To learn when and how passwords are saved to stored session and remembered in memory please read:
https://winscp.net/eng/docs/security_credentials

If you do not specify password on login dialog, you'll be asked for it during authentication. Then the "save session" command does not save the password.

Version 3.8.2

I see that when creating a new session I can enter the host and username and specify the local and remote directories, w/o saving the password. However, many of our users don't know the correct path to type in when creating a new session. They can create a session (w/o password), then login, then navigate to the local and remote directories (which seems easier for them to do rather than typing in the paths) and then save the session again, but now the password is also saved with the session. Is there a way to save connection directories w/o saving password for session?

Thanks,
Karen