ICT-Hotlist Topic

Back to the ICT-Hotlist...

How to retrieve your FTP passwords from FileZilla

By Johan van Soest.

Published : 2015-08-02.

Last updated : 2017-05-02.

You probably once got an e-mail with the FTP settings for a download site, entered the credentials in FileZilla, lost the mail and now someone else needs the FTP account. Or you got a new PC assigned and suddenly need to FTP a bug report, noticing your sites and passwords are not transferred to the new PC. Of course you can contact your ftp partner, fill out a few forms, send them in and wait a few days whilst your boss gets angry behind your back when the sales system grinds to a halt.
As you by now know from reading all the other tips, they do not work as FileZilla now encrypts the password in the configuration file.
These are the steps to get your password with the current versions of FileZilla.

Open the file explorer and paste the path %AppData%/filezilla in the address bar and open the file sitemanager.xml in Notepad or your favorite text editor (NotePad++)
Search for the section containing the ftp site. See for an example the next text box.

<Server>
  <Host>ftp.van_Soest.it</Host>
  <Port>21</Port>
  <Protocol>0</Protocol>
  <Type>0</Type>
  <User>Johan</User>
  <Pass encoding="base64">VGhpc0lzQVRlc3RQYXNzd29yZA==</Pass>
  <Logontype>1</Logontype>
  <TimezoneOffset>0</TimezoneOffset>
  <PasvMode>MODE_DEFAULT</PasvMode>
  <MaximumMultipleConnections>0</MaximumMultipleConnections>
  <EncodingType>Auto</EncodingType>
  <BypassProxy>0</BypassProxy>
  <Name>ftp://ftp.van_Soest.it</Name>
  <Comments />
  <LocalDir />
  <RemoteDir />
  <SyncBrowsing>0</SyncBrowsing>
  <DirectoryComparison>0</DirectoryComparison>ftp://ftp.van_Soest.it
</Server>

An example of a FileZilla server configuration.
You now can find the password in the line.
<Pass encoding="base64">VGhpc0lzQVRlc3RQYXNzd29yZA==</Pass>

Notice the encoding type "base64". This explains the encoding type used to encrypt the password.
Now open your favorite base64 decoding program. Every postmaster has one.

Use your favorite local base64 decoding program. This program keeps all data within the company walls and can do much more than the online variant demonstrated here.

Example of a tool to decode your passwords locally.

Copy everything between <Pass encoding = "base64"> and </Pass> into the text box.
Now click on the "Decode to Text" button and the Output box will show your FileZilla password in plain text.

Warning: The following steps use an internet website to "decrypt" the password. Please be aware of company policies implemented for transmitting passwords in plain text over the internet. Your company can prohibit this!
Go to the great website opinionatedgeek by Geoff Taylor and copy everything between <Pass encoding="base64"> and </Pass> in the text box.
Now click the button "Decode Safely As Text" and a new Decoded Output text box opens containing your FileZilla password in plain text.

Example of a decoded FileZilla password using the Opinionated Geek website. Please read your company policy about using passwords before transmitting passwords over the internet.

You may vote your opinion about this article:

Scripts and programming examples disclaimer

Unless stated otherwise, the script sources and programming examples provided are copyrighted freeware. You may modify them, as long as a reference to the original code and hyperlink to the source page is included in the modified code and documentation. However, it is not allowed to publish (copies of) scripts and programming examples on your own site, blog, vlog, or distribute them on paper or any other medium, without prior written consent.
Many of the techniques used in these scripts, including but not limited to modifying the registry or system files and settings, impose a risk of rendering the Operating System inoperable and loss of data. Make sure you have verified full backups and the associated restore software available before running any script or programming example. Use these scripts and programming examples entirely at your own risk. All liability claims against the author in relation to material or non-material losses caused by the use, misuse or non-use of the information provided, or the use of incorrect or incomplete information, are excluded. All content is subject to change and provided without obligation.