SFTP vs SCP vs FTP: what's the difference, and which port each uses

SFTP runs inside an SSH connection. It isn't FTP over SSH and has nothing to do with FTP: it's its own protocol, made for files. Besides copying, it can list folders, rename, delete, change permissions and resume a transfer that stopped, which is why graphical file managers use it.

sftp admin@files.example.com
sftp> put report.pdf          # upload
sftp> get backup.tar.gz       # download
sftp> ls -l                   # list the server's folder
sftp> bye

Every server with OpenSSH has SFTP turned on, so if you can SSH in, SFTP works with the same account and keys. The SFTP guide has all the commands; to run your own, see how to set up an SFTP server.

SCP also rides on SSH. It does one thing, copy, in a single command, which makes it handy in a terminal or a script:

scp report.pdf admin@files.example.com:/srv/share/
scp admin@files.example.com:/var/log/syslog .
scp -r photos/ admin@files.example.com:backup/
scp -P 2222 report.pdf admin@files.example.com:/tmp/    # capital -P for the port

The old SCP protocol is limited (no listing, no resume) and has had security problems with tricky file names. Since OpenSSH 9.0, the scp command uses the SFTP protocol underneath, so you keep the familiar command with SFTP's behavior. scp -O falls back to the old protocol for servers that don't have SFTP.

SSH is the secure connection itself: a terminal, commands, tunnels. SFTP is one of the services that runs inside it, for files. You don't choose between them; SFTP needs SSH. That's also why SFTP uses SSH's port, 22 by default, and why changing the SSH port moves SFTP too.

FTP is from the 1970s. It uses one connection on port 21 for commands and opens more connections for the data: in passive mode, the server listens on a range of extra ports. That makes it awkward behind firewalls and routers, and plain FTP sends the user name, password and files unencrypted.

FTPS adds TLS to FTP. It comes in two forms:

• Explicit FTPS: connects on port 21 like FTP, then switches to TLS before signing in. Most servers use this.
• Implicit FTPS: TLS from the first byte, usually on port 990.

FTP still turns up on web hosting, printers, scanners, cameras and older systems. If a device only offers FTP, use FTPS when it can, and keep plain FTP on your own network. To run one yourself, see how to set up an FTP server on Windows.

• The server has SSH: SFTP. One port, encrypted, works with keys, and every SSH server already has it.
• A quick copy in a terminal: scp (it uses SFTP underneath on current OpenSSH).
• Syncing a big folder again and again: rsync over SSH.
• The host or device only offers FTP: FTPS if it supports it, plain FTP only on a network you trust.
• Reaching it from outside your network: SFTP is far easier, because it needs one port instead of a range, or none at all if you connect through a computer that's already there.

The RemoteAccessApp SSH and SFTP client opens SFTP and FTP hosts in two panes: your PC on one side, the server on the other, with drag and drop both ways. FTP hosts have an Encryption setting for plain FTP, FTPS with explicit TLS or FTPS with implicit TLS, and the server's certificate is checked before your password is sent. You can also copy straight from one server to another, or upload the same files to several servers at once.

SSH and SFTP hosts on your home or office network can be reached through one of your own PCs there, with no port forwarded. FTP can't go that way, because it opens a new connection for every file. It's free on Windows and Linux for up to 5 saved hosts: download RemoteAccessApp. Comparing clients? See the SSH client checklist.