If the attacker has your computer, then they now have ' the thing you own'.

One-time-passwords work well for server authentication because both client and server end-points are considered secure and the attacker needs ' something you own' as well as ' something you know'. This master key can consist of multiple components: a master password, a key file and/or a key that. If the KeePass file is still interoperable with other KeePass programs, then you gain nothing from using a one-time-password in this fashion. To set up the custom entry you need to have the Windows security dialog open and waiting for input then go into the KeePass Auto-Type tab and press Add then fill in the box as shown: Works for me Share Improve this answer Follow answered at 13:49 shunty 680 6 8 I use KeePass to log into the hundreds of Windows servers that we maintain. Your KeePass database file is encrypted using a master key. When you get up from your desk, hit Windows+L to proactively. If the attacker has access the device storing the KeePass installation and files, the security re-collapses to the security of the normal password on its own. Protect your Windows account with a strong password, biometrics, or both, and set it to lock after a short period of inactivity. Security from a one-time-password comes from two parties knowing the same key and counter - HOTP(Key,Counter) - while an attacker doesn't know the key. However to generate the next password on the device, the plugin would require either a secret stored on the device or the normal password for the KeePass file.

Presumably the plugin uses OATH HOTP where the KeePass file or master key is re-encypted after each access with the next one-time-password. Security remains the same + extra cognitive overhead.

Keepass windows login