Should I use FileZilla?

FileZilla per se isn't inherently insecure. Yes, it's storing passwords in plaintext, but the alternatives are only slightly more secure. You see, encrypting the credentials requires an encryption key which needs to be stored somewhere. If a malware is running on your user account, they have as much access to what you (or any other application running at the same level) have. Meaning they will also have access to the encryption keys or the keys encrypting the encryption keys and so on.

Your best option here is to disable password storage in FileZilla

disable-password-save-filezilla

Then start using KeePass to store your account credentials. There are also many guides on the Internet about how to integrate KeePass with FileZilla. Doing this, you're storing the encryption key somewhere where malware don't have access; you're storing the encryption key (or rather, the password from which the encryption key is derived) in your brain.

Finally (and perhaps this is a bit outside the scope of your question), please make sure you move away from FTP in favor of SFTP.


Unless your alternative has an option where you need to provide a password (which is used to encrypt your settings containing IPs and credentials), I wouldn't see why you would need to migrate away.

If you are migrating from one application to another, you need to make sure why (in detail) the new application is better than the previous application.


I think one of the main reason people advise to move away from Filezilla is clearly the fact passwords are stored as plain text and thus, easilly stolen. Filezilla bad reputation began some years ago when some malwares began to target specifically Filezilla. Using critical flaws in third party softwares (namely flash and acrobat reader) these malwares were able to steal the XML passowrd file Filezilla uses to store the passwords. Most of the time, these malwares were eradicated and cleaned in a few seconds, but the data was stolen. These stolen credential files were then handled in a very complicated bot zombie network which connected to each and every ftp contained in the file, scanned it then propagated malware in every index.html/php file found on these FTP. In less than 2 hours, all the ftp websites stored in filezilla were infected. At the time, the process has been very well documented by some victim webmasters.

Probably thousands of webmasters, tens of thousands of websites, were infected because of this. Many many complained about the fact the passwords were not encrypted.

The second reason people advise to move away from Filezilla is the reaction of the developper team : instead of adding this feature, they just refused every argument, either sending back the responsibility to badly secured systems or pretending that encrypting passwords would not change anything, that it was system's responsibility to secure data.

So for now, if you still want to use Filezilla (which is a good ftp client) you really should consider disabling all password storing options and using a third party tool like Keepass. It's a bit of a pain in the * but it's safer. You may even find bonus advantages with Keepass because you'll have a tool to centralize cross-protocol credentials in a safer way