diff --git a/CHANGELOG.md b/CHANGELOG.md
index 284a9311440..3763ab5a8be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,7 @@ Note that this project **does not** adhere to [Semantic Versioning](http://semve
 - We enabled the user to change the name of a field in a custom entry type by double-clicking on it. [#9840](https://github.com/JabRef/jabref/issues/9840)
 - We integrated two mail actions ("As Email" and "To Kindle") under a new "Send" option in the right-click & Tools menus. The Kindle option creates an email targeted to the user's Kindle email, which can be set in preferences under "External programs" [#6186](https://github.com/JabRef/jabref/issues/6186)
 - We added an option to clear recent libraries' history. [#10003](https://github.com/JabRef/jabref/issues/10003)
+- We added an option to encrypt and remember the proxy password. [#8055](https://github.com/JabRef/jabref/issues/8055)[#10044](https://github.com/JabRef/jabref/issues/10044)
 
 ### Changed
 
@@ -70,6 +71,7 @@ Note that this project **does not** adhere to [Semantic Versioning](http://semve
 - We improved the error message when no terminal was found [#9607](https://github.com/JabRef/jabref/issues/9607)
 - In the context of the "systematic literature functionality", we changed the name "database" to "catalog" to use a separate term for online catalogs in comparison to SQL databases. [#9951](https://github.com/JabRef/jabref/pull/9951)
 - We now show more fields (including Special Fields) in the dropdown selection for "Save sort order" in the library properties and for "Export sort order" in the preferences. [#10010](https://github.com/JabRef/jabref/issues/10010)
+- We now encrypt and store the custom API keys in the OS native credential store. [#10044](https://github.com/JabRef/jabref/issues/10044)
 
 ### Fixed
 
@@ -81,7 +83,7 @@ Note that this project **does not** adhere to [Semantic Versioning](http://semve
 - We fixed an issue where custom field in the custom entry types could not be set to mulitline. [#9609](https://github.com/JabRef/jabref/issues/9609)
 - We fixed an issue where the Office XML exporter did not resolve BibTeX-Strings when exporting entries. [forum#3741](https://discourse.jabref.org/t/exporting-bibtex-constant-strings-to-ms-office-2007-xml/3741)
 - We fixed an issue where the Merge Entries Toolbar configuration was not saved after hitting 'Merge Entries' button. [#9091](https://github.com/JabRef/jabref/issues/9091)
-- We fixed an issue where the password is saved locally if user wants to use proxy with authentication. [#8055](https://github.com/JabRef/jabref/issues/8055)
+- We fixed an issue where the password is stored in clear text if the user wants to use a proxy with authentication. [#8055](https://github.com/JabRef/jabref/issues/8055)
 - JabRef is now more relaxed when parsing field content: In case a field content ended with `\`, the combination `\}` was treated as plain `}`. [#9668](https://github.com/JabRef/jabref/issues/9668)
 - We resolved an issue that cut off the number of group entries when it exceeded four digits. [#8797](https://github.com/JabRef/jabref/issues/8797)
 - We fixed the issue where the size of the global search window was not retained after closing. [#9362](https://github.com/JabRef/jabref/issues/9362)
diff --git a/build.gradle b/build.gradle
index 7a75a7847fd..14324d78e2e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -141,6 +141,7 @@ dependencies {
 
     implementation 'io.github.java-diff-utils:java-diff-utils:4.12'
     implementation 'info.debatty:java-string-similarity:2.0.0'
+    implementation 'com.github.javakeyring:java-keyring:1.0.2'
 
     antlr4 'org.antlr:antlr4:4.13.0'
     implementation 'org.antlr:antlr4-runtime:4.13.0'
diff --git a/src/main/java/module-info.java b/src/main/java/module-info.java
index 91229649901..2138923ed88 100644
--- a/src/main/java/module-info.java
+++ b/src/main/java/module-info.java
@@ -99,6 +99,8 @@
 
     requires com.h2database.mvstore;
 
+    requires java.keyring;
+
     requires org.jooq.jool;
 
     // fulltext search
diff --git a/src/main/java/org/jabref/gui/JabRefGUI.java b/src/main/java/org/jabref/gui/JabRefGUI.java
index 74afaa50314..133df390b3f 100644
--- a/src/main/java/org/jabref/gui/JabRefGUI.java
+++ b/src/main/java/org/jabref/gui/JabRefGUI.java
@@ -4,6 +4,7 @@
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 import java.util.stream.Collectors;
 
 import javafx.application.Platform;
@@ -25,6 +26,7 @@
 import org.jabref.logic.shared.exception.InvalidDBMSConnectionPropertiesException;
 import org.jabref.logic.shared.exception.NotASharedDatabaseException;
 import org.jabref.logic.util.WebViewStore;
+import org.jabref.model.strings.StringUtil;
 import org.jabref.model.util.FileUpdateMonitor;
 import org.jabref.preferences.GuiPreferences;
 import org.jabref.preferences.PreferencesService;
@@ -71,13 +73,32 @@ public JabRefGUI(Stage mainStage,
                 preferencesService.getInternalPreferences())
                 .checkForNewVersionDelayed();
 
