Where apps hide your files

FileZilla's sitemanager.xml and config folder

Updated 2026-10-28 · 6 min read

FileZilla stores your Site Manager and settings in a hidden folder in your home directory. Here is the path, how to export and back it up, and why that file should never be shared as it is.

The location

~/.config/filezilla

On a Mac, FileZilla's Site Manager is the file sitemanager.xml in that folder:

~/.config/filezilla/sitemanager.xml

FileZilla's source code picks this folder on a Mac the same way it does on Linux: ~/.config/filezilla, unless you have set XDG_CONFIG_HOME, or a very old install left a ~/.filezilla folder and no .config one, in which case it keeps using the old folder. The name starts with a dot, so Finder hides .config. To open it, choose Go > Go to Folder (⇧⌘G), paste the path and press Return, or from Terminal:

open ~/.config/filezilla

To list the names, sizes and permissions without reading anything:

ls -la ~/.config/filezilla

If the folder does not exist, FileZilla has not run on this account yet, you have a legacy ~/.filezilla folder, or you use FileZilla Pro from the Mac App Store, which is sandboxed (see below).

What is in the folder

File	What it holds
sitemanager.xml	The sites in your Site Manager, including folders you made, host, port, protocol and login type
filezilla.xml	Your settings from the Settings dialog
filters.xml	Directory listing filters
queue.sqlite3	The transfer queue
recentservers.xml	Recent Quickconnect servers, which can include saved logins

Other files appear as you use features, and names can change between versions, so run the ls -la command to see what yours holds.

Passwords: what the file contains

This is the part to know before you share or back anything up. By default FileZilla saves the password for a site, and in sitemanager.xml it is written as a <Pass> element with encoding="base64". Base64 is a way of writing bytes, not encryption: anyone who can read the file can turn it back into the password in seconds.

Since FileZilla 3.26.0 you can change that. Open Settings (FileZilla's menus list it under Edit; on a Mac look in the FileZilla menu), choose Interface, then Passwords, and pick Save passwords protected by a master password. Saved passwords are then stored encrypted (encoding="crypt"), and FileZilla warns that a lost master password cannot be recovered. Do not save passwords is the third choice.

So:

• Do not email, post or upload sitemanager.xml, recentservers.xml or an export file. They carry your hosts, user names and saved passwords.
• Do not put them in a public repository or a shared folder.
• Do not open the file to check it on a screen others can see. This guide never needs you to read it.

If you save a site with Ask for password as its logon type, no password is written to the file.

Export your sites the supported way

Choose File > Export. The Export settings dialog has checkboxes for Export Site Manager entries, Export Settings, Export Queue and Export Filters, then asks where to save a file named FileZilla.xml by default. There is no option to leave passwords out: the Site Manager part is a straight copy of your sites, saved passwords included, base64 or encrypted exactly as they are in sitemanager.xml. Save it to a private folder, not Downloads or a shared drive, and delete it once it has done its job.

To bring the sites back, use File > Import on the other Mac, or on the same Mac after a reinstall. If the passwords were protected by a master password, you need that master password to use them there.

Back up, in the right order

To back up or move your whole setup:

1. Quit FileZilla, so it does not rewrite files mid-copy.
2. Copy ~/.config/filezilla to a private location, such as an encrypted disk. The copy holds the same saved passwords (base64 unless you set a master password), so never put it in a shared or public cloud folder.
3. On the new Mac, install FileZilla, open it once and quit.
4. Copy your files in place of the new filezilla folder, then start FileZilla.

To restore the old state after a bad edit, quit FileZilla and put your copy back the same way. If FileZilla then complains that it cannot save its files, check with ls -la ~/.config that the filezilla folder exists and belongs to you.

Mac App Store edition

The edition sold through the Mac App Store is FileZilla Pro, the paid version. App Store apps are sandboxed and keep their data under ~/Library/Containers, so ~/.config/filezilla stays empty if that is all you use. The exact folder for that edition is not documented. A sandboxed app treats its container's Data folder as its home folder, so look there, possibly in the same .config/filezilla layout. To find the container, run:

ls ~/Library/Containers | grep -i filezilla

That prints only the container's name. The same hidden-folder and password warnings apply to the files you find inside it.

Share a setup without sharing logins

Because an export always carries the saved passwords, do not send one to a colleague. Write down the host, port, protocol and logon type instead and let each person create the site with their own login, using Ask for password or, for SFTP, their own key file. The SSH keys guide linked below covers where keys live.

Why a normal search misses it

.config is a dot-folder, which Finder hides, and Spotlight and Finder searches leave hidden folders out of normal results. The file name sitemanager.xml also tells you nothing about which app owns it.

Finding it again

Type sitemanager into Everywhere to see every copy of that file at once, including any export you saved and forgot, and filezilla to list the whole folder. Press ⌘T to open a Terminal in the folder where you can run ls -la. Hidden folders in your home directory are covered without extra setup. Everywhere matches names only and never reads the hosts or passwords inside.

Common questions

Where is sitemanager.xml on a Mac?

In ~/.config/filezilla/sitemanager.xml. The .config folder is hidden, so open it with Go > Go to Folder (⇧⌘G) or open ~/.config/filezilla in Terminal.

How do I export FileZilla sites on a Mac?

Choose File > Export, tick Export Site Manager entries and save the file (FileZilla.xml by default). The export includes saved passwords, so keep it private, and bring it back with File > Import.

Are FileZilla passwords encrypted?

Not by default: saved passwords in sitemanager.xml are base64-encoded, which anyone can reverse. Since FileZilla 3.26.0, choosing Save passwords protected by a master password under Settings, Interface, Passwords stores them encrypted instead.

Why is there no .config/filezilla folder on my Mac?

FileZilla may not have run yet, an old install may still use ~/.filezilla, or you use FileZilla Pro from the Mac App Store, which keeps its data under ~/Library/Containers. Run ls ~/Library/Containers | grep -i filezilla to look.