SFTP client for Windows: FTPShell Client over SSH-2

SFTP is file transfer inside an SSH connection: login, commands, directory listings and file contents all travel encrypted over one port, usually 22, which is why it is the protocol most hosting companies and security policies now ask for. FTPShell Client speaks SFTP in every edition, including the free Personal edition, with the same dual-pane browser, transfer queue, favorites and automation it offers for plain FTP.

Connecting

File > New SFTP session (Ctrl+F) opens a tab with port 22 pre-filled. Type the address, login and password in the quick-connect bar and press Enter. Saved sites reopen as SFTP automatically, carry a secure-session icon in the tab and the Favorites menu, and remember their last remote and local folders. If a connection attempt fails it is retried every 62 seconds up to 300 times by default, with the countdown in the log.

Logs in however the server is set up

Plain password login, keyboard-interactive (PAM-style) prompts answered with the saved password, and a fixed fallback order so logins succeed on differently configured servers. The server's pre-login banner is shown in the log. In FTPShell Script (Enterprise), public-key login with a passphrase-protected PEM key (RSA, DSA or ECDSA) is loaded with pkeyload before ftpconnectssh, and SFTP can be tunnelled through an authenticated HTTP CONNECT proxy with proxyhttp.

Talks to current OpenSSH servers

Key exchange with Diffie-Hellman group14 and group-exchange (SHA-1 and SHA-256) and ECDH on the P-256, P-384 and P-521 curves; host keys ssh-rsa, rsa-sha2-256, rsa-sha2-512 and ECDSA nistp256/384/521 (and ssh-dss for old hosts); AES-128, AES-192 and AES-256 in CBC and CTR modes; HMAC-SHA2-256 and HMAC-SHA2-512 alongside SHA-1 and MD5 for older appliances; server-initiated rekeying handled mid-session; SFTP protocol version 3. That covers today's Linux distributions and the appliances that still run older SSH stacks.

What works on an SFTP session

Everything the transfer queue does: recursive folder transfers, resume by file offset, duplicate rules by size or date, automatic retry and reconnect, transfer on connect and the end-of-run summary. Listing times come from the server and uploads set the local date on the server with SETSTAT, so folder and file times stay meaningful; sizes and offsets are 64-bit, so files over 4 GB report and resume correctly. Compare/Synchronize, remote search (up to 999 folder levels, with symbolic-link loops detected), View Differences and the FTPShell Editor all work on SFTP sessions in the editions that include them. Transfers are always binary on SFTP. Two FTP-only conveniences do not apply: server-to-server (FXP) transfers and per-session speed limits.

Automating SFTP

Scheduled tasks (Professional and Enterprise) run SFTP uploads, downloads and queue runs at a time you set, once or repeating. FTPShell Script (Enterprise) connects with ftpconnectssh, verifies transfers by CRC, MD5 or SHA-1, mirrors folders with syncrun and backuprun, encrypts files with OpenPGP and emails a report; the ftpshellc console runs the same scripts and ftp.exe-style command files in sftp mode from batch files, with exit codes for your scheduler. See FTPShell Script and the command-line client.

Editions

SFTP sessions, the transfer queue, favorites, the editor and logging are in the free Personal edition. Scheduling, folder sync and remote search are Professional; scripts, keys, PGP and the console are Enterprise. Download the 30-day Enterprise trial or compare the editions.

Questions people ask

Is SFTP the same as FTPS?

No. SFTP is a file-transfer subsystem of SSH on port 22; FTPS is classic FTP wrapped in SSL/TLS on port 21 (explicit) or 990 (implicit). FTPShell Client supports both; the SFTP vs FTPS page explains when each is the right choice.

Which port does SFTP use?

Port 22, the SSH port, for everything. There are no separate data connections and no passive-mode port ranges to open in a firewall, which is one reason SFTP connects where FTP struggles. The port reference lists all of them.

Does the free edition include SFTP?

Yes. The Personal edition includes FTP, FTPS and SFTP sessions with no time limit, for non-commercial use.

Can I log in with an SSH key instead of a password?

In scripts, yes: pkeyload loads a passphrase-protected PEM private key (RSA, DSA or ECDSA) for ftpconnectssh. GUI sessions use password or keyboard-interactive login.

