After some reflection, and yet another issue with a customer not remembering their password, I am removing the application level password capability from my software. Why? Because real security is controlling access itself. Lock up the computer. Hardware access control. Operating system access control. Access control keys, recovery keys stored off site under lock and key themselves.
In my customer's cases, the complaint will inevitably be when the owner wants to have secure data on a computer they let their employees access.
It will be interesting to see the customer feedback, and arguments against. The #1 will likely be "I cannot afford a separate computer", which is tough to sell to me, since a modest computer can be had for much less than a year of data breach insurance. Plus the number of customers who install a "second" copy on a different computer for "travel, home use, etc.".
One good point was to add 2FA. But that comes at a cost (internet access at all times, and a cost per access), which is still fallible (email spoofing, stolen phone number, lost, stolen, or borrowed phones).
---
When I added the application level password, we were in the days of Windows 3.1, and there was no real security in the hardware and OS, and most did not want to pay for the access control applications of the end of the last century. Now, it is tough to get a computer without hardware control and the OS having access control as well.