JIRA Client stores usernames and passwords in the config.xml file in the JIRAClient folder in the user's home directory (e.g. "%userprofile%/JIRAClient/" on a Windows PC). The password is encrypted, however the encryption algorithm is very simple and the file itself is not encrypted. If the file is not protected well by the other means of OS and/or network security, it can be used by anybody who has access to it to connect to JIRA.
To our security conscious customers, we recommend using WebLogin feature, available in JIRA Client v. 3.8 and later. This way JIRA Client will not be storing any login information locally, but rather connecting to an active JIRA sessions managed by your web browser.
...