Security of Credentials

If you are using public key authentication, you can use Pageant authentication agent to avoid entering your passphrase for every connection.

If you want to store your password in site to avoid entering them for every connection, it is recommended to protect them with master password.

By default, when you enter your password on the authentication window, it is stored in the memory and reused for all subsequent authentications during the same session, such as when reconnecting, opening an additional connection for a background transfer, opening a separate shell session or opening a session in PuTTY.

You can choose not to keep the password in the memory, for an increased protection, by turning off both Remember password for duration of session and Remember session password and pass it to PuTTY preference options.

When you choose not to remember the password by default, you can still choose to remember it for a specific session on the password prompt. The same effect has entering your password already to the Password box on the Login dialog.

If you have your password stored in a site, it is always automatically used for all authentications during a session.

Keeping the password in the memory can be dangerous, in case a malware gains access to the WinSCP process or the memory is swapped out to disk or written into a crash dump file. However, it is still unavoidably very dangerous, if malicious software is in a position to read the memory of your WinSCP processes: there is still a lot of sensitive data in there which cannot be wiped because it’s still being used, e.g. session keys. Also Pageant retains decrypted private keys in memory for long periods on purpose if you use it. So turning off the option to remember the password somewhat mitigates the risks of malicious access to your WinSCP processes’ memory, but it cannot eliminate those risks completely.1

The least recommended method of handling passwords conveniently is to store them unprotected with your site.

Saved passwords (unless protected by master password) are stored in a manner that they can easily be recovered. It is not possible to securely encrypt passwords in a way that still allows for automatic use. Do not use the save password feature if you are not absolutely sure of the physical and electronic security of the system on which you are storing passwords.

Also note that you need to request storing your password unprotected explicitly on Save session as dialog.

System administrators can restrict password storing altogether.

Learn how to protect credentials used for automation.