator.integrations.revealpath.RevealPathService;
 import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
 import org.cryptomator.windows.autostart.WindowsAutoStart;
+import org.cryptomator.windows.keychain.WindowsHelloKeychainAccess;
 import org.cryptomator.windows.keychain.WindowsProtectedKeychainAccess;
 import org.cryptomator.windows.quickaccess.ExplorerQuickAccessService;
 import org.cryptomator.windows.revealpath.ExplorerRevealPathService;
@@ -19,7 +20,7 @@
 	opens org.cryptomator.windows.quickaccess to org.cryptomator.integrations.api;
 
 	provides AutoStartProvider with WindowsAutoStart;
-	provides KeychainAccessProvider with WindowsProtectedKeychainAccess;
+	provides KeychainAccessProvider with WindowsProtectedKeychainAccess, WindowsHelloKeychainAccess;
 	provides UiAppearanceProvider with WinUiAppearanceProvider;
 	provides RevealPathService with ExplorerRevealPathService;
 	provides QuickAccessService with ExplorerQuickAccessService;
diff --git a/src/main/java/org/cryptomator/windows/autostart/WinShellLinks.java b/src/main/java/org/cryptomator/windows/autostart/WinShellLinks.java
index a1b26f0..83e4df0 100644
--- a/src/main/java/org/cryptomator/windows/autostart/WinShellLinks.java
+++ b/src/main/java/org/cryptomator/windows/autostart/WinShellLinks.java
@@ -1,9 +1,8 @@
 package org.cryptomator.windows.autostart;
 
 import org.cryptomator.windows.common.NativeLibLoader;
+import org.cryptomator.windows.common.WinStrings;
 
-import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
 
 /**
  * Interface to the native Windows shell link interface.
@@ -22,9 +21,9 @@ public class WinShellLinks {
 	 */
 	public int createShortcut(String target, String storagePath, String description) {
 		return Native.INSTANCE.createShortcut(
-				getNullTerminatedUTF16Representation(target),
-				getNullTerminatedUTF16Representation(storagePath),
-				getNullTerminatedUTF16Representation(description)
+				WinStrings.getNullTerminatedUTF16Representation(target),
+				WinStrings.getNullTerminatedUTF16Representation(storagePath),
+				WinStrings.getNullTerminatedUTF16Representation(description)
 		);
 	}
 
@@ -36,13 +35,6 @@ public int createShortcut(String target, String storagePath, String description)
 	public String getPathToStartupFolder() {
 		return Native.INSTANCE.createAndGetStartupFolderPath();
 	}
-
-	// visible for testing
-	byte[] getNullTerminatedUTF16Representation(String source) {
-		byte[] bytes = source.getBytes(StandardCharsets.UTF_16LE);
-		return Arrays.copyOf(bytes, bytes.length + 2); // add double-width null terminator 0x00 0x00
-	}
-
 	private static class Native {
 		static final Native INSTANCE = new Native();
 
diff --git a/src/main/java/org/cryptomator/windows/common/WinStrings.java b/src/main/java/org/cryptomator/windows/common/WinStrings.java
new file mode 100644
index 0000000..5500de9
--- /dev/null
+++ b/src/main/java/org/cryptomator/windows/common/WinStrings.java
@@ -0,0 +1,14 @@
+package org.cryptomator.windows.common;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+
+public class WinStrings {
+
+	// visible for testing
+	public static byte[] getNullTerminatedUTF16Representation(String source) {
+		byte[] bytes = source.getBytes(StandardCharsets.UTF_16LE);
+		return Arrays.copyOf(bytes, bytes.length + 2); // add double-width null terminator 0x00 0x00
+	}
+
+}
diff --git a/src/main/java/org/cryptomator/windows/keychain/FileKeychain.java b/src/main/java/org/cryptomator/windows/keychain/FileKeychain.java
new file mode 100644
index 0000000..066d0ad
--- /dev/null
+++ b/src/main/java/org/cryptomator/windows/keychain/FileKeychain.java
@@ -0,0 +1,166 @@
+package org.cryptomator.windows.keychain;
+
+import com.fasterxml.jackson.core.JacksonException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.Reader;
+import java.io.Writer;
+import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Predicate;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+/**
+ * A file-based keychain. It's content is a utf-8 encoded JSON object.
+ */
+class FileKeychain implements WindowsKeychainAccessBase.Keychain {
+
+	private final static Logger LOG = LoggerFactory.getLogger(FileKeychain.class);
+	private static final ObjectMapper JSON_MAPPER = new ObjectMapper();
+
+	private final List<Path> keychainPaths;
+
+	private Map<String, KeychainEntry> cache;
+	private volatile boolean loaded;
+
+	FileKeychain(String keychainPathsProperty) {
+		keychainPaths = parsePaths(System.getProperty(keychainPathsProperty, ""), System.getProperty("path.separator"));
+		cache = new ConcurrentHashMap<>();
+	}
+
+	//testing
+	FileKeychain(List<Path> paths) {
+		keychainPaths = paths;
+		cache = new ConcurrentHashMap<>();
+	}
+
+	synchronized void load() throws KeychainAccessException {
+		if (!loaded) {
+			loadInternal();
+			loaded = true;
+		}
+	}
+
+	//for testing
+	void loadInternal() throws KeychainAccessException {
+		if (keychainPaths.isEmpty()) {
+			throw new KeychainAccessException("No path specified to store keychain");
+		}
+		//Note: We are trying out all keychainPaths to see, if we have to migrate an old keychain file to a new location
+		boolean useExisting = false;
+		for (Path keychainPath : keychainPaths) {
+			Optional<Map<String, KeychainEntry>> maybeKeychain = parse(keychainPath);
+			if (maybeKeychain.isPresent()) {
+				cache = maybeKeychain.get();
+				useExisting = true;
+				break;
+			}
+		}
+		if (!useExisting) {
+			LOG.debug("Keychain file not found or not parsable. Using new keychain.");
+		}
+
+	}
+
+	//visible for testing
+	Optional<Map<String, KeychainEntry>> parse(Path keychainPath) throws KeychainAccessException {
+		LOG.debug("Loading keychain from {}", keychainPath);
+		TypeReference<Map<String, KeychainEntry>> type = new TypeReference<>() {
+		};
+		try (InputStream in = Files.newInputStream(keychainPath, StandardOpenOption.READ); //
+			 Reader reader = new InputStreamReader(in, UTF_8)) {
+			return Optional.ofNullable(JSON_MAPPER.readValue(reader, type));
+		} catch (NoSuchFileException e) {
+			return Optional.empty();
+		} catch (JacksonException je) {
+			LOG.warn("Ignoring existing keychain file {}: Parsing failed.", keychainPath);
+			return Optional.empty();
+		} catch (IOException e) {
+			//TODO: we could ignore this
+			throw new KeychainAccessException("Failed to read keychain from path " + keychainPath, e);
+		}
+	}
+
+	//visible for testing
+	synchronized void save() throws KeychainAccessException {
+		var keychainFile = keychainPaths.getFirst(); //Note: we are always storing the keychain to the first entry to use the 'newest' keychain path and thus migrate old data
+		LOG.debug("Writing keychain to {}", keychainFile);
+		try (OutputStream out = Files.newOutputStream(keychainFile, StandardOpenOption.WRITE, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING); //
+			 Writer writer = new OutputStreamWriter(out, UTF_8)) {
+			JSON_MAPPER.writeValue(writer, cache);
+		} catch (IOException e) {
+			throw new KeychainAccessException("Could not write keychain to path " + keychainFile, e);
+		}
+	}
+
+	static List<Path> parsePaths(String listOfPaths, String pathSeparator) {
+		return Arrays.stream(listOfPaths.split(pathSeparator))
+				.filter(Predicate.not(String::isEmpty))
+				.map(s -> {
+					try {
+						return Path.of(s);
+					} catch (InvalidPathException e) {
+						LOG.info("Ignoring string {} for keychain file path: Cannot be converted to a path.", s);
+						return null;
+					}
+				})
+				.filter(Objects::nonNull)
+				.map(Util::resolveHomeDir)
+				.toList();
+	}
+
+	@Override
+	public KeychainEntry put(String id, KeychainEntry value) throws KeychainAccessException {
+		load();
+		var result = cache.put(id, value);
+		save();
+		return result;
+	}
+
+	@Override
+	public KeychainEntry get(String id) throws KeychainAccessException {
+		load();
+		return cache.get(id);
+	}
+
+	@Override
+	public KeychainEntry remove(String id) throws KeychainAccessException {
+		load();
+		var result = cache.remove(id);
+		save();
+		return result;
+	}
+
+	@Override
+	public KeychainEntry change(String id, KeychainEntry newEntry) throws KeychainAccessException {
+		load();
+		var result = cache.computeIfPresent(id, (_, _) -> newEntry);
+		save();
+		return result;
+	}
+
+	@Override
+	public boolean isSupported() {
+		//TODO: actually, we would like the location to be writable as well
+		return !keychainPaths.isEmpty();
+	}
+}
diff --git a/src/main/java/org/cryptomator/windows/keychain/Util.java b/src/main/java/org/cryptomator/windows/keychain/Util.java
new file mode 100644
index 0000000..ea7093a
--- /dev/null
+++ b/src/main/java/org/cryptomator/windows/keychain/Util.java
@@ -0,0 +1,51 @@
+package org.cryptomator.windows.keychain;
+
+import com.fasterxml.jackson.core.JacksonException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.Reader;
+import java.io.Writer;
+import java.nio.ByteBuffer;
+import java.nio.file.Files;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+public class Util {
+	private static final Path USER_HOME_REL = Path.of("~");
+	private static final Path USER_HOME = Path.of(System.getProperty("user.home"));
+
+	static Path resolveHomeDir(Path path) {
+		if (path.startsWith(USER_HOME_REL)) {
+			return USER_HOME.resolve(USER_HOME_REL.relativize(path));
+		} else {
+			return path;
+		}
+	}
+
+	static byte[] generateSalt() {
+		byte[] result = new byte[2 * Long.BYTES];
+		UUID uuid = UUID.randomUUID();
+		ByteBuffer buf = ByteBuffer.wrap(result);
+		buf.putLong(uuid.getMostSignificantBits());
+		buf.putLong(uuid.getLeastSignificantBits());
+		return result;
+	}
+
+}
diff --git a/src/main/java/org/cryptomator/windows/keychain/WinDataProtection.java b/src/main/java/org/cryptomator/windows/keychain/WinDataProtection.java
index abfa89f..4058ee4 100644
--- a/src/main/java/org/cryptomator/windows/keychain/WinDataProtection.java
+++ b/src/main/java/org/cryptomator/windows/keychain/WinDataProtection.java
@@ -2,30 +2,23 @@
 
 import org.cryptomator.windows.common.NativeLibLoader;
 
-class WinDataProtection {
-
-	/**
-	 * Encrypts the given cleartext using a key provided by Windows for the currently logged-in user.
-	 *
-	 * @param cleartext The cleartext to encrypt.
-	 * @param salt A salt, that needs to be provided during {@link #unprotect(byte[], byte[]) decryption}
-	 * @return The ciphertext or <code>null</code> if encryption failed.
-	 */
-	public byte[] protect(byte[] cleartext, byte[] salt) {
+class WinDataProtection implements WindowsKeychainAccessBase.PassphraseCryptor {
+
+	@Override
+	public byte[] encrypt(byte[] cleartext, byte[] salt) {
 		return Native.INSTANCE.protect(cleartext, salt);
 	}
 
