What is SFTP?

SFTP is a secure file transfer protocol that runs over SSH. It fills the same role as FTP, but it's a separate protocol designed by the IETF, not FTP with encryption bolted on (that variant is FTPS). In practice it feels much like FTP: you sign in with credentials and use a client to upload, download, edit, and delete files on your server.

The difference is what travels over the network. Plain FTP sends your username, password, and every file in readable text, so anyone positioned between you and the server can capture them. SFTP encrypts all of it from the moment it leaves your machine. Your login is handled by SSH itself: the server accepts a password or, more securely, an SSH key in its place, and some servers allow key-based logins only.

How SFTP works

SFTP usually runs as a subsystem of SSH version 2, so your login, commands, and files all travel through one encrypted connection on TCP port 22, the port IANA assigns to SSH. That single-port design keeps firewalls simple: if you can reach a server over SSH, you can usually reach it over SFTP, though an administrator can move the service to a nonstandard port. Plain FTP needs port 21 for commands plus separate connections for the data itself.

SFTP is also more than a copy tool. It works like a remote file system, so a client can browse folders, transfer files in both directions, and manage what's already on the server. The protocol first appeared in 1997 and was designed from the ground up by the IETF's SECSH working group, the same group that standardized SSH-2. The group's SSH File Transfer Protocol draft calls it the standard file transfer protocol for SSH-2, which is why SFTP shares a name with FTP but none of its machinery.

SFTP vs. FTP vs. FTPS

The three names look similar. The protocols aren't:

• SFTP is a standalone protocol built on SSH. One encrypted connection on port 22 carries logins, commands, and files.
• FTP is the 1971 original. It sends everything, your password included, in plain text over port 21 plus separate data connections. Firefox dropped FTP support in version 90 (July 2021), and Chrome removed it in version 95 later that year.
• FTPS is classic FTP wrapped in TLS encryption. It protects your data but keeps FTP's separate control and data connections, which makes firewall setup messier.

For web hosting, the decision is short: use SFTP whenever your host supports it, and reserve plain FTP for nothing. SFTP is the accepted replacement for FTP on security grounds, and it's what hosts actually offer.

How to connect with SFTP

You need 4 things, usually listed in your host's control panel: the server's hostname, your username, a password or SSH key, and the port (22 unless your host says otherwise). Enter them into a client such as FileZilla or Cyberduck, or run sftp username@hostname in a terminal, and you can browse and transfer files on the server. We've compared Cyberduck and FileZilla if you're choosing between them.

For a quick one-off edit, you may not need SFTP at all: your host's browser-based file manager changes a file with nothing installed. SFTP earns its place for bulk uploads, large files, and anything you want to script.

When SFTP won't connect

Most failed connections trace back to one of 5 causes. Check them in order:

• Wrong hostname or port. Confirm both in your host's control panel. A typo, or a network firewall blocking port 22, stops the connection before login even starts.
• SFTP access disabled. Hosts can restrict SSH or SFTP by plan or per user. Make sure it's turned on for your account.
• Rejected password or key. SFTP credentials can differ from your control panel login, and a key only works if its public half is installed on the server.
• Permission errors after login. The connection is fine, but the server's file permissions won't let your user read or write that folder. Fix them on the server, not in your client.
• A changed host-key warning. Your client remembers each server's SSH key and warns you if it changes. Don't accept the new key until you've verified its fingerprint with your host or administrator: the change can be a routine migration, but it can also be someone impersonating your server.