FileZilla stores passwords as plaintext.

[eXor]

I'm sure this is ancient news to some, but I just stumbled upon this information today.

Malware that target FileZilla must be having a field day.

I am not affected as I try and avoid letting programs save my passwords.

In the case of FileZilla, I've always used:

Logon Type: Interactive

and

Protocol: SFTP - SSH File Transfer Protocol

The passwords are stored in \Users\YourUserName\AppData\Roaming\FileZilla\sitemanager.xml

Below is an entry for a ficticious site that I created. The password is omgitstrue :

        <Server>
            <Host>127.0.0.1</Host>
            <Port>2222</Port>
            <Protocol>1</Protocol>
            <Type>0</Type>
            <User>ftp</User>
            <Pass>omgitstrue</Pass>
            <Logontype>1</Logontype>
            <TimezoneOffset>0</TimezoneOffset>
            <PasvMode>MODE_DEFAULT</PasvMode>
            <MaximumMultipleConnections>0</MaximumMultipleConnections>
            <EncodingType>Auto</EncodingType>
            <BypassProxy>0</BypassProxy>
            <Name>SMH</Name>
            <Comments></Comments>
            <LocalDir></LocalDir>
            <RemoteDir></RemoteDir>
            <SyncBrowsing>0</SyncBrowsing>omg
        </Server>