-	/**
-	 * Decrypts the given ciphertext using a key provided by Windows for the currently logged-in user.
-	 *
-	 * @param ciphertext Ciphertext as previously encrypted using {@link #protect(byte[], byte[])}
-	 * @param salt Same salt as used in {@link #protect(byte[], byte[])}
-	 * @return The cleartext or <code>null</code> if decryption failed (wrong salt?).
-	 */
-	public byte[] unprotect(byte[] ciphertext, byte[] salt) {
+	@Override
+	public byte[] decrypt(byte[] ciphertext, byte[] salt) {
 		return Native.INSTANCE.unprotect(ciphertext, salt);
 	}
 
+	@Override
+	public boolean isSupported() {
+		return true;
+	}
+
 	// initialization-on-demand pattern, as loading the .dll is an expensive operation
 	private static class Native {
 		static final Native INSTANCE = new Native();
diff --git a/src/main/java/org/cryptomator/windows/keychain/WindowsHello.java b/src/main/java/org/cryptomator/windows/keychain/WindowsHello.java
new file mode 100644
index 0000000..7ccb200
--- /dev/null
+++ b/src/main/java/org/cryptomator/windows/keychain/WindowsHello.java
@@ -0,0 +1,43 @@
+package org.cryptomator.windows.keychain;
+
+import org.cryptomator.windows.common.NativeLibLoader;
+import org.cryptomator.windows.common.WinStrings;
+
+class WindowsHello implements WindowsKeychainAccessBase.PassphraseCryptor {
+
+	private final byte[] keyId;
+
+	public WindowsHello(String keyId) {
+		this.keyId = WinStrings.getNullTerminatedUTF16Representation(keyId);
+	}
+
+	@Override
+	public byte[] encrypt(byte[] cleartext, byte[] challenge) {
+		return Native.INSTANCE.setEncryptionKey(keyId, cleartext, challenge);
+	}
+
+	@Override
+	public byte[] decrypt(byte[] ciphertext, byte[] challenge) {
+		return Native.INSTANCE.getEncryptionKey(keyId, ciphertext, challenge);
+	}
+
+	public boolean isSupported() {
+		return Native.INSTANCE.isSupported();
+	}
+
+	// initialization-on-demand pattern, as loading the .dll is an expensive operation
+	private static class Native {
+		static final Native INSTANCE = new Native();
+
+		private Native() {
+			NativeLibLoader.loadLib();
+		}
+
+		public native boolean isSupported();
+
+		public native byte[] setEncryptionKey(byte[] keyId, byte[] cleartext, byte[] challenge);
+
+		public native byte[] getEncryptionKey(byte[] keyId, byte[] ciphertext, byte[] challenge);
+	}
+
+}
diff --git a/src/main/java/org/cryptomator/windows/keychain/WindowsHelloKeychainAccess.java b/src/main/java/org/cryptomator/windows/keychain/WindowsHelloKeychainAccess.java
new file mode 100644
index 0000000..30af383
--- /dev/null
+++ b/src/main/java/org/cryptomator/windows/keychain/WindowsHelloKeychainAccess.java
@@ -0,0 +1,29 @@
+package org.cryptomator.windows.keychain;
+
+import org.cryptomator.integrations.common.OperatingSystem;
+import org.cryptomator.integrations.common.Priority;
+import org.cryptomator.integrations.keychain.KeychainAccessProvider;
+import org.cryptomator.windows.common.Localization;
+
+/**
+ * Windows implementation for the {@link KeychainAccessProvider} based on the <a href="https://en.wikipedia.org/wiki/Data_Protection_API">data protection API</a>.
+ * The storage locations to check for encrypted data can be set with the JVM property {@value WINDOWS_HELLO_KEYCHAIN_PATHS_PROPERTY} with the paths seperated with the character defined in the JVM property path.separator.
+ */
+@Priority(1001)
+@OperatingSystem(OperatingSystem.Value.WINDOWS)
+public final class WindowsHelloKeychainAccess extends WindowsKeychainAccessBase {
+
+	private static final String WINDOWS_HELLO_KEYCHAIN_PATHS_PROPERTY = "cryptomator.integrationsWin.windowsHelloKeychainPaths";
+	private static final String WINDOWS_HELLO_KEY_ID_PROPERTY = "cryptomator.integrationsWin.windowsHelloKeyId";
+
+	@SuppressWarnings("unused") // default constructor required by ServiceLoader
+	public WindowsHelloKeychainAccess() {
+		super(new FileKeychain(WINDOWS_HELLO_KEYCHAIN_PATHS_PROPERTY),
+				new WindowsHello(System.getProperty(WINDOWS_HELLO_KEY_ID_PROPERTY, "org.cryptomator.integrations-win")));
+	}
+
+	@Override
+	public String displayName() {
+		return Localization.get().getString("org.cryptomator.windows.keychain.displayWindowsHelloName");
+	}
+}
diff --git a/src/main/java/org/cryptomator/windows/keychain/WindowsKeychainAccessBase.java b/src/main/java/org/cryptomator/windows/keychain/WindowsKeychainAccessBase.java
new file mode 100644
index 0000000..093af38
--- /dev/null
+++ b/src/main/java/org/cryptomator/windows/keychain/WindowsKeychainAccessBase.java
@@ -0,0 +1,158 @@
+package org.cryptomator.windows.keychain;
+
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.cryptomator.integrations.keychain.KeychainAccessProvider;
+
+import java.nio.ByteBuffer;
+import java.nio.CharBuffer;
+import java.util.Arrays;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+abstract class WindowsKeychainAccessBase implements KeychainAccessProvider {
+
+	private final Keychain keychain;
+	private final PassphraseCryptor passphraseCryptor;
+
+	protected WindowsKeychainAccessBase(Keychain keychain, PassphraseCryptor passphraseCryptor) {
+		this.keychain = keychain;
+		this.passphraseCryptor = passphraseCryptor;
+	}
+
+	@Override
+	public void storePassphrase(String id, String displayName, CharSequence passphrase, boolean ignored) throws KeychainAccessException {
+		var keychainEntry = encryptPassphrase(passphrase);
+		keychain.put(id, keychainEntry);
+	}
+
+	private KeychainEntry encryptPassphrase(CharSequence passphrase) throws KeychainAccessException {
+		ByteBuffer buf = UTF_8.encode(CharBuffer.wrap(passphrase));
+		byte[] cleartext = new byte[buf.remaining()];
+		try {
+			buf.get(cleartext);
+			var salt = Util.generateSalt();
+			var ciphertext = passphraseCryptor.encrypt(cleartext, salt);
+			if (ciphertext == null) {
+				throw new KeychainAccessException("Encrypting the passphrase failed.");
+			}
+			return new KeychainEntry(ciphertext, salt);
+		} finally {
+			Arrays.fill(buf.array(), (byte) 0x00);
+			Arrays.fill(cleartext, (byte) 0x00);
+		}
+	}
+
+	@Override
+	public char[] loadPassphrase(String id) throws KeychainAccessException {
+		KeychainEntry entry = keychain.get(id);
+		if (entry == null) {
+			return null;
+		}
+		byte[] cleartext = null;
+		CharBuffer intermediate = null;
+		try {
+			cleartext = passphraseCryptor.decrypt(entry.ciphertext(), entry.salt());
+			if (cleartext == null) {
+				return null;
+			}
+			intermediate = UTF_8.decode(ByteBuffer.wrap(cleartext));
+			char[] passphrase = new char[intermediate.remaining()];
+			intermediate.get(passphrase);
+			return passphrase;
+		} finally {
+			if (cleartext != null) {
+				Arrays.fill(cleartext, (byte) 0x00);
+			}
+			if (intermediate != null) {
+				Arrays.fill(intermediate.array(), (char) 0x00);
+			}
+		}
+	}
+
+	@Override
+	public void deletePassphrase(String id) throws KeychainAccessException {
+		keychain.remove(id);
+	}
+
+	@Override
+	public void changePassphrase(String id, String displayName, CharSequence passphrase) throws KeychainAccessException {
+		keychain.change(id, encryptPassphrase(passphrase));
+	}
+
+	@Override
+	public boolean isSupported() {
+		return keychain.isSupported() && passphraseCryptor.isSupported();
+	}
+
+	@Override
+	public boolean isLocked() {
+		return false;
+	}
+
+	interface Keychain {
+
+		/**
+		 * Puts a new entry in the keychain
+		 *
+		 * @param id    Identifier of the keychain entry
+		 * @param value {@link KeychainEntry} to be stored in the keychain
+		 * @return the former entry or null, if none was present
+		 * @throws KeychainAccessException if the keychain cannot be accessed or persisted
+		 */
+		KeychainEntry put(String id, KeychainEntry value) throws KeychainAccessException;
+
+		/**
+		 * Looks up and retrieves a keychain entry.
+		 *
+		 * @param id Identifier of the keychain entry
+		 * @return the {@link KeychainEntry} associated with the given id or null, if no entry is associated for the id
+		 * @throws KeychainAccessException if the keychain cannot be accessed
+		 */
+		KeychainEntry get(String id) throws KeychainAccessException;
+
+		/**
+		 * Removes a keychain entry.
+		 *
+		 * @param id Identifier of the keychain entry
+		 * @return the {@link KeychainEntry} formerly associated with the given id or null, if no entry was associated for the id
+		 * @throws KeychainAccessException if the keychain cannot be accessed or persisted
+		 */
+		KeychainEntry remove(String id) throws KeychainAccessException;
+
+		/**
+		 * Replaces an existing keychain entry. Returns null, if the id is not mapped.
+		 *
+		 * @param id       Identifier of the keychain entry
+		 * @param newValue the new {@link KeychainEntry} to be associated for {@code id}
+		 * @return the former keychain entry or null, if there was no mapping for the given id
+		 * @throws KeychainAccessException if the keychain cannot be accessed or persisted
+		 */
+		KeychainEntry change(String id, KeychainEntry newValue) throws KeychainAccessException;
+
+		boolean isSupported();
+	}
+
+	interface PassphraseCryptor {
+
+		/**
+		 * Encrypts the given cleartext using a key provided by Windows.
+		 * The caller is responsible for zeroing the cleartext array after use.
+		 *
+		 * @param cleartext      The cleartext to encrypt.
+		 * @param additionalData Additional data fed into the encryption. Needs to be provided during {@link #decrypt(byte[], byte[])} decryption}
+		 * @return The ciphertext or {@code null} if encryption failed.
+		 */
+		byte[] encrypt(byte[] cleartext, byte[] additionalData);
+
+		/**
+		 * Decrypts the given ciphertext using a key provided by Windows.
+		 *
+		 * @param ciphertext     The cleartext to encrypt.
+		 * @param additionalData Additional data fed into decryption. Must be the same as used in {@link #encrypt(byte[], byte[])} encryption}
+		 * @return The cleartext or {@code null} if decryption failed.
+		 */
+		byte[] decrypt(byte[] ciphertext, byte[] additionalData);
+
+		boolean isSupported();
+	}
+}
diff --git a/src/main/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccess.java b/src/main/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccess.java
index 883b81c..56079f7 100644
--- a/src/main/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccess.java
+++ b/src/main/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccess.java
@@ -1,39 +1,9 @@
 package org.cryptomator.windows.keychain;
 
