# FTP and SFTP

> Two ways to move files to and from a server; only one of them keeps them private.

- Level: Intermediate
- Topics: Networks
- URL: https://tidbit.legios.com.ar/ftp-and-sftp/
- In Spanish: [FTP y SFTP](https://tidbit.legios.com.ar/es/ftp-and-sftp/)

**FTP** (File Transfer Protocol) is one of the oldest services on the internet, older than the web itself. You connect to an **FTP server** with a username and password, see its folders, and upload or download files. For decades it was how people published websites to their web hosting, how printers dropped scans into shared folders and how companies swapped files with banks and suppliers.

Its big flaw is that it was designed before anyone worried about eavesdroppers. FTP sends everything as plain text, including the password, so anyone on the path, such as someone on the same café Wi-Fi, can read it. It also opens separate connections for commands (port 21) and for each file, which makes it awkward to get through firewalls and NAT.

**SFTP** is the modern replacement, and despite the name it is not FTP with security added: it is a different protocol that runs inside SSH, over a single encrypted connection, usually on port 22. Logins can use SSH keys instead of passwords, and the files travel encrypted. There is also **FTPS**, which is the old FTP wrapped in TLS, the same encryption HTTPS uses; it works, but keeps FTP's multi-connection complications.

In practice: if a provider or a partner asks you to send files 'by FTP', ask for SFTP. Many businesses still exchange daily files this way, and cloud services can offer an SFTP endpoint that stores everything straight into object storage like Amazon S3. For sharing with people, a link from a cloud drive is usually simpler.

## An analogy

FTP is mailing documents on postcards: they arrive, but every mail carrier on the way can read them. SFTP is the same documents in a locked courier bag that only the recipient can open.

## Keep in mind

- FTP sends passwords and files as plain text.
- SFTP runs inside SSH: one encrypted connection, usually on port 22.
- FTPS is FTP wrapped in TLS; similar goal, different protocol.
- If someone asks for FTP, ask for SFTP instead.

## Go deeper

- [File Transfer Protocol on Wikipedia](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
- [SSH File Transfer Protocol on Wikipedia](https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol)
- [RFC 959, the FTP standard](https://www.rfc-editor.org/rfc/rfc959)

## Related terms

- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.
- [Web hosting](https://tidbit.legios.com.ar/web-hosting/): Renting space on an always-on computer so your website is reachable by anyone.
- [Wi-Fi](https://tidbit.legios.com.ar/wi-fi/): Networking over radio waves: the internet without the cable, within a few rooms.
- [Port](https://tidbit.legios.com.ar/port/): The numbered door on a computer that says which program a connection is for.
- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [NAT](https://tidbit.legios.com.ar/nat/): How a whole home or office shares one public IP address on the internet.
- [SSH](https://tidbit.legios.com.ar/ssh/): An encrypted way to log in to another computer and type commands on it.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.