-        if (preferencesService.getProxyPreferences().shouldUseProxy() && preferencesService.getProxyPreferences().shouldUseAuthentication()) {
-            DialogService dialogService = Injector.instantiateModelOrService(DialogService.class);
-            dialogService.showPasswordDialogAndWait(Localization.lang("Proxy configuration"), Localization.lang("Proxy requires password"), Localization.lang("Password"))
-                .ifPresent(newPassword -> {
-                    preferencesService.getProxyPreferences().setPassword(newPassword);
-                    ProxyRegisterer.register(preferencesService.getProxyPreferences());
-                });
+        setupProxy();
+    }
+
+    private void setupProxy() {
+        if (!preferencesService.getProxyPreferences().shouldUseProxy()
+                || !preferencesService.getProxyPreferences().shouldUseAuthentication()) {
+            return;
+        }
+
+        if (preferencesService.getProxyPreferences().shouldPersistPassword()
+                && StringUtil.isNotBlank(preferencesService.getProxyPreferences().getPassword())) {
+            ProxyRegisterer.register(preferencesService.getProxyPreferences());
+            return;
+        }
+
+        DialogService dialogService = Injector.instantiateModelOrService(DialogService.class);
+        Optional<String> password = dialogService.showPasswordDialogAndWait(
+                Localization.lang("Proxy configuration"),
+                Localization.lang("Proxy requires password"),
+                Localization.lang("Password"));
+
+        if (password.isPresent()) {
+            preferencesService.getProxyPreferences().setPassword(password.get());
+            ProxyRegisterer.register(preferencesService.getProxyPreferences());
+        } else {
+            LOGGER.warn("No proxy password specified");
         }
     }
 
diff --git a/src/main/java/org/jabref/gui/preferences/general/GeneralTab.fxml b/src/main/java/org/jabref/gui/preferences/general/GeneralTab.fxml
index 706d9510baf..60892aea5cf 100644
--- a/src/main/java/org/jabref/gui/preferences/general/GeneralTab.fxml
+++ b/src/main/java/org/jabref/gui/preferences/general/GeneralTab.fxml
@@ -65,7 +65,6 @@
     <CheckBox fx:id="inspectionWarningDuplicate"
               text="%Warn about unresolved duplicates when closing inspection window"/>
     <CheckBox fx:id="confirmDelete" text="%Show confirmation dialog when deleting entries"/>
-
     <CheckBox fx:id="collectTelemetry" text="%Collect and share telemetry data to help improve JabRef"/>
 
     <Label styleClass="sectionHeader" text="%Libraries"/>
diff --git a/src/main/java/org/jabref/gui/preferences/network/NetworkTab.fxml b/src/main/java/org/jabref/gui/preferences/network/NetworkTab.fxml
index a7851acdbb2..7817d437c75 100644
--- a/src/main/java/org/jabref/gui/preferences/network/NetworkTab.fxml
+++ b/src/main/java/org/jabref/gui/preferences/network/NetworkTab.fxml
@@ -50,7 +50,7 @@
         <TextField fx:id="proxyUsername" prefWidth="200.0" GridPane.columnIndex="1" GridPane.rowIndex="4" />
         <Label fx:id="proxyPasswordLabel" text="%Password" GridPane.rowIndex="5" />
         <CustomPasswordField fx:id="proxyPassword" prefWidth="200.0" GridPane.columnIndex="1" GridPane.rowIndex="5" />
-        <Label fx:id="proxyAttentionLabel" styleClass="info-message" text="%Password kept for this session only." GridPane.columnIndex="2" GridPane.rowIndex="5" />
+        <CheckBox fx:id="proxyPersistPassword" text="%Persist password between sessions" GridPane.columnIndex="2" GridPane.rowIndex="5"/>
         <Button fx:id="checkConnectionButton" onAction="#checkConnection" prefWidth="200.0" text="%Check connection" GridPane.columnIndex="1" GridPane.rowIndex="6" />
     </GridPane>
    <Label styleClass="sectionHeader" text="%SSL Configuration" />
diff --git a/src/main/java/org/jabref/gui/preferences/network/NetworkTab.java b/src/main/java/org/jabref/gui/preferences/network/NetworkTab.java
index 093ac11fd63..19c3425edd0 100644
--- a/src/main/java/org/jabref/gui/preferences/network/NetworkTab.java
+++ b/src/main/java/org/jabref/gui/preferences/network/NetworkTab.java
@@ -50,8 +50,8 @@ public class NetworkTab extends AbstractPreferenceTabView<NetworkTabViewModel> i
     @FXML private TextField proxyUsername;
     @FXML private Label proxyPasswordLabel;
     @FXML private CustomPasswordField proxyPassword;
-    @FXML private Label proxyAttentionLabel;
     @FXML private Button checkConnectionButton;
+    @FXML private CheckBox proxyPersistPassword;
 