-import com.fasterxml.jackson.core.JacksonException;
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import org.cryptomator.integrations.common.OperatingSystem;
 import org.cryptomator.integrations.common.Priority;
-import org.cryptomator.integrations.keychain.KeychainAccessException;
 import org.cryptomator.integrations.keychain.KeychainAccessProvider;
 import org.cryptomator.windows.common.Localization;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
-import java.io.OutputStreamWriter;
-import java.io.Reader;
-import java.io.Writer;
-import java.nio.ByteBuffer;
-import java.nio.CharBuffer;
-import java.nio.file.Files;
-import java.nio.file.NoSuchFileException;
-import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.UUID;
-import java.util.function.Predicate;
-import java.util.stream.Collectors;
-
-import static java.nio.charset.StandardCharsets.UTF_8;
 
 /**
  * Windows implementation for the {@link KeychainAccessProvider} based on the <a href="https://en.wikipedia.org/wiki/Data_Protection_API">data protection API</a>.
@@ -41,49 +11,13 @@
  */
 @Priority(1000)
 @OperatingSystem(OperatingSystem.Value.WINDOWS)
-public class WindowsProtectedKeychainAccess implements KeychainAccessProvider {
+public final class WindowsProtectedKeychainAccess extends WindowsKeychainAccessBase {
 
 	private static final String KEYCHAIN_PATHS_PROPERTY = "cryptomator.integrationsWin.keychainPaths";
-	private static final Logger LOG = LoggerFactory.getLogger(WindowsProtectedKeychainAccess.class);
-	private static final Path USER_HOME_REL = Path.of("~");
-	private static final Path USER_HOME = Path.of(System.getProperty("user.home"));
-	private static final ObjectMapper JSON_MAPPER = new ObjectMapper();
-
-	private final List<Path> keychainPaths;
-	private final WinDataProtection dataProtection;
-	private Map<String, KeychainEntry> keychainEntries;
 
-	@SuppressWarnings("unused") // default constructor required by ServiceLoader
+	//no-arg constructuor required for ServiceLoader
 	public WindowsProtectedKeychainAccess() {
-		this(readKeychainPathsFromEnv(), new WinDataProtection());
-	}
-
-	// visible for testing
-	WindowsProtectedKeychainAccess(List<Path> keychainPaths, WinDataProtection dataProtection) {
-		this.keychainPaths = keychainPaths;
-		this.dataProtection = dataProtection;
-	}
-
-	private static List<Path> readKeychainPathsFromEnv() {
-		var keychainPaths = System.getProperty(KEYCHAIN_PATHS_PROPERTY, "");
-		return parsePaths(keychainPaths, System.getProperty("path.separator"));
-	}
-
-	// visible for testing
-	static List<Path> parsePaths(String listOfPaths, String pathSeparator) {
-		return Arrays.stream(listOfPaths.split(pathSeparator))
-				.filter(Predicate.not(String::isEmpty))
-				.map(Path::of)
-				.map(WindowsProtectedKeychainAccess::resolveHomeDir)
-				.collect(Collectors.toList());
-	}
-
-	private static Path resolveHomeDir(Path path) {
-		if (path.startsWith(USER_HOME_REL)) {
-			return USER_HOME.resolve(USER_HOME_REL.relativize(path));
-		} else {
-			return path;
-		}
+		super(new FileKeychain(KEYCHAIN_PATHS_PROPERTY),new WinDataProtection());
 	}
 
 	@Override
@@ -91,121 +25,4 @@ public String displayName() {
 		return Localization.get().getString("org.cryptomator.windows.keychain.displayName");
 	}
 
