WinSCP keeps your configuration in WinSCP.ini or the registry with site passwords obfuscated or, optionally, encrypted with a master password, and host names, user names and site names in plain text. With NixSCP Pro (free during the beta), NixSCP encrypts the whole configuration on disk with your NixSCP password, the same password that protects your synced data.
How it works
- Encryption turns on automatically once you set up or unlock cloud sync on a computer. There is no separate switch.
- NixSCP asks for your NixSCP password at startup, before it reads anything. Your recovery key works too.
- The key stays in memory only. Files use the same authenticated AES-256-GCM format as cloud sync, unlocked through Argon2id.
- Other programs on your computer, including AI agents, cannot read your sites or saved passwords from the file. This is also what Agent Access relies on.
What is encrypted
| Encrypted | Not encrypted |
|---|---|
nixscp.ini: sites, stored passwords, preferences, workspaces, bookmarks | The cloud state file: account e-mail, sign-in token, your data key wrapped with your password (useless without it) |
| The cached open tabs, team state, and the backups made before sync applies settings | The Agent Access audit log (site names and commands, never credentials or output) |
| Agent session recordings | known_hosts, private key files, session logs and temporary files |
The WinSCP master password is retired
With encryption on, the NixSCP password replaces the master password: an existing master password is removed and Preferences › Security says that the whole configuration is encrypted. Change the password in Pro › Cloud Sync Settings › Change NixSCP password....
Encrypted backup or WinSCP-compatible export
Login › Tools › Export/Backup Configuration... asks how to export:
- Encrypted backup (default): opens in NixSCP on any computer with your NixSCP password or recovery key. Safe to keep anywhere; WinSCP cannot read it.
- Plain file for WinSCP: a normal WinSCP configuration that WinSCP and NixSCP import. Passwords in it are only obfuscated, so keep the file private.
Import/Restore Configuration... opens both; a backup made with another password asks for that password or its recovery key.
Recovery key
Shown once when you set up sync on your first computer: 13 groups of 4 characters. It unlocks NixSCP at startup, nixscp-cli, encrypted backups and sync on a new computer. Without the password and the recovery key, nobody can open the encrypted files, not even NixSCP support.
Scripts and nixscp-cli
nixscp-cli prompts NixSCP password (or recovery key): when the configuration is encrypted (three attempts, then exit code 1). Unattended scripts that need no stored sites can use /ini=nul, or a separate configuration with /ini=<file>. The Agent Access commands never ask: they use the running, unlocked NixSCP.
Turning it off
After signing out, the Cloud Sync window offers Remove encryption from this computer.... NixSCP then stores the configuration like WinSCP again, with passwords obfuscated or protected by a master password. Signing in encrypts it again.
Questions or problems? See the FAQ, open an issue on GitHub or write to hello@codewizdev.com.