How do I forget a saved FTP password?

Open Site Manager in FTP by Zaweba, select the site, press Forget saved next to the password and then press Save. The stored password is removed, and the next time you connect to that site you will be asked to type it in. Nothing else about the site changes.

It takes seconds. Knowing why you might want to do it, and what the app does with passwords the rest of the time, helps you decide when it's worth bothering.

Reasons to clear a password

The common one is a password change. Your host or a colleague resets the account password, the old one stops working, and you want the app to forget it rather than keep trying a value that no longer opens anything.

Another is a shared or borrowed PC. If you set up a client's site on a machine you won't be using again, clearing the password before you leave is good practice even though, as described below, it can only be opened from your own Windows account.

A third is simply tidiness. Sites you no longer look after can be deleted outright in Site Manager, but sometimes you want to keep the settings (the host, the folders, the exclusions) for reference while making sure nobody can connect with them by accident.

Step by step

Open Site Manager from the File or Site menu with Manage Sites. The list of sites is on one side and the selected site's details on the other.

Choose the site. Next to the password box you'll find Forget saved. Press it. Site Manager now shows the site as having unsaved changes, which is your reminder that nothing has been written yet.

Press Save. That's the step people miss. Until you save, the change is only on screen.

Connect to the site again to check. The app should now ask for the password. You can type it in for this session, or enter the new password in Site Manager and save, if you do want it kept.

How saved passwords are protected

FTP by Zaweba stores passwords with Windows DPAPI. In plain terms, Windows itself locks the password to your Windows account on that particular PC. Another account on the same machine can't open it, and nor can anyone who copies the app's files to a different computer. Key passphrases for SFTP are stored the same way.

That is why forgetting a password is a choice rather than a necessity for most people. On your own PC, behind your own Windows login, a saved password is reasonably safe. Clearing it is about changed details, shared machines and personal preference.

Passwords versus trusted server keys

Site Manager has a second Forget button for SFTP sites, and it does something different. Forget next to the trusted server key drops the record of the server's identity, so the next connection asks you to confirm the server's key again. It doesn't touch your password.

Use it when your host tells you the server has changed. Don't use it as a way of clearing your own login, because it won't.

Moving sites without their passwords

If what you really want is to take your sites to another PC and leave the passwords behind, Site > Export Site Settings already does that unless you ask otherwise. Passwords and private key files are only included when you tick that option and set an export password, in which case they are encrypted with AES-256-GCM. Leave it unticked and the file holds every setting except the secrets. The DPAPI data itself is never written out.

A quick habit for anyone who hands sites over to clients or colleagues: export without passwords, send the file, and tell them the password separately. They import it, type the password once in Site Manager, and their copy of FTP by Zaweba protects it under their own Windows account from then on.