-	@Override
-	public void storePassphrase(String key, String displayName, CharSequence passphrase, boolean ignored) throws KeychainAccessException {
-		loadKeychainEntriesIfNeeded();
-		ByteBuffer buf = UTF_8.encode(CharBuffer.wrap(passphrase));
-		byte[] cleartext = new byte[buf.remaining()];
-		buf.get(cleartext);
-		var salt = generateSalt();
-		var ciphertext = dataProtection.protect(cleartext, salt);
-		Arrays.fill(buf.array(), (byte) 0x00);
-		Arrays.fill(cleartext, (byte) 0x00);
-		keychainEntries.put(key, new KeychainEntry(ciphertext, salt));
-		saveKeychainEntries();
-	}
-
-	@Override
-	public char[] loadPassphrase(String key) throws KeychainAccessException {
-		loadKeychainEntriesIfNeeded();
-		KeychainEntry entry = keychainEntries.get(key);
-		if (entry == null) {
-			return null;
-		}
-		byte[] cleartext = dataProtection.unprotect(entry.ciphertext(), entry.salt());
-		if (cleartext == null) {
-			return null;
-		}
-		CharBuffer buf = UTF_8.decode(ByteBuffer.wrap(cleartext));
-		char[] passphrase = new char[buf.remaining()];
-		buf.get(passphrase);
-		Arrays.fill(cleartext, (byte) 0x00);
-		Arrays.fill(buf.array(), (char) 0x00);
-		return passphrase;
-	}
-
-	@Override
-	public void deletePassphrase(String key) throws KeychainAccessException {
-		loadKeychainEntriesIfNeeded();
-		keychainEntries.remove(key);
-		saveKeychainEntries();
-	}
-
-	@Override
-	public void changePassphrase(String key, String displayName, CharSequence passphrase) throws KeychainAccessException {
-		loadKeychainEntriesIfNeeded();
-		if (keychainEntries.remove(key) != null) {
-			storePassphrase(key, passphrase);
-		}
-	}
-
-	@Override
-	public boolean isSupported() {
-		return !keychainPaths.isEmpty();
-	}
-
-	@Override
-	public boolean isLocked() {
-		return false;
-	}
-
-	private byte[] generateSalt() {
-		byte[] result = new byte[2 * Long.BYTES];
-		UUID uuid = UUID.randomUUID();
-		ByteBuffer buf = ByteBuffer.wrap(result);
-		buf.putLong(uuid.getMostSignificantBits());
-		buf.putLong(uuid.getLeastSignificantBits());
-		return result;
-	}
-
-	private void loadKeychainEntriesIfNeeded() throws KeychainAccessException {
-		if (keychainEntries == null) {
-			for (Path keychainPath : keychainPaths) {
-				Optional<Map<String, KeychainEntry>> keychain = loadKeychainEntries(keychainPath);
-				if (keychain.isPresent()) {
-					keychainEntries = keychain.get();
-					break;
-				}
-			}
-		}
-		if (keychainEntries == null) {
-			LOG.info("Unable to load existing keychain file, creating new keychain.");
-			keychainEntries = new HashMap<>();
-		}
-	}
-
-	//visible for testing
-	Optional<Map<String, KeychainEntry>> loadKeychainEntries(Path keychainPath) throws KeychainAccessException {
-		LOG.debug("Attempting to load keychain from {}", keychainPath);
-		TypeReference<Map<String, KeychainEntry>> type = new TypeReference<>() {
-		};
-		try (InputStream in = Files.newInputStream(keychainPath, StandardOpenOption.READ); //
-			 Reader reader = new InputStreamReader(in, UTF_8)) {
-			return Optional.ofNullable(JSON_MAPPER.readValue(reader, type));
-		} catch (NoSuchFileException e) {
-			return Optional.empty();
-		} catch (JacksonException je) {
-			LOG.warn("Unable to parse keychain file, overwriting existing one.");
-			return Optional.empty();
-		} catch (IOException e) {
-			throw new KeychainAccessException("Could not read keychain from path " + keychainPath, e);
-		}
-	}
-
-	private void saveKeychainEntries() throws KeychainAccessException {
-		if (keychainPaths.isEmpty()) {
-			throw new IllegalStateException("Can't save keychain if no keychain path is specified.");
-		}
-		saveKeychainEntries(keychainPaths.get(0));
-	}
-
-	private void saveKeychainEntries(Path keychainPath) throws KeychainAccessException {
-		try (OutputStream out = Files.newOutputStream(keychainPath, StandardOpenOption.WRITE, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING); //
-			 Writer writer = new OutputStreamWriter(out, UTF_8)) {
-			JSON_MAPPER.writeValue(writer, keychainEntries);
-		} catch (IOException e) {
-			throw new KeychainAccessException("Could not read keychain from path " + keychainPath, e);
-		}
-	}
-
 }
diff --git a/src/main/native/org_cryptomator_windows_keychain_WindowsHello_Native.cpp b/src/main/native/org_cryptomator_windows_keychain_WindowsHello_Native.cpp
new file mode 100644
index 0000000..6f15a64
--- /dev/null
+++ b/src/main/native/org_cryptomator_windows_keychain_WindowsHello_Native.cpp
@@ -0,0 +1,356 @@
+#include <jni.h>
+#include "org_cryptomator_windows_keychain_WindowsHello_Native.h"
+#include <winrt/Windows.Foundation.h>
+#include <winrt/Windows.Security.Credentials.h>
+#include <winrt/Windows.Security.Cryptography.h>
+#include <winrt/Windows.Security.Cryptography.Core.h>
+#include <winrt/Windows.Storage.Streams.h>
+#include <windows.h>
+#include <thread>
+#include <chrono>
+#include <string>
+#include <vector>
+#include <stdexcept>
+#include <iostream>
+#include <atomic>
+
+using namespace winrt;
+using namespace Windows::Security::Credentials;
+using namespace Windows::Security::Cryptography;
+using namespace Windows::Security::Cryptography::Core;
+using namespace Windows::Storage::Streams;
+
+static std::atomic<int> g_promptFocusCount{ 0 };
+static IBuffer info = CryptographicBuffer::ConvertStringToBinary(L"EncryptionKey", BinaryStringEncoding::Utf8);
+
+// Helper methods for conversion
+std::vector<uint8_t> jbyteArrayToVector(JNIEnv* env, jbyteArray array) {
+    if (array == nullptr) {
+        return std::vector<uint8_t>();
+    }
+    jsize length = env->GetArrayLength(array);
+    std::vector<uint8_t> result(length);
+    env->GetByteArrayRegion(array, 0, length, reinterpret_cast<jbyte*>(result.data()));
+    return result;
+}
+
+
+jbyteArray vectorToJbyteArray(JNIEnv* env, const std::vector<uint8_t>& vec) {
+    jbyteArray array = env->NewByteArray(vec.size());
+    if (array == nullptr) {
+        return nullptr;
+    }
+    env->SetByteArrayRegion(array, 0, vec.size(), reinterpret_cast<const jbyte*>(vec.data()));
+    return array;
+}
+
+
+IBuffer vectorToIBuffer(const std::vector<uint8_t>& vec) {
+    DataWriter writer;
+    writer.WriteBytes(array_view<const uint8_t>(vec));
+    return writer.DetachBuffer();
+}
+
+
+std::vector<uint8_t> iBufferToVector(const IBuffer& buffer) {
+    auto reader = DataReader::FromBuffer(buffer);
+    if (!buffer || reader.UnconsumedBufferLength() == 0) {
+        return {};
+    }
+    std::vector<uint8_t> result(reader.UnconsumedBufferLength());
+    reader.ReadBytes(array_view<uint8_t>(result));
+    return result;
+}
+
+// Bring Windows Hello pop-up to the front
+void queueSecurityPromptFocus(int delay = 500) {
+    std::thread([delay]() {
+        while (g_promptFocusCount.load() <= 3) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(delay));
+
+            auto hWnd = ::FindWindowA("Credential Dialog Xaml Host", nullptr);
+
+            if (hWnd) {
+                ::SetForegroundWindow(hWnd);
+                g_promptFocusCount.store(0); // Reset the counter
+                break;
+            }
+            else if (g_promptFocusCount.fetch_add(1) + 1 > 3) {
+                g_promptFocusCount.store(0);
+                break;
+            }
+        }
+        }).detach();
+}
+
+
+IBuffer DeriveKeyUsingHKDF(const IBuffer& inputData, const IBuffer& salt, uint32_t keySizeInBytes, const IBuffer& info) {
+    auto macProvider = MacAlgorithmProvider::OpenAlgorithm(L"HMAC_SHA256"); //MacLength is 32 bytes for SHA256
+
+    // HKDF-extract
+    auto extractKey = macProvider.CreateKey(salt);
+    auto pseudorandomKey = CryptographicEngine::Sign(extractKey, inputData);
+
+    // HKDF-expand
+    auto expandKey = macProvider.CreateKey(pseudorandomKey);
+    if (expandKey.KeySize() < macProvider.MacLength()) {
+        throw std::runtime_error("Key provided by HMAC_SHA256 implementation is shorter than the HMAC length.");
+    }
+    int maxKeySize = 255 * macProvider.MacLength();
+    if (keySizeInBytes > maxKeySize) {
+        throw std::runtime_error("HKDF requires keySizeInBytes to be at most " + std::to_string(maxKeySize) + " bytes.");
+    }
+
+    int N = std::ceil(keySizeInBytes / macProvider.MacLength());
+    std::vector<uint8_t> result;
+    std::vector<uint8_t> previousBlock = std::vector<uint8_t>(0);
+
+    for (uint8_t i = 0; i < N; i++) {
+        std::vector<uint8_t> input(previousBlock);
+        if (info.Length() > 0) {
+            input.insert(input.end(), info.data(), info.data() + info.Length());
+        }
+        input.push_back(i + 1);
+
+        auto inputBuffer = CryptographicBuffer::CreateFromByteArray(input);
+        auto blockBuffer = CryptographicEngine::Sign(expandKey, inputBuffer);
+
+        std::vector<uint8_t> block;
+        block.insert(block.end(), blockBuffer.data(), blockBuffer.data() + blockBuffer.Length());
+        previousBlock = block;
+        result.insert(result.end(), block.begin(), block.end());
+    }
+
+    result.resize(keySizeInBytes);
+    return CryptographicBuffer::CreateFromByteArray(result);
+}
+
+
+bool deriveEncryptionKey(const std::wstring keyId, const std::vector<uint8_t>& challenge, IBuffer& key) {
+    auto challengeBuffer = CryptographicBuffer::CreateFromByteArray(
+        array_view<const uint8_t>(challenge.data(), challenge.size()));
+
+    try {
+        // The first time this is used a key-pair will be generated using the common name
+        auto result = KeyCredentialManager::RequestCreateAsync(keyId,
+            KeyCredentialCreationOption::FailIfExists).get();
+
+        if (result.Status() == KeyCredentialStatus::CredentialAlreadyExists) {
+            result = KeyCredentialManager::OpenAsync(keyId).get();
+        }
+        else if (result.Status() != KeyCredentialStatus::Success) {
+            std::cerr << "Failed to retrieve Windows Hello credential." << std::endl;
+            return false;
+        }
+
+        const auto signature = result.Credential().RequestSignAsync(challengeBuffer).get();
+        if (signature.Status() != KeyCredentialStatus::Success) {
+            if (signature.Status() != KeyCredentialStatus::UserCanceled) {
+                std::cerr << "Failed to sign challenge using Windows Hello." << std::endl;
+            }
+            return false;
+        }
+
+        // Derive the encryption/decryption key using HKDF
+        const auto response = signature.Result();
+        key = DeriveKeyUsingHKDF(response, challengeBuffer, 32, info); // needs to be 32 bytes for SHA256
+        return true;
+
+    }
+    catch (winrt::hresult_error const& ex) {
+        std::cerr << winrt::to_string(ex.message()) << std::endl;
+        return false;
+    }
+}
+
+
+jboolean JNICALL Java_org_cryptomator_windows_keychain_WindowsHello_00024Native_isSupported
+(JNIEnv* env, jobject obj) {
+    try {
+        winrt::init_apartment(winrt::apartment_type::single_threaded);
+
+        auto keyCredentialAvailable = KeyCredentialManager::IsSupportedAsync().get();
+        return keyCredentialAvailable ? JNI_TRUE : JNI_FALSE;
+
+    }
+    catch (winrt::hresult_error const& hre) {
+        HRESULT hr = hre.code();
+        winrt::hstring message = hre.message();
+        std::cerr << "Error: " << winrt::to_string(message) << " (HRESULT: 0x" << std::hex << hr << ")" << std::endl;
+        return JNI_FALSE;
+    }
+    catch (const std::exception& e) {
+        std::cerr << "Warning: " << e.what() << std::endl;
+        return JNI_FALSE;
+    }
+    catch (...) {
+        std::cerr << "Caught an unknown exception" << std::endl;
+        return JNI_FALSE;
+    }
+}
+
+
+// Encrypts data using Windows Hello KeyCredentialManager API
+jbyteArray JNICALL Java_org_cryptomator_windows_keychain_WindowsHello_00024Native_setEncryptionKey
+(JNIEnv* env, jobject obj, jbyteArray keyId, jbyteArray cleartext, jbyteArray challenge) {
+    queueSecurityPromptFocus();
+    try {
+        // Convert Java byte arrays to C++ vectors
+        std::vector<uint8_t> cleartextVec = jbyteArrayToVector(env, cleartext);
+        std::vector<uint8_t> challengeVec = jbyteArrayToVector(env, challenge);
+
+        winrt::init_apartment(winrt::apartment_type::single_threaded);
+
+        auto toReleaseKeyId = (LPCWSTR)env->GetByteArrayElements(keyId, NULL);
+        const std::wstring keyIdentifier(toReleaseKeyId);
+
+        // Take the random challenge and sign it by Windows Hello
+        // to create the key.
+        IBuffer key;
+        if (!deriveEncryptionKey(keyIdentifier, challengeVec, key)) {
+            throw std::runtime_error("Failed to generate the encryption key with the Windows Hello credential.");
+        }
+
+        auto iv = CryptographicBuffer::GenerateRandom(16); // 128-bit IV for AES-CBC
+        auto algorithmName = SymmetricAlgorithmNames::AesCbcPkcs7();
+        auto aesProvider = SymmetricKeyAlgorithmProvider::OpenAlgorithm(algorithmName);
+        auto aesKey = aesProvider.CreateSymmetricKey(key);
+        auto dataBuffer = CryptographicBuffer::CreateFromByteArray(array_view<const uint8_t>(cleartextVec.data(), cleartextVec.size()));
+        auto encryptedBuffer = CryptographicEngine::Encrypt(aesKey, dataBuffer, iv);
+
+        // Compute HMAC over (IV || ciphertext)
+        auto macProvider = MacAlgorithmProvider::OpenAlgorithm(MacAlgorithmNames::HmacSha256());
+        auto hmacKey = macProvider.CreateKey(key);
+
+        // Concatenate IV and ciphertext into a single buffer
+        std::vector<uint8_t> ivVec = iBufferToVector(iv);
+        std::vector<uint8_t> encryptedVec = iBufferToVector(encryptedBuffer);
+        std::vector<uint8_t> dataToAuthenticate(ivVec.size() + encryptedVec.size());
+        std::copy(ivVec.begin(), ivVec.end(), dataToAuthenticate.begin());
+        std::copy(encryptedVec.begin(), encryptedVec.end(), dataToAuthenticate.begin() + ivVec.size());
+
+        // Create a buffer from the concatenated vector
+        auto dataToAuthenticateBuffer = CryptographicBuffer::CreateFromByteArray(array_view<const uint8_t>(dataToAuthenticate.data(), dataToAuthenticate.size()));
+        auto hmac = CryptographicEngine::Sign(hmacKey, dataToAuthenticateBuffer);
+
+        // Combine IV, ciphertext, and HMAC into the final buffer
+        std::vector<uint8_t> hmacVec = iBufferToVector(hmac);
+        std::vector<uint8_t> output(dataToAuthenticate.size() + hmacVec.size());
+        std::copy(dataToAuthenticate.begin(), dataToAuthenticate.end(), output.begin());
+        std::copy(hmacVec.begin(), hmacVec.end(), output.begin() + dataToAuthenticate.size());
+
+        std::fill(cleartextVec.begin(), cleartextVec.end(), 0);
+        std::fill(challengeVec.begin(), challengeVec.end(), 0);
+        std::fill(ivVec.begin(), ivVec.end(), 0);
+        std::fill(encryptedVec.begin(), encryptedVec.end(), 0);
+        std::fill(dataToAuthenticate.begin(), dataToAuthenticate.end(), 0);
+        std::fill(hmacVec.begin(), hmacVec.end(), 0);
+        env->ReleaseByteArrayElements(keyId, (jbyte*) toReleaseKeyId, JNI_ABORT);
+
+        return vectorToJbyteArray(env, output);
+
+    }
+    catch (winrt::hresult_error const& hre) {
+        HRESULT hr = hre.code();
+        winrt::hstring message = hre.message();
+        std::cerr << "Error: " << winrt::to_string(message) << " (HRESULT: 0x" << std::hex << hr << ")" << std::endl;
+        return NULL;
+    }
+    catch (const std::exception& e) {
+        std::cerr << "Warning: " << e.what() << std::endl;
+        return NULL;
+    }
+    catch (...) {
+        std::cerr << "Caught an unknown exception" << std::endl;
+        return NULL;
+    }
+}
+
+// Decrypts data using Windows Hello KeyCredentialManager API
+jbyteArray JNICALL Java_org_cryptomator_windows_keychain_WindowsHello_00024Native_getEncryptionKey
+(JNIEnv* env, jobject obj, jbyteArray keyId, jbyteArray ciphertext, jbyteArray challenge) {
+    queueSecurityPromptFocus();
+    try {
+        // Convert Java byte arrays to C++ vectors
+        std::vector<uint8_t> ciphertextVec = jbyteArrayToVector(env, ciphertext);
+        std::vector<uint8_t> challengeVec = jbyteArrayToVector(env, challenge);
+
+        winrt::init_apartment(winrt::apartment_type::single_threaded);
+
+        size_t ivSize = 16; // IV size (128-bit)
+        size_t hmacSize = 32; // HMAC size (256-bit)
+
+        // Ensure the input is long enough to contain IV (16 bytes), ciphertext, and HMAC (32 bytes)
+        if (ciphertextVec.size() < ivSize + hmacSize) {
+            throw std::runtime_error("Invalid ciphertext");
+        }
+
+        // Take the random challenge and sign it by Windows Hello
+        // to create the key.
+        auto toReleaseKeyId = (LPCWSTR)env->GetByteArrayElements(keyId, NULL);
+        const std::wstring keyIdentifier(toReleaseKeyId);
+        IBuffer key;
+        if (!deriveEncryptionKey(keyIdentifier, challengeVec, key)) {
+            throw std::runtime_error("Failed to generate the encryption key with the Windows Hello credential.");
+        }
+
+        auto algorithmName = SymmetricAlgorithmNames::AesCbcPkcs7();
+        auto aesProvider = SymmetricKeyAlgorithmProvider::OpenAlgorithm(algorithmName);
+        auto aesKey = aesProvider.CreateSymmetricKey(key);
+
+        // Split the input data
+        std::vector<uint8_t> ivVec(ciphertextVec.begin(), ciphertextVec.begin() + ivSize);
+        std::vector<uint8_t> encryptedVec(ciphertextVec.begin() + ivSize, ciphertextVec.end() - hmacSize);
+        std::vector<uint8_t> hmacVec(ciphertextVec.end() - hmacSize, ciphertextVec.end());
+
+        // Recreate the data to authenticate (IV || ciphertext)
+        std::vector<uint8_t> dataToAuthenticate(ciphertextVec.begin(), ciphertextVec.end() - hmacSize);
+
+        // Compute HMAC to verify integrity
+        auto macProvider = MacAlgorithmProvider::OpenAlgorithm(MacAlgorithmNames::HmacSha256());
+        auto hmacKey = macProvider.CreateKey(key);
+        auto dataToAuthenticateBuffer = CryptographicBuffer::CreateFromByteArray(
+            array_view<const uint8_t>(dataToAuthenticate.data(), dataToAuthenticate.size())
+        );
+        auto computedHmac = CryptographicEngine::Sign(hmacKey, dataToAuthenticateBuffer);
+        std::vector<uint8_t> computedHmacVec = iBufferToVector(computedHmac);
+
+        // Compare HMACs
+        if (computedHmacVec != hmacVec) {
+            throw std::runtime_error("HMAC verification failed.");
+        }
+
+        // Decrypt ciphertext
+        auto ivBuffer = CryptographicBuffer::CreateFromByteArray(array_view<const uint8_t>(ivVec.data(), ivVec.size()));
+        auto encryptedBuffer = CryptographicBuffer::CreateFromByteArray(
+            array_view<const uint8_t>(encryptedVec.data(), encryptedVec.size())
+        );
+        auto decryptedBuffer = CryptographicEngine::Decrypt(aesKey, encryptedBuffer, ivBuffer);
+
+        std::fill(ciphertextVec.begin(), ciphertextVec.end(), 0);
+        std::fill(challengeVec.begin(), challengeVec.end(), 0);
+        std::fill(ivVec.begin(), ivVec.end(), 0);
+        std::fill(encryptedVec.begin(), encryptedVec.end(), 0);
+        std::fill(hmacVec.begin(), hmacVec.end(), 0);
+        std::fill(dataToAuthenticate.begin(), dataToAuthenticate.end(), 0);
+        std::fill(computedHmacVec.begin(), computedHmacVec.end(), 0);
+        env->ReleaseByteArrayElements(keyId, (jbyte*)toReleaseKeyId, JNI_ABORT);
+
+        return vectorToJbyteArray(env, iBufferToVector(decryptedBuffer));
+
+    }
+    catch (winrt::hresult_error const& hre) {
+        HRESULT hr = hre.code();
+        winrt::hstring message = hre.message();
+        std::cerr << "Error: " << winrt::to_string(message) << " (HRESULT: 0x" << std::hex << hr << ")" << std::endl;
+        return NULL;
+    }
+    catch (const std::exception& e) {
+        std::cerr << "Warning: " << e.what() << std::endl;
+        return NULL;
+    }
+    catch (...) {
+        std::cerr << "Caught an unknown exception" << std::endl;
+        return NULL;
+    }
+}
diff --git a/src/main/native/org_cryptomator_windows_uiappearnce_WinAppearance_Native.cpp b/src/main/native/org_cryptomator_windows_uiappearnce_WinAppearance_Native.cpp
index 9ae99ba..ffaf353 100644
--- a/src/main/native/org_cryptomator_windows_uiappearnce_WinAppearance_Native.cpp
+++ b/src/main/native/org_cryptomator_windows_uiappearnce_WinAppearance_Native.cpp
@@ -17,10 +17,10 @@ void throwIllegalStateException(JNIEnv *env, const char* message) {
 JNIEXPORT jint JNICALL Java_org_cryptomator_windows_uiappearance_WinAppearance_00024Native_getCurrentTheme (JNIEnv *env, jobject thisObject){
     DWORD data{};
     DWORD dataSize = sizeof(data);
-    LSTATUS status = RegGetValue(HKEY_CURRENT_USER, R"(Software\Microsoft\Windows\CurrentVersion\Themes\Personalize)", "AppsUseLightTheme", RRF_RT_DWORD, NULL, &data, &dataSize);
+    LSTATUS status = RegGetValueW(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", L"AppsUseLightTheme", RRF_RT_DWORD, NULL, &data, &dataSize);
     if(status != ERROR_SUCCESS){
         char msg[50];
-        sprintf(msg, "Failed to read registry value (status %d)", (int) status);
+        sprintf_s(msg, 50, "Failed to read registry value (status %d)", (int) status);
         throwIllegalStateException(env, msg);
     }
     return data ? 1 : 0;
@@ -28,16 +28,16 @@ JNIEXPORT jint JNICALL Java_org_cryptomator_windows_uiappearance_WinAppearance_0
 
