I use the KeePass password manager, which allows me to change the key derivation/encryption settings. I'm tempted to take time to choose very strong settings and an enormous passphrase.
But does it really improve security ? My understanding is that when a malware runs on a user account (which is the only way it could try to attack my password database), there's not safe way to hide data : it could register keystrokes, or take screenshots when passwords appear on the screen, or try to read the password manager's memory when the database is decrypted, or monitor the clipboard.
Moreover, I don't see the point in investing so much effort in securing my password database when other personal and sensitive data sits unencrypted in my user folder, like connection cookies or my photos archive, which is arguably more sensitive than my passwords : the latter can be changed after a breach, but if the former gets stolen, I've lost. Also, it would bother me more if someone stole my photos than the passwords to my social media accounts.
Finally, I use full disk encryption, preventing someone with access to my computer from using any data on it, including my passwords.
Because of those reasons, I'm considering using KeePass with only a keyfile that would sit in my user folder, making the encryption totally useless as the key would be as accessible as the encrypted file. I know it's not considered good practice, but for the above reasons I don't see the point in securing only this particular part of my data.
Is there any reason I've overlooked that would make this decision stupid ? More generally, how can a master password be a significant improvement in security as a malware would have other easy options to see the passwords ?