Member Avatar for huzeifa

I am working on a ftp client program and i wana know how to save password without creating a text file. If its possible to achieve this using xml or any other method please show me how.
If u have a project or sourcecode on this please upload it in to the following site:
<snipped url>

  • 4 Contributors
  • 3 Replies
  • 94 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by tux4life

Dani AI

Generated

Short summary: for an FTP client that must persist a user credential without leaving it in clear text, use the platform's secure secret store or a token-based flow rather than inventing your own file format. , and pointed to the right tradeoffs (threat model, local access). Below are concise, practical options and pointers to implement them safely.

Common secure choices (links to docs and libraries)

Practical implementation notes

  • Decide the real threat model first (local attacker, stolen backup, other users). That drives whether per-user OS protection is sufficient or you need hardware-backed keys or a user passphrase.
  • Prefer OS-managed stores so you do not handle raw keys. If you must encrypt yourself, derive a key with a KDF (PBKDF2/Argon2) and use an authenticated cipher (AES-GCM); require a user passphrase or a protected key blob.
  • Limit scope: store only what you need (username, minimal metadata, and the secret), restrict file/registry permissions, never log secrets, and avoid including secrets in backups unless encrypted with a machine/user-bound key.
  • Cross-platform apps: call the native store where available; fallback strategies on headless Linux may require prompting for a passphrase.

Troubleshooting and cautions

  • DPAPI/credential stores are often tied to a specific user or machine — blobs may not decrypt after a profile move.
  • If an attacker controls the OS (root/admin), any local secret can be extracted; treat local compromise as out-of-scope and plan mitigations accordingly.
  • For design guidance on storing secrets safely, see OWASP’s cryptographic storage guidance: Cryptographic Storage Cheat Sheet.

These choices keep key management simple and rely on battle-tested OS facilities rather than ad-hoc encryption in your own files.

Recommended Answers

All 3 Replies

Member Avatar for Ancient Dragon

If the destination machine is MS-Windows system, then you could encrypt the password and store it in the registry.

Member Avatar for Salem

Well the first question is "who are you trying to hide it from"?

At some point. you're going to have to decrypt it locally so that you can send it to the server "in the clear".

Member Avatar for tux4life

If you're on Windows, you could maybe store the password in the registry.
Edit::
BTW, if I remember good, then FileZilla standard stores the passwords in an xml file.
(FileZilla is written in C++, so you could maybe get your hands on the freely downloadable source code?)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.