Are MySQL's database files encrypted?

Are MySQL database files that are stored on disk encrypted?

No, they are not.

You can (relatively) easily test this by moving .ibd or .myd files to a different system, where you can still read them. Or you can just open them and you will likely see at least some of the content of the tables in plaintext.

Some MySQL engines do provide optional encryption, such as innodb. MySQL enterprise edition also provides optional encryption.

Could I directly read the data from these files without knowing my MySQL username/password?

You bet.

I am considering to encrypt and decrypt the credentials in the application and store only the encrypted version in the DB, but is this necessary?

Don't store plaintext passwords in your database, and don't use symmetric encryption, either (if you do, then when your key gets stolen along with the encrypted passwords, you lost).

The way to store passwords (anywhere - it doesn't matter whether you store them in flat files, databases or somewhere else...) is to salt and hash them using a secure hash function. A hash function takes an input string and returns a fixed-length random-looking string as an output. You store this random-looking string in your database.

When you want to check whether someone entered the right password, you run the password through the hash function and check the resulting string against the string in your database.

This way, passwords aren't exposed (hash functions are one-way functions, which means that you can't inverse the hash function without tremendous effort).

Note that simply hashing the password isn't enough. You have to concatenate a random salt value to the password before hashing it and then store both the hash function output AND the salt value in your database. You need do to this for several reasons: 1. If you don't, then identical passwords will yield an identical hash value 2. Someone with some time on his hands could precalculate a table of hashed passwords (rainbow tables). Using a salt value makes this operation much more expensive.

There are hash functions available for hashing passwords, bcrypt for example. Use one of them instead of rolling your own. DON'T use a standard hash function such as md5 or sha1. They are all designed to be fast, which is the opposite of what you want in a password hash function (to make brute force attacks on your password file harder when it gets stolen).