If you don't want to type your username and password everytime you do a pull or push to mercurial, you have to store your credentials somewhere. On windows, the commandline
hg does not store credentials (you have to enter them every time). If you configure credentials in TortoiseHG, the username and password will be stored in plain-text, in mercurial.ini file. This is not the most secure way to do it, and mercurial will even warn you about that.