     @FXML private TableView<CustomCertificateViewModel> customCertificatesTable;
     @FXML private TableColumn<CustomCertificateViewModel, String> certIssuer;
@@ -105,7 +105,8 @@ public void initialize() {
         proxyPasswordLabel.disableProperty().bind(proxyCustomAndAuthentication.not());
         proxyPassword.textProperty().bindBidirectional(viewModel.proxyPasswordProperty());
         proxyPassword.disableProperty().bind(proxyCustomAndAuthentication.not());
-        proxyAttentionLabel.disableProperty().bind(proxyCustomAndAuthentication.not());
+        proxyPersistPassword.selectedProperty().bindBidirectional(viewModel.proxyPersistPasswordProperty());
+        proxyPersistPassword.disableProperty().bind(proxyCustomAndAuthentication.not());
 
         proxyPassword.setRight(IconTheme.JabRefIcons.PASSWORD_REVEALED.getGraphicNode());
         proxyPassword.getRight().addEventFilter(MouseEvent.MOUSE_PRESSED, this::proxyPasswordReveal);
diff --git a/src/main/java/org/jabref/gui/preferences/network/NetworkTabViewModel.java b/src/main/java/org/jabref/gui/preferences/network/NetworkTabViewModel.java
index a54c6431159..1379d5ebbe2 100644
--- a/src/main/java/org/jabref/gui/preferences/network/NetworkTabViewModel.java
+++ b/src/main/java/org/jabref/gui/preferences/network/NetworkTabViewModel.java
@@ -4,7 +4,6 @@
 import java.nio.file.Path;
 import java.util.Collections;
 import java.util.List;
-import java.util.Objects;
 import java.util.Optional;
 import java.util.concurrent.atomic.AtomicBoolean;
 
@@ -43,12 +42,8 @@
 import de.saxsys.mvvmfx.utils.validation.ValidationStatus;
 import de.saxsys.mvvmfx.utils.validation.Validator;
 import kong.unirest.UnirestException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 public class NetworkTabViewModel implements PreferenceTabViewModel {
-    private static final Logger LOGGER = LoggerFactory.getLogger(NetworkTabViewModel.class);
-
     private final BooleanProperty remoteServerProperty = new SimpleBooleanProperty();
     private final StringProperty remotePortProperty = new SimpleStringProperty("");
     private final BooleanProperty proxyUseProperty = new SimpleBooleanProperty();
@@ -57,6 +52,7 @@ public class NetworkTabViewModel implements PreferenceTabViewModel {
     private final BooleanProperty proxyUseAuthenticationProperty = new SimpleBooleanProperty();
     private final StringProperty proxyUsernameProperty = new SimpleStringProperty("");
     private final StringProperty proxyPasswordProperty = new SimpleStringProperty("");
+    private final BooleanProperty proxyPersistPasswordProperty = new SimpleBooleanProperty();
     private final ListProperty<CustomCertificateViewModel> customCertificateListProperty = new SimpleListProperty<>(FXCollections.observableArrayList());
 
     private final Validator remotePortValidator;
@@ -92,7 +88,8 @@ public NetworkTabViewModel(DialogService dialogService, PreferencesService prefe
                 proxyPreferences.getPort(),
                 proxyPreferences.shouldUseAuthentication(),
                 proxyPreferences.getUsername(),
-                proxyPreferences.getPassword());
+                proxyPreferences.getPassword(),
+                proxyPreferences.shouldPersistPassword());
 
         remotePortValidator = new FunctionBasedValidator<>(
                 remotePortProperty,
@@ -140,6 +137,7 @@ public NetworkTabViewModel(DialogService dialogService, PreferencesService prefe
                         Localization.lang("Network"),
                         Localization.lang("Proxy configuration"),
                         Localization.lang("Please specify a password"))));
+
         this.trustStoreManager = new TrustStoreManager(Path.of(sslPreferences.getTruststorePath()));
     }
 
@@ -159,6 +157,7 @@ private void setProxyValues() {
         proxyUseAuthenticationProperty.setValue(proxyPreferences.shouldUseAuthentication());
         proxyUsernameProperty.setValue(proxyPreferences.getUsername());
         proxyPasswordProperty.setValue(proxyPreferences.getPassword());
+        proxyPersistPasswordProperty.setValue(proxyPreferences.shouldPersistPassword());
     }
 
     private void setSSLValues() {
@@ -181,24 +180,6 @@ private void setSSLValues() {
 
     @Override
     public void storeSettings() {
-        storeRemoteSettings();
-        storeProxySettings(new ProxyPreferences(
-                proxyUseProperty.getValue(),
-                proxyHostnameProperty.getValue().trim(),
-                proxyPortProperty.getValue().trim(),
-                proxyUseAuthenticationProperty.getValue(),
-                proxyUsernameProperty.getValue().trim(),
-                proxyPasswordProperty.getValue()
-        ));
-        storeSSLSettings();
-    }
-
-    private void storeRemoteSettings() {
-        RemotePreferences newRemotePreferences = new RemotePreferences(
-                remotePreferences.getPort(),
-                remoteServerProperty.getValue()
-        );
-
         getPortAsInt(remotePortProperty.getValue()).ifPresent(newPort -> {
             if (remotePreferences.isDifferentPort(newPort)) {
                 remotePreferences.setPort(newPort);
@@ -212,25 +193,16 @@ private void storeRemoteSettings() {
             remotePreferences.setUseRemoteServer(false);
             Globals.REMOTE_LISTENER.stop();
         }
-    }
-
-    private void storeProxySettings(ProxyPreferences newProxyPreferences) {
-        if (Objects.equals(newProxyPreferences, proxyPreferences)) {
-            // nothing changed; thus, nothing to store
-            return;
-        }
 
