Site Manager password encryption and master password enforcement

Credential Storage in sitemanager.xml

FileZilla Site Manager stores connection details and credentials within the sitemanager.xml file. By default, these passwords are stored in plain text, making them accessible to any user or process with read permissions to the local application data folder.

Master Password Constraints

The Master Password feature allows for the encryption of these credentials. However, this is an opt-in security setting managed via the Security menu. There is currently no native mechanism to mandate the use of a master password for all users or to prevent the initial saving of credentials in plain text before a master password is established.

In environments requiring strict compliance with credential encryption standards, the manual nature of this activation creates a gap in security enforcement.

• Is there a configuration file or registry key that can force the Master Password requirement upon first launch?
• Can the application be configured to reject the saving of any password in sitemanager.xml unless a master password is already active?