 JNIEXPORT void JNICALL Java_org_cryptomator_windows_uiappearance_WinAppearance_00024Native_waitForNextThemeChange(JNIEnv *env, jobject thisObj){
     HKEY key;
-    LSTATUS status = RegOpenKeyEx(HKEY_CURRENT_USER, R"(Software\Microsoft\Windows\CurrentVersion\Themes\Personalize)", 0, KEY_READ, &key);
+    LSTATUS status = RegOpenKeyExW(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", 0, KEY_READ, &key);
     if (status != ERROR_SUCCESS) {
         char msg[50];
-        sprintf(msg, "Failed to open registry key (status %d)", (int) status);
+        sprintf_s(msg, 50,"Failed to open registry key (status %d)", (int) status);
         throwIllegalStateException(env, msg);
     }
     status = RegNotifyChangeKeyValue(key, TRUE, REG_NOTIFY_CHANGE_LAST_SET, NULL, FALSE);
     if (status != ERROR_SUCCESS) {
         char msg[50];
-        sprintf(msg, "Failed to observe registry key (status %d)", (int) status);
+        sprintf_s(msg, 50, "Failed to observe registry key (status %d)", (int) status);
         throwIllegalStateException(env, msg);
     }
     RegCloseKey(key);
diff --git a/src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.KeychainAccessProvider b/src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.ProtectedKeychainAccessProvider
similarity index 100%
rename from src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.KeychainAccessProvider
rename to src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.ProtectedKeychainAccessProvider
diff --git a/src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.WindowsHelloKeychainAccessProvider b/src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.WindowsHelloKeychainAccessProvider
new file mode 100644
index 0000000..e6c4bf3
--- /dev/null
+++ b/src/main/resources/META-INF/services/org.cryptomator.integrations.keychain.WindowsHelloKeychainAccessProvider
@@ -0,0 +1 @@
+org.cryptomator.windows.keychain.WindowsHelloKeychainAccess
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle.properties b/src/main/resources/WinIntegrationsBundle.properties
index 85f4a7a..47f8ba5 100644
--- a/src/main/resources/WinIntegrationsBundle.properties
+++ b/src/main/resources/WinIntegrationsBundle.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows Data Protection
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows Data Protection
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_af.properties b/src/main/resources/WinIntegrationsBundle_af.properties
new file mode 100644
index 0000000..e69de29
diff --git a/src/main/resources/WinIntegrationsBundle_ar.properties b/src/main/resources/WinIntegrationsBundle_ar.properties
index 7494b2b..b2aa432 100644
--- a/src/main/resources/WinIntegrationsBundle_ar.properties
+++ b/src/main/resources/WinIntegrationsBundle_ar.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=حماية بيانات ويندوز
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=حماية بيانات ويندوز
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_ca.properties b/src/main/resources/WinIntegrationsBundle_ca.properties
index 85f4a7a..47f8ba5 100644
--- a/src/main/resources/WinIntegrationsBundle_ca.properties
+++ b/src/main/resources/WinIntegrationsBundle_ca.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows Data Protection
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows Data Protection
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_el.properties b/src/main/resources/WinIntegrationsBundle_el.properties
index 98c4378..ecbd4ff 100644
--- a/src/main/resources/WinIntegrationsBundle_el.properties
+++ b/src/main/resources/WinIntegrationsBundle_el.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Προστασία δεδομένων Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Προστασία δεδομένων Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_en.properties b/src/main/resources/WinIntegrationsBundle_en.properties
new file mode 100644
index 0000000..e69de29
diff --git a/src/main/resources/WinIntegrationsBundle_es.properties b/src/main/resources/WinIntegrationsBundle_es.properties
index de3b706..06a7112 100644
--- a/src/main/resources/WinIntegrationsBundle_es.properties
+++ b/src/main/resources/WinIntegrationsBundle_es.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Protección de Datos de Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Protección de Datos de Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_fi.properties b/src/main/resources/WinIntegrationsBundle_fi.properties
index e69de29..47f8ba5 100644
--- a/src/main/resources/WinIntegrationsBundle_fi.properties
+++ b/src/main/resources/WinIntegrationsBundle_fi.properties
@@ -0,0 +1,2 @@
+org.cryptomator.windows.keychain.displayName=Windows Data Protection
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_fr.properties b/src/main/resources/WinIntegrationsBundle_fr.properties
index bc2b508..ae44dd9 100644
--- a/src/main/resources/WinIntegrationsBundle_fr.properties
+++ b/src/main/resources/WinIntegrationsBundle_fr.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Protection des données Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Protection des données Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_id.properties b/src/main/resources/WinIntegrationsBundle_id.properties
index eb326f6..293ac32 100644
--- a/src/main/resources/WinIntegrationsBundle_id.properties
+++ b/src/main/resources/WinIntegrationsBundle_id.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Perlindungan Data Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Perlindungan Data Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Hai Windows
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_it.properties b/src/main/resources/WinIntegrationsBundle_it.properties
index a0836f8..7204746 100644
--- a/src/main/resources/WinIntegrationsBundle_it.properties
+++ b/src/main/resources/WinIntegrationsBundle_it.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Protezione Dati Di Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Protezione Dati Di Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_ja.properties b/src/main/resources/WinIntegrationsBundle_ja.properties
index 6206ec7..8cd87fd 100644
--- a/src/main/resources/WinIntegrationsBundle_ja.properties
+++ b/src/main/resources/WinIntegrationsBundle_ja.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows のデータ保護
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows のデータ保護
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_ko.properties b/src/main/resources/WinIntegrationsBundle_ko.properties
index ce45244..f36eee4 100644
--- a/src/main/resources/WinIntegrationsBundle_ko.properties
+++ b/src/main/resources/WinIntegrationsBundle_ko.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=윈도우 데이터 보호
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=윈도우 데이터 보호
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_nl.properties b/src/main/resources/WinIntegrationsBundle_nl.properties
index ac61bf7..342d491 100644
--- a/src/main/resources/WinIntegrationsBundle_nl.properties
+++ b/src/main/resources/WinIntegrationsBundle_nl.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows-gegevensbescherming
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows-gegevensbescherming
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_no.properties b/src/main/resources/WinIntegrationsBundle_no.properties
new file mode 100644
index 0000000..e69de29
diff --git a/src/main/resources/WinIntegrationsBundle_pl.properties b/src/main/resources/WinIntegrationsBundle_pl.properties
index 713b9c8..eb6e078 100644
--- a/src/main/resources/WinIntegrationsBundle_pl.properties
+++ b/src/main/resources/WinIntegrationsBundle_pl.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Ochrona danych w systemie Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Ochrona danych w systemie Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_pt.properties b/src/main/resources/WinIntegrationsBundle_pt.properties
index cad370f..13a4372 100644
--- a/src/main/resources/WinIntegrationsBundle_pt.properties
+++ b/src/main/resources/WinIntegrationsBundle_pt.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Proteção de dados do Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Proteção de dados do Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_pt_BR.properties b/src/main/resources/WinIntegrationsBundle_pt_BR.properties
index 80addbd..dc3a976 100644
--- a/src/main/resources/WinIntegrationsBundle_pt_BR.properties
+++ b/src/main/resources/WinIntegrationsBundle_pt_BR.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Proteção de Dados do Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Proteção de Dados do Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Janelas Olá
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_ro.properties b/src/main/resources/WinIntegrationsBundle_ro.properties
index b2cea99..5be1988 100644
--- a/src/main/resources/WinIntegrationsBundle_ro.properties
+++ b/src/main/resources/WinIntegrationsBundle_ro.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Protecție de date Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Protecție de date Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_ru.properties b/src/main/resources/WinIntegrationsBundle_ru.properties
index 7a3b6bd..a2af3f7 100644
--- a/src/main/resources/WinIntegrationsBundle_ru.properties
+++ b/src/main/resources/WinIntegrationsBundle_ru.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Защита данных Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Защита данных Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_sk.properties b/src/main/resources/WinIntegrationsBundle_sk.properties
index 28cf67b..883e1d6 100644
--- a/src/main/resources/WinIntegrationsBundle_sk.properties
+++ b/src/main/resources/WinIntegrationsBundle_sk.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows ochrana dát
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows ochrana dát
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Ahoj
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_sv.properties b/src/main/resources/WinIntegrationsBundle_sv.properties
index 85f4a7a..47f8ba5 100644
--- a/src/main/resources/WinIntegrationsBundle_sv.properties
+++ b/src/main/resources/WinIntegrationsBundle_sv.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows Data Protection
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows Data Protection
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_tr.properties b/src/main/resources/WinIntegrationsBundle_tr.properties
index deb530d..5df693f 100644
--- a/src/main/resources/WinIntegrationsBundle_tr.properties
+++ b/src/main/resources/WinIntegrationsBundle_tr.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows Veri Koruması
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows Veri Koruması
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_ug.properties b/src/main/resources/WinIntegrationsBundle_ug.properties
new file mode 100644
index 0000000..e69de29
diff --git a/src/main/resources/WinIntegrationsBundle_uk.properties b/src/main/resources/WinIntegrationsBundle_uk.properties
index bb88c3b..99ba22d 100644
--- a/src/main/resources/WinIntegrationsBundle_uk.properties
+++ b/src/main/resources/WinIntegrationsBundle_uk.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Захист даних Windows
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Захист даних Windows
+org.cryptomator.windows.keychain.displayWindowsHelloName=Пін-код Windows
\ No newline at end of file
diff --git a/src/main/resources/WinIntegrationsBundle_zh.properties b/src/main/resources/WinIntegrationsBundle_zh.properties
index 482a967..f6b8078 100644
--- a/src/main/resources/WinIntegrationsBundle_zh.properties
+++ b/src/main/resources/WinIntegrationsBundle_zh.properties
@@ -1 +1,2 @@
-org.cryptomator.windows.keychain.displayName=Windows 数据保护
\ No newline at end of file
+org.cryptomator.windows.keychain.displayName=Windows 数据保护
+org.cryptomator.windows.keychain.displayWindowsHelloName=Windows Hello
\ No newline at end of file
diff --git a/src/test/java/org/cryptomator/windows/autostart/WinShellLinksTest.java b/src/test/java/org/cryptomator/windows/autostart/WinShellLinksTest.java
index f0a4b1d..c9cfcbc 100644
--- a/src/test/java/org/cryptomator/windows/autostart/WinShellLinksTest.java
+++ b/src/test/java/org/cryptomator/windows/autostart/WinShellLinksTest.java
@@ -46,17 +46,6 @@ public void testShellLinkCreation() {
 		Assertions.assertTrue(Files.exists(shortcut));
 	}
 
