Password and form data is stored unencrypted within a WebCopy project file.

URIThe URL of the form to post, relative to the website URL. Supports regular expressions.
Form DataSpecifies the data that will be posted. One piece of data should be entered per line, in the format name=value.
EnabledIf the form is not enabled, it will not be posted when the scan/copy is performed
Merge ValuesIf this option is set, WebCopy will perform a GET on the specified URI and then extract the values of the INPUT, SELECT and TEXTAREA elements into the values to be posted to the page.
Form URIThe URI to read form values from, relative to the website URI. If this value is left blank, the URI field will be used instead. You can use this field where a login form is on one page, but the form posts to a different page.

If the Merge Values option is disabled, WebCopy will not be able to log into pages that either use validation cookies, or validation tokens based on hidden input fields in the source form that change per session. You can use the URI tester tool to test that you can successfully log into websites.