You need to upload a few files to a server. Someone hands you a host, a username, a password, and the word "FTP." Twenty minutes later you're staring at three near-identical acronyms — FTP, FTPS, SFTP — a client asking about "passive mode," and a connection that hangs forever. The names look interchangeable. They are not. Two of them are secure, one is from a more trusting era of the internet, and one of them isn't really FTP at all. Here's the whole picture.
Three names, two completely different families
Despite the shared letters, these protocols come from two unrelated lineages:
| Protocol | Full name | Built on | Default port | Encrypted? |
|---|---|---|---|---|
| FTP | File Transfer Protocol | its own 1971 design | 21 (+ data) | No |
| FTPS | FTP Secure | FTP wrapped in TLS | 21 / 990 (+ data) | Yes (TLS) |
| SFTP | SSH File Transfer Protocol | SSH | 22 | Yes (SSH) |
The key surprise: SFTP is not FTP with an S bolted on. It's a completely different protocol that rides inside an SSH connection. FTPS is old FTP with TLS encryption added. So FTP and FTPS are cousins; SFTP is the odd one out — and, for most people, the best one.
FTP: the original, and why it's risky
Plain FTP is genuinely ancient and beautifully simple — which is exactly the problem. It sends everything in cleartext, including your username and password. Anyone able to watch the network between you and the server sees your credentials in plain view. On a coffee-shop Wi-Fi or any shared network, that's a real risk.
It also has an awkward design quirk that trips up almost everyone: FTP uses two separate connections.
- A control channel (port 21) carries commands like "list this folder" or "send this file."
- A separate data channel carries the actual file bytes.
How that second channel gets opened is where things break.
Active vs passive mode (the part that hangs)
This single concept explains 90% of "FTP won't connect" tickets:
| Mode | Who opens the data connection | Plays nicely with firewalls/NAT? |
|---|---|---|
| Active | The server connects back to the client | No — the client's firewall usually blocks the incoming connection |
| Passive | The client opens both connections | Yes — almost always the right choice |
In active mode, the server tries to reach back to your machine to deliver data. If you're behind a router doing NAT (everyone at home is), that inbound connection gets dropped, and the transfer hangs after "connected." In passive mode, your client makes both connections outbound, which firewalls allow by default. The fix for a mysterious FTP hang is almost always: switch to passive mode. It's a checkbox in every client.
If you run an FTP server, passive mode means opening a range of ports for data — and that's one more reason most teams have quietly moved on.
FTPS: FTP with a TLS coat
FTPS keeps the FTP protocol but wraps it in TLS, the same encryption that protects HTTPS. Credentials and file contents are encrypted in transit, which fixes FTP's biggest flaw. It comes in two flavors — explicit (start plain on port 21, then upgrade to TLS) and implicit (TLS from the first byte, usually port 990). Because it's TLS, FTPS also inherits TLS's housekeeping: its certificate expires on a schedule, and an expired cert silently breaks every connection — which is exactly the kind of thing certificate monitoring exists to catch.
The catch: FTPS inherits FTP's two-channel design, so it's still firewall-unfriendly, and the TLS layer makes the data ports even harder for firewalls to track. It works, and it's secure, but it carries all of FTP's operational baggage. You'll mostly meet FTPS when a legacy system requires it.
SFTP: file transfer over SSH
SFTP is the modern default, and it sidesteps every problem above. It runs as a subsystem of SSH, so:
- It uses a single connection on port 22 — no active/passive headaches, no data-port ranges, firewall-friendly out of the box.
- It's encrypted by the same battle-tested SSH layer that secures remote logins.
- It supports key-based authentication — you can log in with a public/private key pair instead of a password, which is both safer and more convenient.
If you already have SSH access to a server, you already have SFTP — no extra service to install. That's why "FTP me those files" almost always means SFTP today.
Side by side
| FTP | FTPS | SFTP | |
|---|---|---|---|
| Encryption | None | TLS | SSH |
| Connections | Two (control + data) | Two | One |
| Firewall-friendly | Only in passive mode | Painful | Yes |
| Auth | Password | Password / cert | Password or key |
| Port | 21 | 21 / 990 | 22 |
| Use it when | Never, ideally | A legacy system demands it | Almost always |
Which client should I use?
You rarely type raw protocol commands — a client handles it. Good free options by OS:
| OS | Recommended clients |
|---|---|
| Windows | WinSCP (excellent for SFTP), FileZilla |
| macOS | Cyberduck, FileZilla, Transmit (paid, polished) |
| Linux | The built-in sftp command, lftp, FileZilla |
| Any | FileZilla (cross-platform), or the sftp CLI everywhere SSH exists |
On the command line, SFTP is delightfully simple: sftp you@server, then put file.zip to upload and get report.pdf to download. If you live in a terminal, you already have it.
A few hard-won tips
- Default to SFTP. Unless something forces your hand, it's simpler and safer.
- FTP hanging? Switch to passive mode before you debug anything else.
- Check the port is open. If a client won't connect, confirm the server is actually listening — our port checker tells you in seconds whether port 22 (SFTP) or 21 (FTP) is reachable. For a file server you depend on, a continuous TCP monitor watches that port from multiple regions and alerts you the moment it stops accepting connections.
- Use SSH keys for SFTP. They beat passwords on both security and convenience — see our SSH guide.
- Never use plain FTP over the public internet. If you must touch a cleartext FTP server, do it over a VPN.
The bottom line
| In one line | |
|---|---|
| FTP | The original — simple, unencrypted, avoid on public networks. |
| FTPS | FTP + TLS — secure but firewall-awkward; mostly for legacy. |
| SFTP | File transfer over SSH — one port, encrypted, key auth. The default. |
| Stuck connecting? | Switch FTP to passive mode, and confirm the port is open. |
The three acronyms hide a simple truth: FTP and FTPS are the old two-channel family, and SFTP is the clean, SSH-based future. When in doubt, reach for SFTP — one encrypted connection, key-based login, and none of the active/passive drama. Once you're comfortable moving files over SSH, the next step is learning what else SSH can do.
Related: SSH explained, TCP vs UDP, what is a network port, what is a firewall.