-	@ParameterizedTest
-	@CsvSource(value = { // convert utf16-le string to hex with https://dencode.com/en/string/hex, append null terminator
-			"foo, '66 00 6f 00 6f 00 00 00'",
-			"bar, '62 00 61 00 72 00 00 00'"
-	})
-	public void testGetNullTerminatedUTF16Representation(String input, @ConvertWith(ByteArrayConverter.class) byte[] expected) {
-		var result = inTest.getNullTerminatedUTF16Representation(input);
-
-		Assertions.assertArrayEquals(expected, result);
-	}
-
 	@ParameterizedTest
 	@CsvSource(value = {
 			"'00', 0",
diff --git a/src/test/java/org/cryptomator/windows/common/WinStringsTest.java b/src/test/java/org/cryptomator/windows/common/WinStringsTest.java
new file mode 100644
index 0000000..3de0263
--- /dev/null
+++ b/src/test/java/org/cryptomator/windows/common/WinStringsTest.java
@@ -0,0 +1,22 @@
+package org.cryptomator.windows.common;
+
+import org.cryptomator.windows.autostart.WinShellLinksTest;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.converter.ConvertWith;
+import org.junit.jupiter.params.provider.CsvSource;
+
+public class WinStringsTest {
+
+
+	@ParameterizedTest
+	@CsvSource(value = { // convert utf16-le string to hex with https://dencode.com/en/string/hex, append null terminator
+			"foo, '66 00 6f 00 6f 00 00 00'",
+			"bar, '62 00 61 00 72 00 00 00'"
+	})
+	public void testGetNullTerminatedUTF16Representation(String input, @ConvertWith(WinShellLinksTest.ByteArrayConverter.class) byte[] expected) {
+		var result = WinStrings.getNullTerminatedUTF16Representation(input);
+
+		Assertions.assertArrayEquals(expected, result);
+	}
+}
diff --git a/src/test/java/org/cryptomator/windows/keychain/FileKeychainTest.java b/src/test/java/org/cryptomator/windows/keychain/FileKeychainTest.java
new file mode 100644
index 0000000..4b7b449
--- /dev/null
+++ b/src/test/java/org/cryptomator/windows/keychain/FileKeychainTest.java
@@ -0,0 +1,220 @@
+package org.cryptomator.windows.keychain;
+
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mockito;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class FileKeychainTest {
+
+	private static final String CONTENT = """
+			{
+			  "cryptomator-device-p12": {
+			    "ciphertext": "Zm9vYmFy",
+			    "salt": "c2FsdHlTYWx0"
+			  },
+			  "äd3": {
+			    "ciphertext": "aUFtQVdhbHJ1cw==",
+			    "salt": "c3VybGF3"
+			  }
+			}
+			""";
+
+	@TempDir
+	Path keychainFileDir;
+	List<Path> keychainPaths;
+	FileKeychain fileKeychain;
+
+	@BeforeEach
+	public void beforeEach() {
+		keychainPaths = List.of(keychainFileDir.resolve("keychain.json"), //
+				keychainFileDir.resolve("keychain_2.json"), //
+				keychainFileDir.resolve("keychain_3.json"));
+		fileKeychain = new FileKeychain(List.of());
+	}
+
+	@Test
+	public void puttin() throws KeychainAccessException {
+		var fileKeychainSpy = spy(fileKeychain);
+		Mockito.doNothing().when(fileKeychainSpy).load();
+		Mockito.doNothing().when(fileKeychainSpy).save();
+
+		var result = fileKeychainSpy.put("test3000", new KeychainEntry(new byte[] {}, new byte[] {}));
+
+		var ordering = Mockito.inOrder(fileKeychainSpy);
+		ordering.verify(fileKeychainSpy).load();
+		ordering.verify(fileKeychainSpy).save();
+		Assertions.assertNull(result);
+	}
+
+	@Test
+	public void gettin() throws KeychainAccessException {
+		var fileKeychainSpy = spy(fileKeychain);
+		Mockito.doNothing().when(fileKeychainSpy).load();
+
+		var result = fileKeychainSpy.get("test3000");
+
+		verify(fileKeychainSpy).load();
+		verify(fileKeychainSpy, never()).save();
+		Assertions.assertNull(result);
+	}
+
+	@Test
+	public void removin() throws KeychainAccessException {
+		var fileKeychainSpy = spy(fileKeychain);
+		Mockito.doNothing().when(fileKeychainSpy).load();
+		Mockito.doNothing().when(fileKeychainSpy).save();
+
+		var result = fileKeychainSpy.remove("test3000");
+
+		var ordering = Mockito.inOrder(fileKeychainSpy);
+		ordering.verify(fileKeychainSpy).load();
+		ordering.verify(fileKeychainSpy).save();
+		Assertions.assertNull(result);
+	}
+
+	@Test
+	public void changin() throws KeychainAccessException {
+		var fileKeychainSpy = spy(fileKeychain);
+		Mockito.doNothing().when(fileKeychainSpy).load();
+		Mockito.doNothing().when(fileKeychainSpy).save();
+
+		var result = fileKeychainSpy.change("test3000", new KeychainEntry(new byte[] {}, new byte[] {}));
+
+		var ordering = Mockito.inOrder(fileKeychainSpy);
+		ordering.verify(fileKeychainSpy).load();
+		ordering.verify(fileKeychainSpy).save();
+		Assertions.assertNull(result);
+	}
+
+	@Test
+	public void youOnlyLoadOnce() throws KeychainAccessException {
+		var fileKeychainSpy = spy(fileKeychain);
+		Mockito.doNothing().when(fileKeychainSpy).loadInternal();
+		fileKeychainSpy.load();
+		fileKeychainSpy.load();
+		verify(fileKeychainSpy).loadInternal();
+	}
+
+	@Test
+	public void loadThrowsOnEmptyPaths() {
+		var fileKeychain = new FileKeychain(List.of());
+		Assertions.assertThrows(KeychainAccessException.class, fileKeychain::load);
+		Assertions.assertThrows(KeychainAccessException.class, fileKeychain::loadInternal);
+	}
+
+	@Test
+	public void loadInternalUsesFirstFittingPath() throws KeychainAccessException {
+		var fileKeychain = spy(new FileKeychain(keychainPaths));
+
+		when(fileKeychain.parse(keychainPaths.get(0))).thenReturn(Optional.empty());
+		when(fileKeychain.parse(keychainPaths.get(1))).thenReturn(Optional.of(Map.of()));
+
+		fileKeychain.loadInternal();
+		verify(fileKeychain).parse(keychainPaths.get(0));
+		verify(fileKeychain).parse(keychainPaths.get(1));
+		verify(fileKeychain, never()).parse(keychainPaths.get(2));
+	}
+
+	@Test
+	public void saveUsesFirstPath() throws KeychainAccessException {
+		var fileKeychain = new FileKeychain(keychainPaths);
+		fileKeychain.save();
+		Assertions.assertTrue(Files.exists(keychainPaths.get(0)));
+		Assertions.assertTrue(Files.notExists(keychainPaths.get(1)));
+		Assertions.assertTrue(Files.notExists(keychainPaths.get(2)));
+	}
+
+	@Test
+	public void saveThrowsKeychainExceptionOnIOExcpetion() {
+		var fileKeychain = new FileKeychain(List.of(keychainFileDir.resolve("foo/bar")));
+		var exception = Assertions.assertThrows(KeychainAccessException.class, fileKeychain::save);
+		Assertions.assertInstanceOf(IOException.class, exception.getCause());
+	}
+
+	@Test
+	public void parseSuccess() throws KeychainAccessException, IOException {
+		var keychainFile = keychainFileDir.resolve("realJson.json");
+		Files.writeString(keychainFile, CONTENT, StandardCharsets.UTF_8, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE);
+
+		var result = fileKeychain.parse(keychainFile);
+
+		Assertions.assertTrue(result.isPresent());
+		Assertions.assertEquals(2, result.get().size());
+	}
+
+	@Test
+	public void parseWrongJson() throws KeychainAccessException, IOException {
+		var keychainFile = keychainFileDir.resolve("realJson.json");
+		Files.writeString(keychainFile, CONTENT.substring(0, 20), StandardCharsets.UTF_8, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE);
+
+		var result = fileKeychain.parse(keychainFile);
+
+		Assertions.assertTrue(result.isEmpty());
+	}
+
+	@Test
+	public void parseNotExisting() throws KeychainAccessException, IOException {
+		var keychainFile = keychainFileDir.resolve("realJson.json");
+		var result = fileKeychain.parse(keychainFile);
+		Assertions.assertTrue(result.isEmpty());
+	}
+
+	@Nested
+	public class ParsePaths {
+		@Test
+		@DisplayName("String is split with path separator")
+		public void testParsePaths() {
+			String paths = "C:\\foo\\bar;bar\\kuz";
+			var result = FileKeychain.parsePaths(paths, ";");
+			Assertions.assertEquals(2, result.size());
+			Assertions.assertTrue(result.contains(Path.of("C:\\foo\\bar")));
+			Assertions.assertTrue(result.contains(Path.of("bar\\kuz")));
+		}
+
+		@Test
+		@DisplayName("Empty string returns empty list")
+		public void testParsePathsEmpty() {
+			var result = FileKeychain.parsePaths("", ";");
+			Assertions.assertEquals(0, result.size());
+		}
+
+		@Test
+		@DisplayName("Strings starting with ~ are resolved to user home")
+		public void testParsePathsUserHome() {
+			var userHome = Path.of(System.getProperty("user.home"));
+			var result = FileKeychain.parsePaths("this\\~\\not;~\\foo\\bar", ";");
+			Assertions.assertEquals(2, result.size());
+			Assertions.assertTrue(result.contains(Path.of("this\\~\\not")));
+			Assertions.assertTrue(result.contains(userHome.resolve("foo\\bar")));
+		}
+
+		@Test
+		@DisplayName("Invalid paths are ignored")
+		public void testParseInvalidPaths() {
+			var result = FileKeychain.parsePaths("ax?|*;C:\\foo", ";");
+			Assertions.assertEquals(1, result.size());
+			Assertions.assertTrue(result.contains(Path.of("C:\\foo")));
+		}
+
+	}
+
+}
diff --git a/src/test/java/org/cryptomator/windows/keychain/WinDataProtectionTest.java b/src/test/java/org/cryptomator/windows/keychain/WinDataProtectionTest.java
index fef1a00..9dc601d 100644
--- a/src/test/java/org/cryptomator/windows/keychain/WinDataProtectionTest.java
+++ b/src/test/java/org/cryptomator/windows/keychain/WinDataProtectionTest.java
@@ -10,13 +10,13 @@ public void testProtectAndUnprotect() {
 		WinDataProtection dataProtection = new WinDataProtection();
 