-        ProxyRegisterer.register(newProxyPreferences);
+        proxyPreferences.setUseProxy(proxyUseProperty.getValue());
+        proxyPreferences.setHostname(proxyHostnameProperty.getValue().trim());
+        proxyPreferences.setPort(proxyPortProperty.getValue().trim());
+        proxyPreferences.setUseAuthentication(proxyUseAuthenticationProperty.getValue());
+        proxyPreferences.setUsername(proxyUsernameProperty.getValue().trim());
+        proxyPreferences.setPersistPassword(proxyPersistPasswordProperty.getValue()); // Set before the password to actually persist
+        proxyPreferences.setPassword(proxyPasswordProperty.getValue());
+        ProxyRegisterer.register(proxyPreferences);
 
-        proxyPreferences.setUseProxy(newProxyPreferences.shouldUseProxy());
-        proxyPreferences.setHostname(newProxyPreferences.getHostname());
-        proxyPreferences.setPort(newProxyPreferences.getPort());
-        proxyPreferences.setUseAuthentication(newProxyPreferences.shouldUseAuthentication());
-        proxyPreferences.setUsername(newProxyPreferences.getUsername());
-        proxyPreferences.setPassword(newProxyPreferences.getPassword());
-    }
-
-    public void storeSSLSettings() {
         trustStoreManager.flush();
     }
 
@@ -299,15 +271,14 @@ public void checkConnection() {
 
         final String testUrl = "http://jabref.org";
 
-        // Workaround for testing, since the URLDownload uses stored proxy settings, see
-        // preferences.storeProxyPreferences(...) below.
-        storeProxySettings(new ProxyPreferences(
+        ProxyRegisterer.register(new ProxyPreferences(
                 proxyUseProperty.getValue(),
                 proxyHostnameProperty.getValue().trim(),
                 proxyPortProperty.getValue().trim(),
                 proxyUseAuthenticationProperty.getValue(),
                 proxyUsernameProperty.getValue().trim(),
-                proxyPasswordProperty.getValue()
+                proxyPasswordProperty.getValue(),
+                proxyPersistPasswordProperty.getValue()
         ));
 
         URLDownload urlDownload;
@@ -324,7 +295,7 @@ public void checkConnection() {
             dialogService.showErrorDialogAndWait(dialogTitle, connectionFailedText);
         }
 
-        storeProxySettings(backupProxyPreferences);
+        ProxyRegisterer.register(backupProxyPreferences);
     }
 
     @Override
@@ -368,6 +339,10 @@ public StringProperty proxyPasswordProperty() {
         return proxyPasswordProperty;
     }
 
+    public BooleanProperty proxyPersistPasswordProperty() {
+        return proxyPersistPasswordProperty;
+    }
+
     public ListProperty<CustomCertificateViewModel> customCertificateListProperty() {
         return customCertificateListProperty;
     }
diff --git a/src/main/java/org/jabref/logic/net/ProxyPreferences.java b/src/main/java/org/jabref/logic/net/ProxyPreferences.java
index 5479e6beb72..dc5311ab139 100644
--- a/src/main/java/org/jabref/logic/net/ProxyPreferences.java
+++ b/src/main/java/org/jabref/logic/net/ProxyPreferences.java
@@ -15,22 +15,25 @@ public class ProxyPreferences {
     private final BooleanProperty useAuthentication;
     private final StringProperty username;
     private final StringProperty password;
+    private final BooleanProperty persistPassword;
 
     public ProxyPreferences(Boolean useProxy,
                             String hostname,
                             String port,
                             Boolean useAuthentication,
                             String username,
-                            String password) {
+                            String password,
+                            boolean persistPassword) {
         this.useProxy = new SimpleBooleanProperty(useProxy);
         this.hostname = new SimpleStringProperty(hostname);
         this.port = new SimpleStringProperty(port);
         this.useAuthentication = new SimpleBooleanProperty(useAuthentication);
         this.username = new SimpleStringProperty(username);
         this.password = new SimpleStringProperty(password);
+        this.persistPassword = new SimpleBooleanProperty(persistPassword);
     }
 
-    public final Boolean shouldUseProxy() {
+    public final boolean shouldUseProxy() {
         return useProxy.getValue();
     }
 
@@ -66,8 +69,8 @@ public void setPort(String port) {
         this.port.set(port);
     }
 
-    public final Boolean shouldUseAuthentication() {
-        return useAuthentication.getValue();
+    public final boolean shouldUseAuthentication() {
+        return useAuthentication.get();
     }
 
     public BooleanProperty useAuthenticationProperty() {
@@ -102,6 +105,18 @@ public void setPassword(String password) {
         this.password.set(password);
     }
 
