Filename is cleartext.

Thanks, I won't use it then.

Usernames are not secrets. If you're taking tons of considerations for encrypting your usernames, your security model is just plain wrong, and you will be strongly disappointed when you survey the rest of the landscape (web browsers, email clients, web sites, keychains...). There's another HN post about this on a different thread. Alternatively, don't put sensitive data in the file name component.

What the hell? You can't encrypt filenames. I don't know where the hell you got the idea that you can.

By "encrypted filenames" what people are clearly talking about is making it so unauthorized people can not infer from the filename of a password file what website that password is for.

For instance, to store the password for www.example.com, the filename could be derived by encrypting the website name (www.example.com) with AES using the user's master password, base 64 encoding the output, and using that for the filename.

Have you seen encFS?

Filenames readable in cleartext is a security issue. This means whoever has access to your files knows you have accounts on certain websites they are looking for.

You could store the password files in an encFS mount