So please provide step-by-step instructions for reproducing the issue with both the options turned off.

Actually no, "Remember session password and pass it to PuTTY" is unchecked
app version is 6.5 build 16288

@alexis: You might have "Remember session password and pass it to PuTTY" enabled. Have you?
https://winscp.net/eng/docs/ui_pref_integration_app

I am also a bit confused with 'Remember password for duration of the session' setting in
https://winscp.net/eng/docs/ui_pref_security.

Uncheck the Remember password for duration of the session checkbox to avoid your password (or private key passphrase) being stored in the memory for a duration of the session.

Maybe I am getting it wrong, but how I still can see password in 'Generate session URL/code' window when password should not be stored in memory after authentication?

I have added this request to the tracker:
Issue 2280 – Optionally prevent revealing passwords on the Generate URL/Code dialog
You can vote for it there.

+1 for this.
Right now Generate session URL/Code allows the passphrase to be seen in clear text when using passwordsfromfiles. Is there a way to display the actual code as C:\tmp\pass.txt or as the OP said, a way to disable this button via argument/regedit?

Command :

In Generate Code:

It would be better like:

Ok, I'll consider it.
Though are you aware, that this is security through obscurity, right? Once the password is in local machine memory, there's nothing that can prevent the user from retrieving it. You can only make it more difficult.

Hi again, Martin, thank you for your answer!
I figured out how to use secured pipe for authentication.
Is there a chance that you will add possibility to disable 'Generate session URL' via some registry key or command line parameter?

A password file can be read by anyone too.
You would have to use a named pipe to make it somewhat secure.
Only then it would make sense to ask for WinSCP not to be able to reveal the password. And even then, only if you use an encrypted connection.

Oh, thanks, I see that
if I will use password from file option?

Well then anyone can see the password in the Task Manager anyway.

Via command-line option.
For example

(or with private key path)

So how are you passing the password to WinSCP?

Yes, exactly.
I need to give endpoint access for some user without giving credentials.
Perform automated connect, after that user should not be able to access password.

I'm not sure I understand what you are doing.
Are you starting WinSCP with some command-line parameters that automate the login (including the password)?

Greetings!
I am working on automation of launching WinSCP (GUI) and connecting to server for some user, that should not be able to access session password or key passphrase.
I disabled password storing using correspond registry value, but it is still possible to get password using "Generate session URL/Code".
Maybe you can help me, is there a way to totally prevent accessing password for session?