Articles from July 2007 - Lorenz Cuno Klopfenstein

This weekend I needed to access a website via FTP from my laptop computer. Unfortunately, the password was stored only in the Filezilla "site manager" of my desktop PC and I had no copy of it in clear-text (since Filezilla ciphers all of its password...). If you ever have this kind of problem when using Filezilla, I hope you'll find the small program I wrote useful!

Anyway all credit goes to Peter's Blog for the original deciphering code.

Note: Filezilla 2 stored all settings as ciphered strings either in the Filezilla.xml or in the Windows registry. This is not the case for FileZilla 3.0. Apparently they dropped the password ciphering stuff in the new version and passwords are simply stored in clear text. I can't say if this is good or bad (the original ciphering wasn't very strong anyway), but at least it's easier to get to your password once you forget them...

Filezilla Password Decoder screenshot However, if you're still using FileZilla 2, the passwords are very simple to decode: open the XML file or the registry and extract the keys of the program; copy and paste the ciphered values into the form and click on "decode".

The code

public string Decode(string sCrypt) {
    const string sKey = "FILEZILLA1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    int cPass = sCrypt.Length / 3;
    int cOffset = cPass % sKey.Length;

    string sDecoded = "";

    for (int i = 0; i < cPass; ++i) {
        int a = Int32.Parse(sCrypt.Substring(i * 3, 3));
        char b = sKey[(i + cOffset) % sKey.Length];

        char c = (char)(a ^ b);

        sDecoded += c;
    }

    return sDecoded;
}

Download

Executable without installer. Needs the .NET 2.0 framework (x64) in order to run (or Mono if running on Linux).

Download the Filezilla Password Decoder (6.32 KiB)