Can I open a file on the SFTP server and edit it?

Yes. Remote > Direct edit downloads the file to a temporary copy, opens it in the FTPShell Editor, and Save uploads it straight back to the same path. View Differences (Professional and Enterprise) compares the local and server copies side by side and merges changes.

Does FTPShell work as a Windows SCP client?

FTPShell transfers over SFTP, the file-transfer protocol that OpenSSH servers expose alongside SCP. For copying files to and from Linux servers that is the protocol to use; it supports resume, listings and folder operations that SCP does not.

How to download or upload files through SSH, to or from a local folder, with a secure SSH file transfer client

Downloading files through SSH means SFTP. Open File > New SFTP session, connect, browse to the server folder in the upper pane and the local folder in the lower pane, select the files and choose Download or Upload. The transfer runs inside the SSH connection on port 22, resumes if it breaks, and keeps the server's modification dates. Nothing else has to be installed on either side as long as the server runs an SSH service with the SFTP subsystem, which every OpenSSH server does.

How to download or upload a whole folder over SFTP: get, put, mget, mput, pull and recursive transfers

In the GUI, select the folder and choose Download or Upload; FTPShell walks every subfolder, creates missing folders on the other side and queues the files. In the ftpshellc console, get and put move one file, mget and mput move every file matching a wildcard in the current folder; for a whole tree with its subfolders use the GUI or a script's ftpdownload and ftpupload commands, which are recursive. Pulling a server folder down to a local copy on a schedule is the download-sync feature in Professional and Enterprise.

Is FTPShell an SSH2 SFTP client, and which SFTP authentication methods does it use: password, public key or key authentication?

Yes, SSH-2 only, with SFTP protocol version 3, the version every server speaks. In the GUI the authentication methods are password and keyboard-interactive, tried in a fixed order so the login succeeds on differently configured servers. Public-key authentication, with a passphrase-protected PEM private key in RSA, DSA or ECDSA form, is available to FTPShell Script and the console in the Enterprise edition through the pkeyload command.

How to set up, setup, configure, access and test an SFTP connection to an SFTP site, with or without a config file, and what the Pro edition adds for SFTP

Choose File > New SFTP session, type the address, login and password, press Enter; the log shows the server's banner and the listing confirms the connection, which is the test. Add to favorites saves it with its options, so there is no config file to edit; FTPShell keeps every saved site in its own settings file and you can export the list to move it to another PC. The Professional edition adds the same automation to SFTP sessions that it adds to FTP: scheduled tasks, Compare/Synchronize, remote search, manual transfers and upload to all sessions.

Is SFTP encryption in transit safe over the internet, and does SFTP use SSH, TCP, or an SSH tunnel for FTP?

SFTP is file transfer inside an SSH-2 connection, so login, commands, listings and file contents are encrypted in transit with the key exchange, host-key and cipher algorithms listed above, which is what makes it the protocol to use over the internet. It runs over TCP on port 22. It is not FTP pushed through an SSH tunnel; FTPShell does not tunnel plain FTP through SSH, because an SFTP session gives the same result with none of FTP's extra data connections.

Explain SFTP: what it stands for, understanding how it works, and the SFTP information in the log, including client logging

SFTP stands for SSH File Transfer Protocol. The client opens one SSH connection to the server, authenticates, then asks for the sftp subsystem; from then on every request, such as open a folder, read a file or set a date, travels as an encrypted message over that one connection. In FTPShell the session log shows the server's banner, the login steps and each transfer, with passwords hidden; a per-site log file with timestamps can be switched on in Session options, and script runs can write a rolling log file.

Is there a fastest or modern SFTP client for Windows, and a terminal SFTP client in the Windows terminal?

Transfer speed over SFTP is set mostly by the server and the network, so the differences between clients come from resume, retries and running several sessions at once, all of which FTPShell does. Its SFTP stack is current: SHA-256 key exchange, ECDH, rsa-sha2 host keys, AES-CTR and HMAC-SHA2. For a terminal, the ftpshellc console client (Enterprise) runs in the Windows Terminal or any command prompt in sftp mode with the usual get, put, mget and mput commands.