Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Filezilla or WinSCP save password in plain text which is unsecured on public machines. Is there any FTP client can save and encrypt password so that people using it only can access to FTP but not able to see password? Thanks!

share|improve this question

closed as off-topic by Mokubai Jan 29 '15 at 22:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they become outdated quickly and attract opinion-based answers. Instead, describe your situation and the specific problem you're trying to solve. Share your research. Here are a few suggestions on how to properly ask this type of question." – Mokubai
If this question can be reworded to fit the rules in the help center, please edit the question.

I had a look at Filezilla's bug tracker and there has been a lot of argument about this. The Filezilla coders argue that there's no point as your OS should guard all your passwords for you. Encrypting them once your machine has a keylogger installed makes no difference. – Iain Jan 23 '10 at 8:09
up vote 4 down vote accepted

Eventually ends up by using WinSCP which encrypt (or hash?) password and save in registry. So it's not easy to see plain text pwd.

share|improve this answer
Note: Master Password option is not enabled by default, after enabling it only it will encrypt password securely. – Morbia Feb 17 '12 at 9:53
Read about Security of Credentials and Master Password in WinSCP documentation. – Martin Prikryl Jan 29 '15 at 7:26

FileZilla developers said that OS should secure passwords for you , but what if someone got acces to your PC (direct acces , without hacking , just sitting in your chair) and looks at your passwords in that SiteManager's XML ?

share|improve this answer
The password is not stored in plain text. – Ramhound Oct 12 '11 at 19:29
Password IS stored in plain text (FileZilla case). If you use FileZilla , look into your C:\Users\your_username\AppData\Roaming\FileZilla\sitemanager.xml file and see how your passwords are stored. – Wrong Nov 20 '11 at 1:51

If you can use the password, you can decrypt it as well, by using the same algorithm as the program uses. Even if you do not know the algorithm, you still can sniff the plain-text authentication using Wireshark.

share|improve this answer

Cyberduck for Windows stores passwords (Wiki) encrypted using the System.Security.Cryptography.DataProtector API.

share|improve this answer

WinSCP does not save passwords in plain text.

Though obviously it can only "obfuscate" the password. It is not possible to securely encrypt passwords in a way that still allows for automatic use.

For better security, you can enable password encryption using master password:

share|improve this answer

If you're connecting via FileZilla's Site Manager, there's an option below the password field to prevent saving the password.

If you use Quickconnect, the password is saved encrypted in the XML file, and you can click the drop-down menu on the right and clear the history. Then the password will not be stored in the XML file.

Where is the evidence that FileZilla saves plaintext passwords?

Assuming you don't clear and empty the history, the password is only saved if you have this setting in the filezilla.xml file:

<Item name="Last Server dont save pass" type="numeric">0</Item>

This is in the FileZilla installation directory, normally under Program Files, but if you can edit the file and change the setting to 0, the last-used site's password won't be saved at all.

share|improve this answer
Thanks. However, when having tens of site in Site Manager, I definitely don't want to memorize all pwds. I am just looking for a FTP client that can encrypt saved pwd to prevent from others easily seeing the pwd in plain text configuration files. That's it. WinSCP use a master pwd to guard all saved pwd in Site Manager. However, is there any other client can even do encryption with out a master pwd? – Stan Jan 23 '10 at 20:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.