How do I store my connection string safely?
You can't. You can only obfuscate it.
Obviously you can encrypt a connection string in a client application. One very easy way would be to use an obfuscation program like .NET Reactor which has a simple option to encrypt all strings. If you want to use obfuscation, go for it. I'm a fan personally. This gives you as much protection (which is to say not much) as any other encryption method that might be suggested, but it can serve as a nuisance to the average user.
Just understand that when it comes to client applications - be it WPF, mobile, or web - anything that the client can access, the person who controls the client can also access. The client must always be assumed to be insecure and untrusted. It doesn't matter if it's programmed in an easy-to-decompile language like C#, or in C++ or assembly. By extension, if the users have local databases on their systems, those databases, too, are insecure. Even if they could somehow be prevented from seeing the connection string, they can get to them through other means.
The only way to protect data from client software is to keep it inaccessible except through a secure middleman that you control - e.g., a server. When the client authenticates, the server provides a short-lived token that lets the client access data during the session. When the session is over, the token stops working. In other words, you secure the connection to the database by ensuring the client never gets one; the middleman (the server) mediates all access. The only secret the client is entrusted with is a short-lived one-time token that you retain the power to invalidate at any time.
Even if your users are all behind a firewall in a secure on-prem network, you still can't let the client computers connect directly to the database if you want that data to remain secured. Sure, in the before times, you may have seen productivity apps that lived behind corporate firewalls connecting to SQL databases directly. Hardly anyone does this anymore, but if they do, it's because they have accepted the fact that anybody behind that firewall can access those databases with or without the client software.
I hope this helps and apologize if this doesn't directly answer your question. To me it's a matter of fundamental importance that all developers understand what perhaps should be the First Commandment of data security - thou shalt never entrust the client with something you want to keep secret.