 		String storedPw = "h€llo wørld123";
-		byte[] ciphertext = dataProtection.protect(storedPw.getBytes(), "salt".getBytes());
+		byte[] ciphertext = dataProtection.encrypt(storedPw.getBytes(), "salt".getBytes());
 		Assertions.assertNotNull(ciphertext);
 
-		byte[] shouldBeNull = dataProtection.unprotect(ciphertext, "pepper".getBytes());
+		byte[] shouldBeNull = dataProtection.decrypt(ciphertext, "pepper".getBytes());
 		Assertions.assertNull(shouldBeNull);
 
-		byte[] cleartext = dataProtection.unprotect(ciphertext, "salt".getBytes());
+		byte[] cleartext = dataProtection.decrypt(ciphertext, "salt".getBytes());
 		Assertions.assertArrayEquals(storedPw.getBytes(), cleartext);
 	}
 
diff --git a/src/test/java/org/cryptomator/windows/keychain/WindowsHelloTest.java b/src/test/java/org/cryptomator/windows/keychain/WindowsHelloTest.java
new file mode 100644
index 0000000..222f76a
--- /dev/null
+++ b/src/test/java/org/cryptomator/windows/keychain/WindowsHelloTest.java
@@ -0,0 +1,32 @@
+package org.cryptomator.windows.keychain;
+
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.DisabledIfEnvironmentVariable;
+import org.junit.jupiter.api.condition.EnabledOnOs;
+import org.junit.jupiter.api.condition.OS;
+
+@EnabledOnOs(OS.WINDOWS)
+@DisabledIfEnvironmentVariable(named = "CI", matches = ".*")
+class WindowsHelloTest {
+
+	@Test
+	@DisplayName("Test Windows Hello Authentication")
+	@Disabled
+	public void testStoreAndLoadWithAuth() throws KeychainAccessException {
+		var winhello = new WindowsHello("integrations-win-test");
+		String storedPw = "h€llo wørld123";
+		byte[] ciphertext = winhello.encrypt(storedPw.getBytes(), "salt".getBytes());
+		Assertions.assertNotNull(ciphertext);
+
+		byte[] shouldBeNull = winhello.decrypt(ciphertext, "pepper".getBytes());
+		Assertions.assertNull(shouldBeNull);
+
+		byte[] cleartext = winhello.decrypt(ciphertext, "salt".getBytes());
+		Assertions.assertArrayEquals(storedPw.getBytes(), cleartext);
+	}
+
+}
\ No newline at end of file
diff --git a/src/test/java/org/cryptomator/windows/keychain/WindowsKeychainAccessBaseTest.java b/src/test/java/org/cryptomator/windows/keychain/WindowsKeychainAccessBaseTest.java
new file mode 100644
index 0000000..09eb223
--- /dev/null
+++ b/src/test/java/org/cryptomator/windows/keychain/WindowsKeychainAccessBaseTest.java
@@ -0,0 +1,90 @@
+package org.cryptomator.windows.keychain;
+
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+
+import static org.cryptomator.windows.keychain.WindowsKeychainAccessBase.Keychain;
+import static org.cryptomator.windows.keychain.WindowsKeychainAccessBase.PassphraseCryptor;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.*;
+
+public class WindowsKeychainAccessBaseTest {
+
+	PassphraseCryptor passphraseCryptor = mock(PassphraseCryptor.class);
+	Keychain keychain = mock(Keychain.class);
+	WindowsKeychainAccessBase winKeychainBase = new TestProvider(keychain, passphraseCryptor);
+
+
+	@Test
+	public void storePassphraseFailsIfEncryptionisNull() {
+		when(passphraseCryptor.encrypt(any(), any())).thenReturn(null);
+		Assertions.assertThrows(KeychainAccessException.class, //
+				() -> winKeychainBase.storePassphrase("test3000", "display3000", "abc") //
+		);
+	}
+
+	@Test
+	public void storePassphrasePutsIntoKeychain() throws KeychainAccessException {
+		var encrypted = new byte[] {'a','b','x'};
+		when(passphraseCryptor.encrypt(any(), any())).thenReturn(encrypted);
+		winKeychainBase.storePassphrase("test3000", "display3000", "abc"); //
+		verify(keychain).put(eq("test3000"), argThat(entry -> Arrays.equals(entry.ciphertext(),encrypted)));
+		verify(passphraseCryptor).encrypt(any(), any());
+	}
+
+	@Test
+	public void loadPassphraseReturnsNullOnKeychainNull() throws KeychainAccessException {
+		when(keychain.get("test3000")).thenReturn(null);
+
+		var result = winKeychainBase.loadPassphrase("test3000");
+
+		verify(keychain).get("test3000");
+		verify(passphraseCryptor, never()).decrypt(any(), any());
+		Assertions.assertNull(result);
+	}
+
+	@Test
+	public void loadPassphraseReturnsNullOnDecryptNull() throws KeychainAccessException {
+		byte [] ciphertext = {'x','y','z'};
+		byte [] salt = {'s'};
+		when(keychain.get("test3000")).thenReturn(new KeychainEntry(ciphertext, salt));
+		when(passphraseCryptor.decrypt(ciphertext, salt)).thenReturn(null);
+
+		var result = winKeychainBase.loadPassphrase("test3000");
+
+		verify(keychain).get("test3000");
+		verify(passphraseCryptor).decrypt(ciphertext, salt);
+		Assertions.assertNull(result);
+	}
+
+	@Test
+	public void loadPassphraseReturnsPassphrase() throws KeychainAccessException {
+		byte [] cleartext = {'a','b','c'};
+		byte [] ciphertext = {'x','y','z'};
+		byte [] salt = {'s'};
+		when(keychain.get("test3000")).thenReturn(new KeychainEntry(ciphertext, salt));
+		when(passphraseCryptor.decrypt(ciphertext, salt)).thenReturn(cleartext);
+
+		var result = winKeychainBase.loadPassphrase("test3000");
+
+		verify(keychain).get("test3000");
+		verify(passphraseCryptor).decrypt(ciphertext, salt);
+		Assertions.assertArrayEquals(new char[] {'a', 'b', 'c'}, result);
+	}
+
+	static class TestProvider extends WindowsKeychainAccessBase {
+
+		public TestProvider(Keychain keychain, PassphraseCryptor passphraseCryptor) {
+			super(keychain, passphraseCryptor);
+		}
+
+		@Override
+		public String displayName() {
+			return "TestProvider";
+		}
+	}
+}
diff --git a/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessIntegrationTest.java b/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessIntegrationTest.java
index c948440..d21f202 100644
--- a/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessIntegrationTest.java
+++ b/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessIntegrationTest.java
@@ -6,67 +6,101 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.MethodOrderer;
 import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Order;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
 import org.junit.jupiter.api.io.TempDir;
 
 import java.io.IOException;
-import java.net.URISyntaxException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
 public class WindowsProtectedKeychainAccessIntegrationTest {
+	static Path keychainFile;
 
 	@BeforeAll
 	public static void setup(@TempDir Path tmpDir) {
-		Path keychainPath = tmpDir.resolve("keychain.tmp");
-		System.setProperty("cryptomator.integrationsWin.keychainPaths", keychainPath.toString());
+		keychainFile = tmpDir.resolve("keychain.tmp");
+		System.setProperty("cryptomator.integrationsWin.keychainPaths", keychainFile.toString());
 	}
 
 	@Test
 	@DisplayName("WindowsProtectedKeychainAccess can be loaded")
 	public void testLoadWindowsProtectedKeychainAccess() {
-		var windowsKeychainAccessProvider = KeychainAccessProvider.get().findAny();
-
-		Assertions.assertTrue(windowsKeychainAccessProvider.isPresent());
-		Assertions.assertInstanceOf(WindowsProtectedKeychainAccess.class, windowsKeychainAccessProvider.get());
+		var found = KeychainAccessProvider.get().anyMatch(s -> s instanceof WindowsProtectedKeychainAccess);
+		Assertions.assertTrue(found);
 	}
 
 	@Nested
-	public class LoadKeyChainEntries {
+	@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+	public class FunctionalTests {
 
-		Path keychainPath;
 		WindowsProtectedKeychainAccess keychainAccess;
 