+    public boolean shouldPersistPassword() {
+        return persistPassword.get();
+    }
+
+    public BooleanProperty persistPasswordProperty() {
+        return persistPassword;
+    }
+
+    public void setPersistPassword(boolean persistPassword) {
+        this.persistPassword.set(persistPassword);
+    }
+
     @Override
     public boolean equals(Object o) {
         if (this == o) {
@@ -118,7 +133,8 @@ public boolean equals(Object o) {
                 && Objects.equals(port.getValue(), other.port.getValue())
                 && Objects.equals(useAuthentication.getValue(), other.useAuthentication.getValue())
                 && Objects.equals(username.getValue(), other.username.getValue())
-                && Objects.equals(password.getValue(), other.password.getValue());
+                && Objects.equals(password.getValue(), other.password.getValue())
+                && Objects.equals(persistPassword.getValue(), other.persistPassword.getValue());
     }
 
     @Override
@@ -129,6 +145,7 @@ public int hashCode() {
                 port.getValue(),
                 useAuthentication.getValue(),
                 username.getValue(),
-                password.getValue());
+                password.getValue(),
+                persistPassword.getValue());
     }
 }
diff --git a/src/main/java/org/jabref/migrations/PreferencesMigrations.java b/src/main/java/org/jabref/migrations/PreferencesMigrations.java
index 9d88661ed15..7a43a4a5e43 100644
--- a/src/main/java/org/jabref/migrations/PreferencesMigrations.java
+++ b/src/main/java/org/jabref/migrations/PreferencesMigrations.java
@@ -20,6 +20,7 @@
 import org.jabref.gui.maintable.MainTableColumnModel;
 import org.jabref.logic.citationkeypattern.GlobalCitationKeyPattern;
 import org.jabref.logic.cleanup.FieldFormatterCleanups;
+import org.jabref.logic.shared.security.Password;
 import org.jabref.logic.util.OS;
 import org.jabref.model.entry.field.SpecialField;
 import org.jabref.model.entry.field.StandardField;
@@ -28,6 +29,7 @@
 import org.jabref.preferences.CleanupPreferences;
 import org.jabref.preferences.JabRefPreferences;
 
+import com.github.javakeyring.Keyring;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -60,6 +62,7 @@ public static void runMigrations(JabRefPreferences preferences) {
         upgradeColumnPreferences(preferences);
         restoreVariablesForBackwardCompatibility(preferences);
         upgradeCleanups(preferences);
+        moveApiKeysToKeyring(preferences);
     }
 
     /**
@@ -516,4 +519,26 @@ private static void upgradeCleanups(JabRefPreferences prefs) {
             prefs.put(V6_0_CLEANUP_FIELD_FORMATTERS, String.join(OS.NEWLINE, formatterCleanups.subList(1, formatterCleanups.size() - 1)));
         }
     }
+
+    static void moveApiKeysToKeyring(JabRefPreferences preferences) {
+        final String V5_9_FETCHER_CUSTOM_KEY_NAMES = "fetcherCustomKeyNames";
+        final String V5_9_FETCHER_CUSTOM_KEYS = "fetcherCustomKeys";
+
+        List<String> names = preferences.getStringList(V5_9_FETCHER_CUSTOM_KEY_NAMES);
+        List<String> keys = preferences.getStringList(V5_9_FETCHER_CUSTOM_KEYS);
+
+        if (keys.size() > 0 && names.size() == keys.size()) {
+            try (final Keyring keyring = Keyring.create()) {
+                for (int i = 0; i < names.size(); i++) {
+                    keyring.setPassword("org.jabref.customapikeys", names.get(i), new Password(
+                            keys.get(i),
+                            preferences.getInternalPreferences().getUserAndHost())
+                            .encrypt());
+                }
+                preferences.deleteKey(V5_9_FETCHER_CUSTOM_KEYS);
+            } catch (Exception ex) {
+                LOGGER.error("Unable to open key store", ex);
+            }
+        }
+    }
 }
diff --git a/src/main/java/org/jabref/preferences/JabRefPreferences.java b/src/main/java/org/jabref/preferences/JabRefPreferences.java
index 896b6b6e7ff..f97680c67d7 100644
--- a/src/main/java/org/jabref/preferences/JabRefPreferences.java
+++ b/src/main/java/org/jabref/preferences/JabRefPreferences.java
@@ -94,6 +94,7 @@
 import org.jabref.logic.protectedterms.ProtectedTermsPreferences;
 import org.jabref.logic.remote.RemotePreferences;
 import org.jabref.logic.shared.prefs.SharedDatabasePreferences;
+import org.jabref.logic.shared.security.Password;
 import org.jabref.logic.util.OS;
 import org.jabref.logic.util.Version;
 import org.jabref.logic.util.io.AutoLinkPreferences;
@@ -113,6 +114,8 @@
 import org.jabref.model.search.rules.SearchRules;
 import org.jabref.model.strings.StringUtil;
 
