FileZilla is a cross platform Open Source FTP client for uploading files to web server. It is one of most used FTP client.
It stores password in XML files in its config directory.
Follow these instructions to recover saved password in FileZilla.
These instructions are applicable in windows. I’ve tested them on windows 7 and windows 8.
Filezilla saves password in 2 files named sitemanager.xml and recentservers.xml. Sitemanager.xml saves password and other details of ftp accounts which are configured through site manager in filezilla. Recentservers.xml saved password saved in quick connect box.
These two files are located in “AppData” folder. To find this location go to
C:/(drive name in which windows is installed) => Users => Gyan(Windows username) => AppData => Roaming => FileZilla
so in my case it is: C:\Users\is14\AppData\Roaming\FileZilla
Open these two files in any text editor to view ftp account details.
Once you open one of the file it has following code blocks. Host (between Host tag) ,username (between User tag) and password (between Pass tag) are clearly visible for a ftp account.
This is an example of the RecentServers.xml file:
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?> <FileZilla3> <RecentServers> <Server> <Host>192.168.99.101</Host> <Port>21</Port> <Protocol>0</Protocol> <Type>0</Type> <User>piero</User> <Pass>test</Pass> <Logontype>1</Logontype> <TimezoneOffset>0</TimezoneOffset> <PasvMode>MODE_DEFAULT</PasvMode> <MaximumMultipleConnections>0</MaximumMultipleConnections> <EncodingType>Auto</EncodingType> <BypassProxy>0</BypassProxy> </Server> </RecentServers> </FileZilla3>
What if the stored password is encoded?
It can happen the password is saved here but the password is saved after an encoding.
If you password looks like this:
<Pass encoding="base64">dGVzdA==</Pass>
you will have to decode it to recover you pass. You can use this online tool to encode/decode string with base64.
Note: AppData folder is hidden by default.Enable show folder in folder option to view it.
Just a tip now: if you want to check how to import and/or export your site list, just click here.
15 October 2015 at 16:22
I can confirm that the base64 decoding works as of today. I am using FileZilla 3.11.0.1.
LikeLike
15 October 2015 at 16:24
Thanks for your feedback! 😉
LikeLike
7 November 2015 at 16:33
Thanks i lost my password and helped me to recover it.
LikeLike
9 November 2015 at 7:53
You’re welcome! 🙂
LikeLike
20 January 2016 at 0:48
WOW! Just wow! thanks. Your tutorial was very helpful
LikeLiked by 1 person
20 January 2016 at 8:13
Thanks man! 🙂
LikeLike
1 May 2016 at 15:16
This still works as of 5/1/2016. Caught a virus and had to reinstall my OS. This tutorial saved me from having go back and ask clients for this information again. Thanks.
LikeLike
2 May 2016 at 8:08
Glad to read this! 😉
LikeLike
10 May 2016 at 22:26
Great outline of the password recovery process. I wanted to use this opportunity to share a free utility I had written to also achieve this same thing. It might come in handy to some of your readers that may be needing to decode a larger amount of passwords. The utility is available at my site: http://www.mannerud.org/software/toms-filezilla-password-recovery/ and automates the steps you outlined in your article.
LikeLiked by 1 person
11 May 2016 at 8:06
I never had a lot of passwords in Filezilla, but your tool seems to be useful if you have a lot of passwords! Good job!!
LikeLike
27 September 2016 at 13:50
Thank you Preruz. Been struggling with FTP after updating Filezilla, kept getting ‘cannot connect to server’. Wanted to go through everything on Site Manager to be sure it was correct but couldn’t check password. With your advice got to sitemanager.xml but there was no after and before … none anywhere! Still can’t update website.
LikeLike
10 February 2017 at 9:00
Did you solved it?
LikeLike
19 February 2017 at 8:21
Thank You! Its perfect …
LikeLike
20 February 2017 at 9:09
Wonderful, I love this kind of comments 🙂
LikeLike
22 March 2017 at 0:43
I’m afraid this was too tricky for me to understand. I tried but failed.
LikeLike
22 March 2017 at 7:28
Hi Russell, if you want I can help you. What did you try? Which step is too tricky for you? 🙂
LikeLike
13 April 2017 at 18:57
What do you do if it tells you the password is anon@localhost?
LikeLike
14 April 2017 at 8:05
Quite weird! Do you tried it as password?
LikeLike
17 April 2017 at 6:42
Great resource ! Thanks!
LikeLike
19 April 2017 at 8:09
Happy to read this! 😉
LikeLike
12 May 2017 at 13:30
Helped me to recover password. 🙂
LikeLiked by 1 person
12 May 2017 at 13:44
Perfect! 🙂
LikeLiked by 1 person
9 June 2017 at 12:46
Pass tag in not there in the xml file? how to find password.
LikeLike
9 June 2017 at 14:08
I think you never saved the password
LikeLike
30 August 2017 at 8:59
Thanks 🙂 helped a lot
LikeLike
30 August 2017 at 10:57
You’re welcome! 😉
LikeLike
8 November 2017 at 11:39
Thank you 🙂
LikeLike
8 November 2017 at 11:56
Glad to be useful 🙂
LikeLike
14 February 2018 at 16:33
Thanks for the tips, I didn’t know how to get to my encrypted passwords. By the way you can just type “%appdata%” in your explorer address bar and it will take you to the correct folder.
LikeLike
14 February 2018 at 16:35
Good tip! Thanks! 😉
LikeLike
13 February 2019 at 17:04
Simple Perl script, feed it the encoded string, spits back cleartext:
“`
#!/usr/bin/perl -w
use MIME::Base64 ();
$encoded = $ARGV[0];
$decoded = MIME::Base64::decode($encoded);
print “Encoded $encoded\nDecoded $decoded\n”;
“`
LikeLike
8 April 2020 at 18:50
So, does Filezilla still store passwords unencrypted? One of the great mysteries to me, why anyone would store access data to all of their websites without encryption …
LikeLike