 		@BeforeEach
-		public void init(@TempDir Path tmpDir) {
-			keychainPath = tmpDir.resolve("keychain.tmp");
-			keychainAccess = (WindowsProtectedKeychainAccess) KeychainAccessProvider.get().findAny().get();
+		public void beforeEach(@TempDir Path tmpDir) {
+			keychainAccess = (WindowsProtectedKeychainAccess) KeychainAccessProvider.get().filter(s -> s instanceof WindowsProtectedKeychainAccess).findFirst().get();
 		}
 
 		@Test
-		public void testNonExistingFileReturnsEmpty() throws KeychainAccessException, IOException {
-			var result = keychainAccess.loadKeychainEntries(keychainPath);
+		@DisplayName("The DataProtection Keychain cannot be locked")
+		@Order(1)
+		public void cannotBeLocked() {
+			Assertions.assertFalse(keychainAccess.isLocked());
+		}
 
-			Assertions.assertTrue(result.isEmpty());
+		@Test
+		@DisplayName("The DataProtection API works, although the file does not exists")
+		@Order(2)
+		public void notExistingFile() throws KeychainAccessException, IOException {
+			Assertions.assertNull(keychainAccess.loadPassphrase("ozelot"));
+			Assertions.assertTrue(Files.notExists(keychainFile));
 		}
 
 		@Test
-		public void testEmptyFileReturnsEmpty() throws KeychainAccessException, IOException {
-			Files.write(keychainPath, new byte[] {});
+		@DisplayName("A credential can be stored")
+		@Order(3)
+		public void testStoringCredential() throws KeychainAccessException, IOException {
+			keychainAccess.storePassphrase("ozelot", "oZeLoT", "abc", false);
+			var passphrase = keychainAccess.loadPassphrase("ozelot");
+			Assertions.assertEquals("abc", String.valueOf(passphrase));
+		}
 
-			var result = keychainAccess.loadKeychainEntries(keychainPath);
+		@Test
+		@DisplayName("A credential can be removed")
+		@Order(4)
+		public void testRemovingCredential() throws KeychainAccessException, IOException {
+			Assertions.assertNotNull(keychainAccess.loadPassphrase("ozelot"));
+			keychainAccess.deletePassphrase("ozelot");
+			Assertions.assertNull(keychainAccess.loadPassphrase("ozelot"));
+		}
 
-			Assertions.assertTrue(result.isEmpty());
+		@Test
+		@DisplayName("Not existing credential can be \"removed\"")
+		@Order(5)
+		public void testRemovingCredentialNotExisting() throws KeychainAccessException, IOException {
+			keychainAccess.deletePassphrase("ozelot");
+			Assertions.assertNull(keychainAccess.loadPassphrase("ozelot"));
 		}
 
 		@Test
-		public void testLegacyKeychainFiles() throws URISyntaxException, KeychainAccessException {
-			var keychainPath = Path.of(this.getClass().getResource("keychain.v1.2.2.json").toURI());
-			var result = keychainAccess.loadKeychainEntries(keychainPath);
+		@DisplayName("Not existing credential can be \"changed\"")
+		@Order(6)
+		public void testChangingCredentialNotExisting() throws KeychainAccessException, IOException {
+			keychainAccess.changePassphrase("ozelot", "oZeLoT", "qwe");
+			Assertions.assertNull(keychainAccess.loadPassphrase("ozelot"));
+		}
 
-			Assertions.assertTrue(result.isPresent());
-			Assertions.assertEquals(3, result.get().size());
+		@Test
+		@DisplayName("Existing credential can be changed")
+		@Order(7)
+		public void testChangingCredential() throws KeychainAccessException, IOException {
+			keychainAccess.storePassphrase("ozelot", "oZeLoT", "abc", false);
+			keychainAccess.changePassphrase("ozelot", "oZeLoT", "qwe");
+			var passphrase = keychainAccess.loadPassphrase("ozelot");
+			Assertions.assertEquals("qwe", String.valueOf(passphrase));
 		}
 	}
 
diff --git a/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessTest.java b/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessTest.java
deleted file mode 100644
index 60ce399..0000000
--- a/src/test/java/org/cryptomator/windows/keychain/WindowsProtectedKeychainAccessTest.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*******************************************************************************
- * Copyright (c) 2017 Skymatic UG (haftungsbeschränkt).
- * All rights reserved. This program and the accompanying materials
- * are made available under the terms of the accompanying LICENSE file.
- *******************************************************************************/
-package org.cryptomator.windows.keychain;
-
-import org.cryptomator.integrations.keychain.KeychainAccessException;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-import org.mockito.Mockito;
-import org.mockito.stubbing.Answer;
-
-import java.nio.file.Path;
-import java.util.List;
-
-public class WindowsProtectedKeychainAccessTest {
-
-	private WindowsProtectedKeychainAccess keychain;
-
-	@BeforeEach
-	public void setup(@TempDir Path tempDir) {
-		Path keychainPath = tempDir.resolve("keychainfile.tmp");
-		WinDataProtection winDataProtection = Mockito.mock(WinDataProtection.class);
-		Answer<byte[]> answerReturningFirstArg = invocation -> ((byte[]) invocation.getArgument(0)).clone();
-		Mockito.when(winDataProtection.protect(Mockito.any(), Mockito.any())).thenAnswer(answerReturningFirstArg);
-		Mockito.when(winDataProtection.unprotect(Mockito.any(), Mockito.any())).thenAnswer(answerReturningFirstArg);
-		keychain = new WindowsProtectedKeychainAccess(List.of(keychainPath), winDataProtection);
-	}
-
-	@Test
-	public void testStoreAndLoad() throws KeychainAccessException {
-		String storedPw1 = "topSecret";
-		String storedPw2 = "bottomSecret";
-		keychain.storePassphrase("myPassword", storedPw1);
-		keychain.storePassphrase("myOtherPassword", storedPw2);
-		String loadedPw1 = new String(keychain.loadPassphrase("myPassword"));
-		String loadedPw2 = new String(keychain.loadPassphrase("myOtherPassword"));
-		Assertions.assertEquals(storedPw1, loadedPw1);
-		Assertions.assertEquals(storedPw2, loadedPw2);
-		keychain.deletePassphrase("myPassword");
-		Assertions.assertNull(keychain.loadPassphrase("myPassword"));
-		Assertions.assertNotNull(keychain.loadPassphrase("myOtherPassword"));
-		Assertions.assertNull(keychain.loadPassphrase("nonExistingPassword"));
-	}
-
-	@Nested
-	public class ParsePaths {
-		@Test
-		@DisplayName("String is split with path separator")
-		public void testParsePaths() {
-			String paths = "C:\\foo\\bar;bar\\kuz";
-			var result = WindowsProtectedKeychainAccess.parsePaths(paths, ";");
-			Assertions.assertEquals(2, result.size());
-			Assertions.assertTrue(result.contains(Path.of("C:\\foo\\bar")));
-			Assertions.assertTrue(result.contains(Path.of("bar\\kuz")));
-		}
-
-		@Test
-		@DisplayName("Empty string returns empty list")
-		public void testParsePathsEmpty() {
-			var result = WindowsProtectedKeychainAccess.parsePaths("", ";");
-			Assertions.assertEquals(0, result.size());
-		}
-
-		@Test
-		@DisplayName("Strings starting with ~ are resolved to user home")
-		public void testParsePathsUserHome() {
-			var userHome = Path.of(System.getProperty("user.home"));
-			var result = WindowsProtectedKeychainAccess.parsePaths("this\\~\\not;~\\foo\\bar", ";");
-			Assertions.assertEquals(2, result.size());
-			Assertions.assertTrue(result.contains(Path.of("this\\~\\not")));
-			Assertions.assertTrue(result.contains(userHome.resolve("foo\\bar")));
-		}
-
-	}
-
-}
diff --git a/src/test/java/org/cryptomator/windows/uiappearance/WinUiAppearanceProviderTest.java b/src/test/java/org/cryptomator/windows/uiappearance/WinUiAppearanceProviderTest.java
index b497342..f97c5cc 100644
--- a/src/test/java/org/cryptomator/windows/uiappearance/WinUiAppearanceProviderTest.java
+++ b/src/test/java/org/cryptomator/windows/uiappearance/WinUiAppearanceProviderTest.java
@@ -23,9 +23,9 @@ public void setup() {
 	}
 
 	@Test
-	@DisplayName("get current system theme")
+	@DisplayName("get always returns a theme")
 	public void testGetSystemTheme() {
-		Theme myTheme = appearanceProvider.getSystemTheme();
+		Theme myTheme = Assertions.assertDoesNotThrow(appearanceProvider::getSystemTheme);
 
 		Assertions.assertNotNull(myTheme);
 		System.out.println("current theme: " + myTheme.name());
diff --git a/src/test/resources/org/cryptomator/windows/keychain/keychain.v1.2.2.json b/src/test/resources/org/cryptomator/windows/keychain/keychain.v1.2.2.json
deleted file mode 100644
index 4f12b0a..0000000
--- a/src/test/resources/org/cryptomator/windows/keychain/keychain.v1.2.2.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "cryptomator-device-p12": {
-    "ciphertext": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAMKzd7acJg0ScvBUOCjUb3wAAAAACAAAAAAAQZgAAAAEAACAAAABS6cSKuWqEOp+1HHcsSF0bSzQRRbotDIZPQIuMvbSdowAAAAAOgAAAAAIAACAAAABatZ2hp39vFTysmXRSO1rkk9vLx2S6rnRq6RIGkXlCnzAAAAAgTeOMtOKhnMzIjSwJEFE22UaB3sPGH6UxQ+EWMuZ9WPGHmOp8/WzTzFLCwbiIh9ZAAAAAf7DQSu40eCLUDKQzwFNJrBJsEWX2pK2GS2wOYFTlcMhSij7WkSHh9nAeZtRf14PyBpuLxCiBIayLJMpeK4HIXg==",
-    "salt": "Rwzfb0IHSqOXJw5MGRmCTw=="
-  },
-  "-JgknuFBfItX": {
-    "ciphertext": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAMKzd7acJg0ScvBUOCjUb3wAAAAACAAAAAAAQZgAAAAEAACAAAABnYHm42qCU6kq50NV16IqJbrwrRwagpiYgopjK8xpyVAAAAAAOgAAAAAIAACAAAAC6XB/vmPRR7tK5sTOyY6DFgTXv4/ptTzGsKwJEsn1I8xAAAADUlPA6Qet/WSCbdK4WShMsQAAAAOVsW/9E/YNwHLl/qyzffkp2YR7UKeTcM3EkLoyI9Q2RJjmdidJc4wAet9zlp4qUPST+ukTxXAvMW/+RNxEAeZM=",
-    "salt": "CqEUWMVSQtqsDNhKeNCZHg=="
-  },
-  "vkEAWUv_NmbN": {
-    "ciphertext": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcLFOdGbRSEiT1nQ2ILvP/gAAAAACAAAAAAAQZgAAAAEAACAAAABYjK3wVUE/is3SHpdzLRaijVbLw6UYMSBizyiDDWNrqAAAAAAOgAAAAAIAACAAAAALkAoBV3/RwpSXwkTyDgOKiR7+wMnXq099WW4tt873NRAAAACH2Ki+R4fSi+569Y0RpoS0QAAAAEXbbfM0mUuIgajCfO7yfH1ysWdRUWfZYnfqDjeR5Up/FKqLbPkgZr+0fgb/sZEw+HyQ781A7+fXHFqB3hQoDV0=",
-    "salt": "evllr3H5SHyJN/1SciqlVQ=="
-  }
-}
\ No newline at end of file