+import com.github.javakeyring.Keyring;
+import com.github.javakeyring.PasswordAccessException;
 import com.tobiasdiez.easybind.EasyBind;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -215,10 +218,6 @@ public class JabRefPreferences implements PreferencesService {
     public static final String BASE_DOI_URI = "baseDOIURI";
     public static final String USE_CUSTOM_DOI_URI = "useCustomDOIURI";
 
-    public static final String FETCHER_CUSTOM_KEY_NAMES = "fetcherCustomKeyNames";
-    public static final String FETCHER_CUSTOM_KEY_USES = "fetcherCustomKeyUses";
-    public static final String FETCHER_CUSTOM_KEYS = "fetcherCustomKeys";
-
     public static final String USE_OWNER = "useOwner";
     public static final String DEFAULT_OWNER = "defaultOwner";
     public static final String OVERWRITE_OWNER = "overwriteOwner";
@@ -356,9 +355,14 @@ public class JabRefPreferences implements PreferencesService {
     private static final String PROXY_PORT = "proxyPort";
     private static final String PROXY_HOSTNAME = "proxyHostname";
     private static final String PROXY_USE = "useProxy";
+    private static final String PROXY_USE_AUTHENTICATION = "useProxyAuthentication";
     private static final String PROXY_USERNAME = "proxyUsername";
     private static final String PROXY_PASSWORD = "proxyPassword";
-    private static final String PROXY_USE_AUTHENTICATION = "useProxyAuthentication";
+    private static final String PROXY_PERSIST_PASSWORD = "persistPassword";
+
+    // Web search
+    private static final String FETCHER_CUSTOM_KEY_NAMES = "fetcherCustomKeyNames";
+    private static final String FETCHER_CUSTOM_KEY_USES = "fetcherCustomKeyUses";
 
     // SSL
     private static final String TRUSTSTORE_PATH = "truststorePath";
@@ -537,6 +541,7 @@ private JabRefPreferences() {
         defaults.put(PROXY_USE_AUTHENTICATION, Boolean.FALSE);
         defaults.put(PROXY_USERNAME, "");
         defaults.put(PROXY_PASSWORD, "");
+        defaults.put(PROXY_PERSIST_PASSWORD, Boolean.FALSE);
 
         // SSL
         defaults.put(TRUSTSTORE_PATH, OS.getNativeDesktop()
@@ -650,7 +655,6 @@ private JabRefPreferences() {
 
         defaults.put(FETCHER_CUSTOM_KEY_NAMES, "Springer;IEEEXplore;SAO/NASA ADS;ScienceDirect;Biodiversity Heritage");
         defaults.put(FETCHER_CUSTOM_KEY_USES, "FALSE;FALSE;FALSE;FALSE;FALSE");
-        defaults.put(FETCHER_CUSTOM_KEYS, "");
 
         defaults.put(USE_OWNER, Boolean.FALSE);
         defaults.put(OVERWRITE_OWNER, Boolean.FALSE);
@@ -978,6 +982,7 @@ public void clear() throws BackingStoreException {
         clearAllBibEntryTypes();
         clearCitationKeyPatterns();
         clearTruststoreFromCustomCertificates();
+        clearCustomFetcherKeys();
         prefs.clear();
         new SharedDatabasePreferences().clear();
     }
@@ -1526,17 +1531,62 @@ public ProxyPreferences getProxyPreferences() {
                 get(PROXY_PORT),
                 getBoolean(PROXY_USE_AUTHENTICATION),
                 get(PROXY_USERNAME),
-                (String) defaults.get(PROXY_PASSWORD));
+                getProxyPassword(),
+                getBoolean(PROXY_PERSIST_PASSWORD));
 
         EasyBind.listen(proxyPreferences.useProxyProperty(), (obs, oldValue, newValue) -> putBoolean(PROXY_USE, newValue));
         EasyBind.listen(proxyPreferences.hostnameProperty(), (obs, oldValue, newValue) -> put(PROXY_HOSTNAME, newValue));
         EasyBind.listen(proxyPreferences.portProperty(), (obs, oldValue, newValue) -> put(PROXY_PORT, newValue));
         EasyBind.listen(proxyPreferences.useAuthenticationProperty(), (obs, oldValue, newValue) -> putBoolean(PROXY_USE_AUTHENTICATION, newValue));
         EasyBind.listen(proxyPreferences.usernameProperty(), (obs, oldValue, newValue) -> put(PROXY_USERNAME, newValue));
+        EasyBind.listen(proxyPreferences.passwordProperty(), (obs, oldValue, newValue) -> setProxyPassword(newValue));
+        EasyBind.listen(proxyPreferences.persistPasswordProperty(), (obs, oldValue, newValue) -> {
+            putBoolean(PROXY_PERSIST_PASSWORD, newValue);
+            if (!newValue) {
+                try (final Keyring keyring = Keyring.create()) {
+                    keyring.deletePassword("org.jabref", "proxy");
+                } catch (Exception ex) {
+                    LOGGER.warn("Unable to remove proxy credentials");
+                }
+            }
+        });
 
