To learn when and how passwords are saved to stored session and remembered in memory please read:
https://winscp.net/eng/docs/security_credentials

Thanks...

This issue has been added to tracker.

This is fixed already. The new version will as well allow saving the session without password (although entered), using new button on the warning message dialog.

However seeing your solution, I guess I like the "checkbox" approach better. I'll reconsider my implementation :-)

Usually we warn about saving password when we save session
I found a path where we dont warn....
(test this in Norton Commander mode)

1. launch winscp406.exe
2. on the left tree click "Session"
3. enter host name, user name, *PASSWORD*
4. Click Login, (result: successfully logged in)
5. on menu "Session > Save Session..." and save session
6. exit WinSCP
7. re-launch winscp406.exe
8. click the session name we just saved.
9. Click login

Result:-
WinSCP will login without asking password

Expected:-
on step 5 WinSCP should be warning about saving password.
and give an option to avoid it.


Enhancement suggestion to save session dialog.....
(actually by default save password UNCHECKED)

============ Save session Dialog ==============
|
| Save session as:
| [ blah@blah.com__________________ ]
|
| [x] save password (not recommend) (why ?)
|
===============================================

this will also solve https://winscp.net/forum/viewtopic.php?t=5242