Can I back up my FTP site list with passwords?

Yes. In FTP by Zaweba, Site > Export Site Settings saves one site or all of them to a .zftpsites file, and you can tick an option to include passwords and private key files. When you do, you choose a password of at least eight characters, type it twice, and the secrets are encrypted with AES-256-GCM before anything is written to disk.

So a full backup, logins and all, is one export away. Here is how to do it well, and how to get it back.

What goes into the file

The export holds every setting a site has: the host, port, protocol, user name, remote and local folders, the public address, the trusted host key, scan connections for Disk, protected path settings and your exclusion patterns. A site restored from it behaves as it did before, down to the files it ignores.

Passwords and private key files are the optional part. Leave the box unticked and the file contains everything except those. Tick it and they're added, locked under the password you choose. The encryption key is made from that password with PBKDF2-SHA256 at 600,000 rounds, which makes guessing slow for anyone who gets hold of the file.

One thing is never written: the Windows DPAPI data that protects passwords inside the app. That protection is tied to your Windows account on one PC and wouldn't work anywhere else, so the export carries its own encryption instead.

Making the backup

Choose Site > Export Site Settings. Pick whether to save the current site or all sites. Tick Include passwords and private key files if you want them, then enter your export password twice. Choose where to save the .zftpsites file.

Pick a password you'll still remember in a year, or store it somewhere safe that isn't the same folder as the backup. A file you can't open is no backup at all.

Keep the file somewhere off the PC as well: a USB stick, a second drive, or whatever you already use for backups. If the PC dies, a copy on its own disk doesn't help.

Restoring on the same PC or a new one

On the PC you're restoring to, choose Site > Import Site Settings and pick the file. You'll see the same kind of preview the CSV import shows, a row for each site with its status, before anything is added. If the file holds passwords, you'll need the export password to open them.

A site with the same name as one already in Site Manager is updated rather than duplicated. That's handy when you're refreshing a second machine from your main one, and worth knowing before you import over sites you've changed since the backup was made.

Once imported, passwords are looked after by the app on the new PC, protected under that Windows account just as if you'd typed them in yourself.

When to leave passwords out

Sending sites to a colleague or handing a site over to a client is a different job from a backup. There, leaving passwords out is usually the right call. They import the settings and type the password in Site Manager themselves, so it never travels in a file.

A CSV export is also offered as an alternative. It's useful for reading the list in a spreadsheet or bringing sites into another tool, but treat it as a reference list rather than a secure backup.

A sensible routine

Export all sites with passwords after you add or change a few, and keep the last two or three files. If you look after a lot of client sites, put the date in the file name so you can see which is newest. And when a password changes, update it in Site Manager first, then export, so the backup never holds a login that no longer works.