         return proxyPreferences;
     }
 
+    private String getProxyPassword() {
+        if (getBoolean(PROXY_PERSIST_PASSWORD)) {
+            try (final Keyring keyring = Keyring.create()) {
+                return new Password(
+                        keyring.getPassword("org.jabref", "proxy"),
+                        getInternalPreferences().getUserAndHost())
+                        .decrypt();
+            } catch (PasswordAccessException ex) {
+                LOGGER.warn("JabRef uses proxy password from key store but no password is stored");
+            } catch (Exception ex) {
+                LOGGER.warn("JabRef could not open the key store");
+            }
+        }
+        return (String) defaults.get(PROXY_PASSWORD);
+    }
+
+    private void setProxyPassword(String password) {
+        if (getProxyPreferences().shouldPersistPassword()) {
+            try (final Keyring keyring = Keyring.create()) {
+                if (StringUtil.isBlank(password)) {
+                    keyring.deletePassword("org.jabref", "proxy");
+                } else {
+                    keyring.setPassword("org.jabref", "proxy", new Password(
+                            password.trim(),
+                            getInternalPreferences().getUserAndHost())
+                            .encrypt());
+                }
+            } catch (Exception ex) {
+                LOGGER.warn("Unable to open key store", ex);
+            }
+        }
+    }
+
     @Override
     public SSLPreferences getSSLPreferences() {
         if (Objects.nonNull(sslPreferences)) {
@@ -2759,7 +2809,7 @@ private Set<FetcherApiKey> getFetcherKeys() {
 
         List<String> names = getStringList(FETCHER_CUSTOM_KEY_NAMES);
         List<String> uses = getStringList(FETCHER_CUSTOM_KEY_USES);
-        List<String> keys = getStringList(FETCHER_CUSTOM_KEYS);
+        List<String> keys = getFetcherKeysFromKeyring(names);
 
         for (int i = 0; i < names.size(); i++) {
             fetcherApiKeys.add(new FetcherApiKey(
@@ -2772,6 +2822,28 @@ private Set<FetcherApiKey> getFetcherKeys() {
         return fetcherApiKeys;
     }
 
+    private List<String> getFetcherKeysFromKeyring(List<String> names) {
+        List<String> keys = new ArrayList<>();
+
+        try (final Keyring keyring = Keyring.create()) {
+            for (String fetcher : names) {
+                try {
+                    keys.add(new Password(
+                            keyring.getPassword("org.jabref.customapikeys", fetcher),
+                            getInternalPreferences().getUserAndHost())
+                            .decrypt());
+                } catch (PasswordAccessException ex) {
+                    LOGGER.warn("No api key stored for {} fetcher", fetcher);
+                    keys.add("");
+                }
+            }
+        } catch (Exception ex) {
+            LOGGER.warn("JabRef could not open the key store");
+        }
+
+        return keys;
+    }
+
     private void storeFetcherKeys(Set<FetcherApiKey> fetcherApiKeys) {
         List<String> names = new ArrayList<>();
         List<String> uses = new ArrayList<>();
@@ -2785,7 +2857,39 @@ private void storeFetcherKeys(Set<FetcherApiKey> fetcherApiKeys) {
 
         putStringList(FETCHER_CUSTOM_KEY_NAMES, names);
         putStringList(FETCHER_CUSTOM_KEY_USES, uses);
-        putStringList(FETCHER_CUSTOM_KEYS, keys);
+        storeFetcherKeysToKeyring(names, keys);
+    }
+
+    private void storeFetcherKeysToKeyring(List<String> names, List<String> keys) {
+        try (final Keyring keyring = Keyring.create()) {
+            for (int i = 0; i < names.size(); i++) {
+                if (StringUtil.isNullOrEmpty(keys.get(i))) {
+                    try {
+                        keyring.deletePassword("org.jabref.customapikeys", names.get(i));
+                    } catch (PasswordAccessException ex) {
+                        // Already removed
+                    }
+                } else {
+                    keyring.setPassword("org.jabref.customapikeys", names.get(i), new Password(
+                            keys.get(i),
+                            getInternalPreferences().getUserAndHost())
+                            .encrypt());
+                }
+            }
+        } catch (Exception ex) {
+            LOGGER.error("Unable to open key store");
+        }
+    }
+
+    private void clearCustomFetcherKeys() {
+        List<String> names = getStringList(FETCHER_CUSTOM_KEY_NAMES);
+        try (final Keyring keyring = Keyring.create()) {
+            for (String name : names) {
+                keyring.deletePassword("org.jabref.customapikeys", name);
+            }
+        } catch (Exception ex) {
+            LOGGER.error("Unable to open key store");
+        }
     }
 
     @Override
diff --git a/src/main/resources/l10n/JabRef_en.properties b/src/main/resources/l10n/JabRef_en.properties
index ab6c8ab5b4a..d566fbcb96f 100644
--- a/src/main/resources/l10n/JabRef_en.properties
+++ b/src/main/resources/l10n/JabRef_en.properties
@@ -840,6 +840,8 @@ Show\ BibTeX\ source\ by\ default=Show BibTeX source by default
 
