Securing FileZilla Site Manager with the Master Password: How, Why, and What to Watch Out For

Why the Master Password Matters

FileZilla stores every Site Manager entry in an XML file—typically sitemanager.xml on Linux or filezilla.xml on Windows. By default, the password field is Base64‑encoded. Base64 is a reversible encoding, not encryption, so anyone who can read the file can instantly decode the password with a single command:

cat sitemanager.xml | grep -i password | cut -d'>' -f2 | cut -d'<' -f1 | base64 -d

Enabling the Master Password changes that. FileZilla encrypts the entire <SiteManager> block with AES‑256, and the key is derived from your master password using PBKDF2. This means the XML no longer contains readable passwords, and you must supply the master password every time FileZilla starts.

How to Enable and Use the Master Password

1. Open FileZilla and navigate to Edit → Settings → Interface → Master password.
2. Check the box “Enable master password” and enter a strong password (at least 12 characters, mix of upper/lowercase, numbers, and symbols).
3. Restart FileZilla. A prompt will appear asking for the master password before any sites load.
4. After entering the correct password, FileZilla decrypts the <SiteManager> block in memory and presents your sites normally.

What the XML Looks Like Before and After

Below is a minimal example of an unencrypted sitemanager.xml snippet:

<SiteManager>
  <Site name="Example FTP">
    <Host>ftp.example.com</Host>
    <Port>21</Port>
    <User>user</User>
    <Password>ZGVmYXVsdA==</Password>  
  </Site>
</SiteManager>

After enabling the Master Password and restarting, the file becomes:

<SiteManager encrypted="true">
  <EncryptedData>U2FsdGVkX1+... (AES‑256 ciphertext) ...</EncryptedData>
</SiteManager>

The <EncryptedData> element contains the AES‑256 ciphertext generated from the PBKDF2‑derived key. The file no longer exposes any readable passwords.

Security Trade‑offs and Practical Limitations

• Forgotten Master Password – There is no recovery mechanism. If you lose the password, you must delete the XML file and re‑enter all sites manually. Back up the file before changing the password.
• In‑Memory Exposure – While FileZilla is running, the decrypted credentials reside in RAM. Keyboard loggers or memory‑dumping tools can still capture them.
• Weak Password Risk – PBKDF2 protects against brute force, but a weak master password (e.g., “password123”) defeats that protection. Use a password manager to generate and store a strong master password.
• Cross‑Platform Synchronization – The encrypted XML is portable, but you must copy the same master password to each machine. Some organizations disallow sharing the same password across devices.
• No OS Keychain Integration – FileZilla does not store the master password in the system keychain or a hardware security module, so the key is only derived at runtime.

Practical Checklist Before Enabling the Master Password

1. Back up sitemanager.xml to a secure location. If you forget the master password, you’ll need to recreate all sites.
2. Choose a password that meets your organization’s complexity policy. Store it in a password manager.
3. Verify the file location:
   • Windows: %APPDATA%\FileZilla\filezilla.xml
   • macOS: ~/Library/Application Support/FileZilla/filezilla.xml
   • Linux: ~/.config/filezilla/sitemanager.xml
4. After enabling, restart FileZilla and confirm the prompt appears. If the file still shows plain Base64, the feature did not activate correctly.

Conclusion: Is the Master Password Enough?

The Master Password feature is a quick win for protecting Site Manager credentials on a single workstation. It turns a reversible Base64 string into an AES‑256 blob that only your chosen password can decrypt. However, it is not a panacea: it does not protect against memory scraping, keyloggers, or accidental loss of the password. For environments where the risk of credential exposure is high, consider supplementing FileZilla with a dedicated credential vault, or using an SFTP client that integrates with the OS keychain.

In short: enable it for everyday use, but treat the master password as you would any other critical secret—store it securely, back up the encrypted XML, and be prepared for the “reset‑all‑sites” scenario if you ever forget it.