I looked at KeePass to store confidential information on Windows. But then it occured to me that org files can easily be encrypted, so now I use that instead.

Just add the extension .gpg to your file (so vault.org becomes vault.org.gpg) and you're good to go. The double extension lets Emacs know its both encrypted and an org file.

If you want to hide that the file is an org file, you can even rename your file to just e.g. vault.gpg and start your file with:

# -*- coding: utf-8; mode: org -*-

I love how org mode turns out to be the perfect PIM with every new step. And I was glad to find that EasyPG worked out of the box even on Windows.

The only downside was that you need to enter your password in a popup window, instead of in the minibuffer. This is easily remedied by customizing (epg-pinentry-mode 'loopback).