martin wrote:

Without a master password, passwords are not protected (cannot be). They can be retrieved anytime. The "generate code" functionality makes it only bit easier. But that's actually a plus, as it makes it clear to everyone that the passwords are not protected.

See also
https://winscp.net/eng/docs/security_credentials
https://winscp.net/eng/docs/faq_password

ok. Thank you

Without a master password, passwords are not protected (cannot be). They can be retrieved anytime. The "generate code" functionality makes it only bit easier. But that's actually a plus, as it makes it clear to everyone that the passwords are not protected.

See also
https://winscp.net/eng/docs/security_credentials
https://winscp.net/eng/docs/faq_password

martin wrote:

This is rather broad post.
What "encryption" are you referring to?
Are you using master password?

Hello,

Master password partially fix topic. See picture

Thank you

This is rather broad post.
What "encryption" are you referring to?
Are you using master password?

Hello,

I see security vulnerability. Generate session URL/code is able to decode encrypted password to plain text.

BR
ToldaCZ