Where does WinSCP store site's password?

Try this method.

login into your saved session

go to session menu

click on generate URL

only check username and password options (If you need current directory path click on this option aswell)

You have multiple options, URL/Script/.Net Assembly, select desired.

click on copy to clip board.

it will contain username and password.

thats it.

This is a simplified version of Cesar's excellent answer and assumes your password still works in SCP.

Create a batch file called echo.cmd that contains the following:

echo %*
pause

Place it on a suitable place, such as your desktop.

Fire up WinSCP and connect to your site. Click on Options -> Preferences:

On the Preferences dialog, go to Integration -> Applications. Replace what was previously in the PuTTY path with the path to your newly created echo.cmd batch file. Also select the option:

Remember session password and pass it to PuTTY (SSH)

Click OK.

Now launch PuTTY from within WinSCP.

Your previously stored password should now be displayed on the screen!

The configuration file is stored either in the Windows registry or, if you are using the portable version, in an INI file. (See the documentation.) The registry location is:

HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2

You can always export the settings to an INI file by pressing Export in the preferences dialog.

Note that your passwords are not stored in text, but encoded. Though difficult to decrypt, it is not impossible.