It isn't. The correct decision would be to save the password in the operating system keychain, like Empathy does (or Messages on Mac, or name any others). Browsers also use keychains. On Windows, you can use the Crypto API to obtain an intermediate level of security.