Why does my Subversion client cache passwords in plain text on disk?

On UNIX/Linux, there are no standard system encryption facilities, so the password is stored as text in ~/.subversion/auth/.

Notice, however, that the directory that contains the cached passwords (usually ~/.subversion/auth/) has permissions of 700, meaning only you can read them.

You can turn off password caching to avoid them being stored.

In svn 1.0 client, set store-auth-creds = no in your run-time config file. With an svn 1.1 client or later, you can use the more narrowly defined store-passwords = no (so that server certs are still cached). More information on password caching is in Chapter 6 of the Nightly Build Subversion book, under "Client Credentials Caching".

On Windows 2000 or later, svn 1.2 and above uses standard Windows APIs to encrypt the data, so only the user can decrypt the cached password.

On Mac OS X, svn 1.4 and later uses the system Keychain facility to encrypt/store your svn password.