Perhaps this is just a pet peeve of mine, but it really bugs me that I'm able to reconnect to a bookmarked SFTP server without a password *days* after my last login, so long as Cyberduck wasn't restarted in the meantime.
Is the cached password actually written to disk? Or is it just held in RAM? Or is it simply remembering some sort of a login token?
Regardless, it seems redundant to have Cyberduck cache this information. If people want the passwords remembered, they can store it in the keychain.
The password is cached as long as you don't close the browser window. It should however also be deleted if you connect to another server using the same browser window. This is missing and is a bug.