--- title: FTP vs FTPS vs SFTP: file transfer protocols explained description: FTP, FTPS, and SFTP all move files — but only two are safe, and they work in completely different ways. Here's how each protocol works, active vs passive mode, the best clients per OS, and which to use. canonical: https://watchfor.io/blog/ftp-ftps-sftp-explained --- [All posts](/blog) [Networking](/blog/category/networking) Jun 26, 2026 · 6 min read · WatchFor Team # FTP vs FTPS vs SFTP: file transfer protocols explained FTP, FTPS, and SFTP all move files — but only two are safe, and they work in completely different ways. Here's how each protocol works, active vs passive mode, the best clients per OS, and which to use. You need to upload a few files to a server. Someone hands you a host, a username, a password, and the word "FTP." Twenty minutes later you're staring at three near-identical acronyms — FTP, FTPS, SFTP — a client asking about "passive mode," and a connection that hangs forever. The names look interchangeable. They are not. Two of them are secure, one is from a more trusting era of the internet, and one of them isn't really FTP at all. Here's the whole picture. ## Three names, two completely different families Despite the shared letters, these protocols come from two unrelated lineages: Protocol Full name Built on Default port Encrypted? FTP File Transfer Protocol its own 1971 design 21 (+ data) No FTPS FTP Secure FTP wrapped in TLS 21 / 990 (+ data) Yes (TLS) SFTP SSH File Transfer Protocol [SSH](/blog/ssh-explained) 22 Yes (SSH) The key surprise: SFTP is not FTP with an S bolted on. It's a completely different protocol that rides inside an [SSH](/blog/ssh-explained) connection. FTPS is old FTP with [TLS](/blog/tls-1-2-vs-1-3) encryption added. So FTP and FTPS are cousins; SFTP is the odd one out — and, for most people, the best one. ## FTP: the original, and why it's risky Plain FTP is genuinely ancient and beautifully simple — which is exactly the problem. It sends everything in cleartext , including your username and password. Anyone able to watch the network between you and the server sees your credentials in plain view. On a coffee-shop Wi-Fi or any shared network, that's a real risk. It also has an awkward design quirk that trips up almost everyone: FTP uses two separate connections . - A control channel (port 21) carries commands like "list this folder" or "send this file." - A separate data channel carries the actual file bytes. How that second channel gets opened is where things break. ### Active vs passive mode (the part that hangs) This single concept explains 90% of "FTP won't connect" tickets: Mode Who opens the data connection Plays nicely with firewalls/NAT? Active The server connects back to the client No — the client's [firewall](/blog/what-is-a-firewall) usually blocks the incoming connection Passive The client opens both connections Yes — almost always the right choice In active mode , the server tries to reach back to your machine to deliver data. If you're behind a router doing NAT (everyone at home is), that inbound connection gets dropped, and the transfer hangs after "connected." In passive mode , your client makes both connections outbound, which firewalls allow by default. The fix for a mysterious FTP hang is almost always: switch to passive mode. It's a checkbox in every client. If you run an FTP server, passive mode means opening a [range of ports](/blog/what-is-a-network-port) for data — and that's one more reason most teams have quietly moved on. ## FTPS: FTP with a TLS coat FTPS keeps the FTP protocol but wraps it in [TLS](/blog/tls-1-2-vs-1-3), the same encryption that protects HTTPS. Credentials and file contents are encrypted in transit, which fixes FTP's biggest flaw. It comes in two flavors — explicit (start plain on port 21, then upgrade to TLS) and implicit (TLS from the first byte, usually port 990). Because it's TLS, FTPS also inherits TLS's housekeeping: its certificate expires on a schedule, and an expired cert silently breaks every connection — which is exactly the kind of thing [certificate monitoring](/docs/monitors/certificates) exists to catch. The catch: FTPS inherits FTP's two-channel design, so it's still firewall-unfriendly, and the TLS layer makes the data ports even harder for firewalls to track. It works, and it's secure, but it carries all of FTP's operational baggage. You'll mostly meet FTPS when a legacy system requires it. ## SFTP: file transfer over SSH SFTP is the modern default, and it sidesteps every problem above. It runs as a subsystem of [SSH](/blog/ssh-explained), so: - It uses a single connection on port 22 — no active/passive headaches, no data-port ranges, firewall-friendly out of the box. - It's encrypted by the same battle-tested SSH layer that secures remote logins. - It supports key-based authentication — you can log in with a [public/private key pair](/blog/ssh-explained) instead of a password, which is both safer and more convenient. If you already have SSH access to a server, you already have SFTP — no extra service to install. That's why "FTP me those files" almost always means SFTP today. ## Side by side FTP FTPS SFTP Encryption None TLS SSH Connections Two (control + data) Two One Firewall-friendly Only in passive mode Painful Yes Auth Password Password / cert Password or key Port 21 21 / 990 22 Use it when Never, ideally A legacy system demands it Almost always ## Which client should I use? You rarely type raw protocol commands — a client handles it. Good free options by OS: OS Recommended clients Windows WinSCP (excellent for SFTP), FileZilla macOS Cyberduck, FileZilla, Transmit (paid, polished) Linux The built-in sftp command, lftp , FileZilla Any FileZilla (cross-platform), or the sftp CLI everywhere SSH exists On the command line, SFTP is delightfully simple: sftp you@server , then put file.zip to upload and get report.pdf to download. If you live in a terminal, you already have it. ## A few hard-won tips - Default to SFTP. Unless something forces your hand, it's simpler and safer. - FTP hanging? Switch to passive mode before you debug anything else. - Check the port is open. If a client won't connect, confirm the server is actually listening — our [port checker](/port-checker) tells you in seconds whether port 22 (SFTP) or 21 (FTP) is reachable. For a file server you depend on, a continuous [TCP monitor](/docs/monitors/network) watches that port from multiple regions and alerts you the moment it stops accepting connections. - Use SSH keys for SFTP. They beat passwords on both security and convenience — see our [SSH guide](/blog/ssh-explained). - Never use plain FTP over the public internet. If you must touch a cleartext FTP server, do it over a VPN. ## The bottom line In one line FTP The original — simple, unencrypted, avoid on public networks. FTPS FTP + TLS — secure but firewall-awkward; mostly for legacy. SFTP File transfer over SSH — one port, encrypted, key auth. The default. Stuck connecting? Switch FTP to passive mode, and confirm the port is open. The three acronyms hide a simple truth: FTP and FTPS are the old two-channel family, and SFTP is the clean, SSH-based future. When in doubt, reach for SFTP — one encrypted connection, key-based login, and none of the active/passive drama. Once you're comfortable moving files over SSH, the next step is learning [what else SSH can do](/blog/ssh-explained). Related: [SSH explained](/blog/ssh-explained), [TCP vs UDP](/blog/tcp-vs-udp), [what is a network port](/blog/what-is-a-network-port), [what is a firewall](/blog/what-is-a-firewall). [#networking](/blog/tag/networking)[#ftp](/blog/tag/ftp)[#sftp](/blog/tag/sftp)[#security](/blog/tag/security) ## Start monitoring your services today WatchFor checks HTTP, DNS, SSL, ping, email and 20+ more — from around the world, with alerts to Slack, Discord, email and beyond. [Learn more](/docs/monitors)[Start free](/auth/sign-up) Share this article --- Canonical page: https://watchfor.io/blog/ftp-ftps-sftp-explained · Site guide: https://watchfor.io/llms.txt