FTPS client for Windows: FTP over SSL/TLS, explicit and implicit
FTPS is the classic FTP protocol with SSL/TLS encryption added, so the FTP servers you already have can keep running while logins, listings and file contents travel encrypted. FTPShell Client supports both forms, explicit and implicit, in every edition, and handles the negotiation details that make FTPS fail with other clients: data-channel protection, TLS session reuse and passive-mode addresses behind NAT.
Explicit or implicit, chosen per session
File > New FTPS Explicit session (Ctrl+P) connects on port 21 and upgrades the connection with AUTH TLS before the login. File > New FTPS Implicit session (Ctrl+I) connects on port 990, where the server expects TLS from the first byte. Both are pre-filled with the right port; both show a secure-session icon in the tab and the Favorites menu, and saved sites always reopen with their secure protocol.
Automatic negotiation with old and new servers
Explicit sessions try AUTH TLS, then TLS-C, TLS-P and SSL, including the legacy 334 reply, so servers of every age accept the upgrade. Both explicit and implicit sessions then switch the data channel to TLS with PBSZ 0 and PROT P, so directory listings and file contents are encrypted and not just the password. The data connection reuses the control connection's TLS session, which hardened servers such as vsftpd require before they will serve a listing. TLS 1.0 through 1.2 are negotiated, and the cipher list excludes export-grade, low-strength, MD5 and anonymous Diffie-Hellman suites and prefers the stronger ones.
Through routers, NAT and firewalls
Passive mode is the default. If the first listing after login fails, the other mode is tried once and the working mode is kept for the session. FTPS passive replies that carry a private NAT address, a common misconfiguration on servers behind a router, are corrected automatically. The connection problems page covers the cases that remain.
What works on an FTPS session
The transfer queue with recursive folders, resume (REST), duplicate rules, automatic retry and reconnect, transfer on connect and the summary; keep-alive commands every 120 seconds so idle sessions are not dropped; exact remote times with MDTM, uploads dated on the server with MDTM or MFMT, folder times preserved; 64-bit sizes for files over 4 GB; Compare/Synchronize, remote search, View Differences and the FTPShell Editor in the editions that include them; change permissions by checkboxes or CHMOD number; custom raw commands such as SITE. Transfers are always binary on FTPS.
Client certificates and automation
In FTPShell Script (Enterprise), certload loads a client certificate in PEM, DER or PFX/PKCS#12 form, with chains, for servers that authenticate clients by certificate; ftpconnectssl, ftpconnectssli and ftpconnectsslc choose explicit, implicit or encrypted-login-with-clear-data connections. The same scripts run from the ftpshellc console in ftps, ftpsi or ftpsc mode, so batch jobs gain TLS without changing their command files.
Questions people ask
What is the difference between FTPS explicit and implicit?
Explicit FTPS starts as a normal FTP connection on port 21 and the client asks for TLS with AUTH TLS; implicit FTPS expects TLS immediately on port 990. Explicit is the standard form today; implicit survives on older servers. FTPShell offers both as separate session types.
Which ports does FTPS use?
Explicit: port 21 for the control connection plus the passive data ports the server advertises. Implicit: port 990 for control and, by convention, 989 or the passive range for data. See the FTP, SFTP and FTPS ports page.
Does FTPShell encrypt the data connection, not just the login?
Yes. After the TLS handshake it sends PBSZ 0 and PROT P so listings and file contents are encrypted too, and it reuses the TLS session on the data connection as hardened servers require.
Is FTPS the same as SFTP?
No. SFTP runs inside SSH on port 22 and is a different protocol; FTPS is FTP over TLS. FTPShell supports both. When you can choose, the SFTP vs FTPS page explains the trade-offs.
Can I use a client certificate to log in?
In scripts, yes: certload accepts PEM, DER and PFX/PKCS#12 certificates with chains before an FTPS connect command. GUI sessions log in with a password.
Does the free edition include FTPS?
Yes. FTP, FTPS and SFTP sessions are all included in the free Personal edition, with no time limit, for non-commercial use.
Is FTPS the same as file transfer over SSL, FTP-SSL, FTPSSL, FTP with implicit SSL, AUTH SSL or AUTH TLS, and how is the encryption done?
Yes, those are all names for the same thing: FTP with an SSL/TLS layer. AUTH TLS and AUTH SSL are the commands an explicit session sends on port 21 to start encryption; FTPShell tries AUTH TLS first and falls back to the older forms. FTP with implicit SSL is the port 990 variant that encrypts from the first byte. In both cases the control connection is encrypted first and then the data connection is protected with PBSZ 0 and PROT P, so listings and file contents travel encrypted too.
What does 'this server does not support FTP over TLS', 'insecure server', or 'FTP over TLS is not enabled' mean?
The server answered the AUTH TLS request with an error, which means no certificate and TLS have been configured on it; some clients add the word insecure to make the point. Your choices are to connect with plain FTP, knowing the password and files travel in clear text, to try an implicit FTPS session on port 990 in case that is what the host set up, or to ask the host for SFTP, which most now provide. FTPShell shows the server's exact reply in the log so you can see which case it is.
How to set up and test an FTPS connection, setting up a secure FTP site on an existing server, and what a secure FTP URL looks like
Client side: File > New FTPS Explicit session (port 21) or New FTPS Implicit session (port 990), connect, and watch the log for the TLS negotiation and PROT P; a listing that arrives is the test. Server side, setting up a secure FTP site means installing a certificate and enabling TLS on the server; FTPShell Server does this for FTPS and SFTP. Secure FTP URLs are written ftps:// by convention, but browsers do not open them; in FTPShell the session type, not the URL, selects the protocol.