 Show\ confirmation\ dialog\ when\ deleting\ entries=Show confirmation dialog when deleting entries
 
+Persist\ password\ between\ sessions=Persist password between sessions
+
 Show\ last\ names\ only=Show last names only
 
 Show\ names\ unchanged=Show names unchanged
@@ -1252,7 +1254,6 @@ Please\ specify\ a\ password=Please specify a password
 Proxy\ configuration=Proxy configuration
 Use\ custom\ proxy\ configuration=Use custom proxy configuration
 Proxy\ requires\ authentication=Proxy requires authentication
-Password\ kept\ for\ this\ session\ only.=Password kept for this session only.
 Clear\ connection\ settings=Clear connection settings
 Check\ Proxy\ Setting=Check Proxy Setting
 Check\ connection=Check connection
diff --git a/src/test/java/org/jabref/logic/net/ProxyTest.java b/src/test/java/org/jabref/logic/net/ProxyTest.java
index 510f9ce1a50..6b6e844d1b6 100644
--- a/src/test/java/org/jabref/logic/net/ProxyTest.java
+++ b/src/test/java/org/jabref/logic/net/ProxyTest.java
@@ -12,12 +12,14 @@ public class ProxyTest {
    @Test
    public void testProxyPreferencesStorePassword() {
        // mock data
-       Boolean useProxy = true;
+       boolean useProxy = true;
        String hostname = "testName";
        String port = "8080";
-       Boolean useAuthentication = true;
+       boolean useAuthentication = true;
        String username = "testUserName";
        String password = "testPassword";
+       boolean persist = false;
+
        // Creates proxy preference
        ProxyPreferences proxyPref = new ProxyPreferences(
                useProxy,
@@ -25,7 +27,9 @@ public void testProxyPreferencesStorePassword() {
                port,
                useAuthentication,
                username,
-               password);
+               password,
+               persist);
+
        // Check if mock data is stored in object memory and can be extracted
        assertEquals(proxyPref.shouldUseProxy(), true);
        assertEquals(proxyPref.getHostname(), hostname);
@@ -33,5 +37,6 @@ public void testProxyPreferencesStorePassword() {
        assertEquals(proxyPref.shouldUseAuthentication(), true);
        assertEquals(proxyPref.getUsername(), username);
        assertEquals(proxyPref.getPassword(), password);
+       assertEquals(proxyPref.shouldPersistPassword(), persist);
    }
 }
diff --git a/src/test/java/org/jabref/migrations/PreferencesMigrationsTest.java b/src/test/java/org/jabref/migrations/PreferencesMigrationsTest.java
index 099327a7518..7146764d8c1 100644
--- a/src/test/java/org/jabref/migrations/PreferencesMigrationsTest.java
+++ b/src/test/java/org/jabref/migrations/PreferencesMigrationsTest.java
@@ -7,9 +7,15 @@
 
 import org.jabref.preferences.JabRefPreferences;
 
+import com.github.javakeyring.Keyring;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.Answers;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
 
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
@@ -27,7 +33,7 @@ class PreferencesMigrationsTest {
 
     @BeforeEach
     void setUp() {
-        prefs = mock(JabRefPreferences.class);
+        prefs = mock(JabRefPreferences.class, Answers.RETURNS_DEEP_STUBS);
         mainPrefsNode = mock(Preferences.class);
     }
 
@@ -188,4 +194,26 @@ void testRestoreColumnVariablesForBackwardCompatibility() {
 
         verify(prefs).putInt(JabRefPreferences.MAIN_FONT_SIZE, 11);
     }
+
+    @Test
+    void testMoveApiKeysToKeyRing() throws Exception {
+        final String V5_9_FETCHER_CUSTOM_KEY_NAMES = "fetcherCustomKeyNames";
+        final String V5_9_FETCHER_CUSTOM_KEYS = "fetcherCustomKeys";
+        final Keyring keyring = mock(Keyring.class);
+
+        when(prefs.getStringList(V5_9_FETCHER_CUSTOM_KEY_NAMES)).thenReturn(List.of("FetcherA", "FetcherB", "FetcherC"));
+        when(prefs.getStringList(V5_9_FETCHER_CUSTOM_KEYS)).thenReturn(List.of("KeyA", "KeyB", "KeyC"));
+        when(prefs.getInternalPreferences().getUserAndHost()).thenReturn("user-host");
+
+        try (MockedStatic<Keyring> keyringFactory = Mockito.mockStatic(Keyring.class, Answers.RETURNS_DEEP_STUBS)) {
+            keyringFactory.when(Keyring::create).thenReturn(keyring);
+
+            PreferencesMigrations.moveApiKeysToKeyring(prefs);
+
+            verify(keyring).setPassword(eq("org.jabref.customapikeys"), eq("FetcherA"), any());
+            verify(keyring).setPassword(eq("org.jabref.customapikeys"), eq("FetcherB"), any());
+            verify(keyring).setPassword(eq("org.jabref.customapikeys"), eq("FetcherC"), any());
+            verify(prefs).deleteKey(V5_9_FETCHER_CUSTOM_KEYS);
+        }
+    }
 }