SFTP vs FTPS vs FTP: which secure file transfer protocol to use

Three protocols move files between a PC and a server under the name "FTP", and they are not interchangeable. FTP is the 1985 original with no encryption. FTPS is that same protocol wrapped in SSL/TLS. SFTP is a different protocol altogether that runs inside an SSH connection. Which one you use is usually decided by the server; which one you ask for, when you have the choice, is decided by firewalls, authentication and what the other side already runs.

FTP: the original, in clear text

FTP uses two connections: a control connection on port 21 for commands and replies, and a separate data connection for each listing or file transfer. In active mode the server connects back to the client for data; in passive mode the client opens the data connection to a port the server advertises. Everything, including the login and password, is sent in clear text, which is why FTP belongs only on private networks or for public anonymous downloads. See the FTP basics page for how the conversation works.

FTPS: FTP over SSL/TLS

FTPS keeps FTP's commands and two-connection design and adds TLS. Explicit FTPS connects on port 21 and the client sends AUTH TLS to upgrade the connection before logging in; implicit FTPS connects on port 990 and expects TLS from the first byte. A properly configured client also protects the data connection (PBSZ 0 and PROT P), otherwise listings and file contents still travel in the clear, and reuses the TLS session on data connections, which hardened servers require. Because the data ports are separate and dynamic, FTPS has the same firewall and NAT difficulties as FTP, plus the problem that a firewall cannot read the encrypted PASV reply to open the port. FTPS fits organisations that already run FTP servers and want encryption with minimal change, and it supports client certificates for authentication.

SFTP: file transfer inside SSH

SFTP is the SSH File Transfer Protocol, a subsystem of SSH-2. One connection on port 22 carries login, commands, listings and file contents, all encrypted, so there are no data ports to open and NAT is no problem. Authentication is by password, keyboard-interactive prompts or SSH keys, and the protocol has proper file metadata: sizes, times and permissions are part of the listing rather than parsed from text. Every Linux server with OpenSSH offers it. It is the default choice for anything new, and most hosting companies now hand out SFTP details rather than FTP.

Side by side

Which should you use?

Use SFTP when the server offers it, when you cross firewalls or NAT, or when you want key-based logins for automation. Use FTPS when the other side is an existing FTP server that has added TLS, or when certificate-based authentication is required. Use plain FTP only for anonymous public downloads or inside a private network where nothing sensitive travels. A client should support all three so that the server, not the client, decides; FTPShell Client does, in every edition, and makes the choice a session type: FTP, SFTP, FTPS Explicit or FTPS Implicit. See the SFTP client and FTPS client pages.

Questions people ask

Is SFTP more secure than FTPS?

Both encrypt properly when configured correctly. SFTP is harder to misconfigure because everything is inside one SSH connection, while an FTPS client that forgets PROT P sends file contents in the clear. SFTP also supports SSH key authentication natively.

What port does SFTP use, and what port does FTPS use?

SFTP uses port 22. FTPS uses 21 for explicit and 990 for implicit, plus the passive data ports. The port reference has the full list.

Is FTPS the same as "secure FTP"?

"Secure FTP" is used for both FTPS and SFTP, which causes real confusion. Ask the server administrator which one it is: TLS on port 21 or 990 is FTPS, SSH on port 22 is SFTP.

Is FTP still used?

Yes, for anonymous downloads, inside private networks and on older equipment such as printers and cameras, but hosting companies and partners increasingly require SFTP or FTPS for anything with a login.

Can one client handle FTP, FTPS and SFTP?

Yes. FTPShell Client's free Personal edition includes all three, with the same transfer queue, favorites and editor on each.

What is the alternative to FTP, what are the alternatives, and what can replace it as an FTP replacement?

For the same job, logging in to a server and moving files both ways, the alternatives are SFTP and FTPS, and SFTP is the usual FTP replacement because it needs one port and encrypts everything. For one-way distribution, HTTPS downloads do the job; inside a Windows network, an SMB file share; for exchanging files with people rather than servers, a cloud storage service. An FTP client that also speaks SFTP and FTPS lets you move server by server as each one adds the secure protocol.

FTP vs HTTP and HTTPS for file transfer, and HTTPS vs SFTP: which to use?

HTTP and HTTPS are built for a browser fetching pages and for downloads and form uploads, one file at a time, with no folder browsing, renaming or resume as standard. FTP, FTPS and SFTP are built for two-way work with folders: list, upload, download, resume, delete, change permissions. Between HTTPS and SFTP, both encrypt; choose HTTPS when the other side is a website or web service and SFTP when it is a server you administer or a partner's file drop.

FTP vs SMB: which protocol to use on a Windows network?

SMB is the Windows file-sharing protocol behind drive letters and \\server\share paths, with Windows permissions and in-place editing; it is the right choice inside one office network. FTP, FTPS and SFTP are the right choice between networks and over the internet, where SMB's port 445 is blocked and its exposure is dangerous. Many sites use both: SMB on the LAN, SFTP for anything that crosses a firewall.

Which is better, FTP or SFTP, and FTPS or SFTP, and which is the most secure and safe protocol: is FTP a secure protocol?

FTP is not a secure protocol: it sends the login, the password and every file in clear text. Between FTP and SFTP, SFTP wins on every count except speed on a trusted private network, where they are equal. Between FTPS and SFTP, both encrypt properly when configured correctly; SFTP is the safer default because it cannot be misconfigured into sending data in the clear and it needs no extra firewall ports, while FTPS is the right answer when the other side is an existing FTP server with TLS added or requires client certificates.

What is the fastest protocol for file transfer?

Over a given network the three protocols move bulk data at much the same speed; plain FTP avoids encryption work, but modern CPUs make that difference small. What changes throughput in practice is latency per file, which hurts transfers of many small files, and whether a client can resume, retry and run several sessions in parallel. FTPShell does all three, and the transfer summary and status bar show the rate so you can compare for yourself.

What about SCP: the scp command to transfer files, scp between servers, and how to move a directory?

SCP is the older copy command that ships with OpenSSH: scp file user@host:/path uploads a file, scp -r copies a directory, and scp user@a:/f user@b:/f copies between servers, routed through your PC with -3. It has no listings, no resume and no way to move a directory, only copy and delete. SFTP, which the same SSH servers offer, has all of those, which is why FTPShell uses SFTP for Linux and Unix hosts.