FTP vs. SFTP vs. FTPS

Category: FTP & File Management · Updated 2026-10-30

FTP is the original file transfer protocol and sends data, including passwords, without encryption. FTPS is FTP wrapped in TLS encryption. SFTP is a different protocol that runs over SSH and encrypts everything on a single port. For uploading website files, use SFTP or FTPS whenever your host allows it.

The three protocols compared

	FTP	FTPS	SFTP
Full name	File Transfer Protocol	FTP over TLS/SSL	SSH File Transfer Protocol
Encrypted	No	Yes	Yes
Default port	21 (plus data ports)	21 explicit or 990 implicit	22
Based on	Its own protocol	FTP plus TLS	SSH
Authentication	Username and password	Password, optional certificates	Password or SSH keys
Firewall friendliness	Hard (separate data connections)	Hard	Easy (one port)

Why plain FTP is a risk

In plain FTP the username, password and file contents travel as readable text. Anyone on the same network path, such as a shared Wi-Fi network, can capture them. A stolen FTP login is a common way sites get infected with malware. If your host only offers FTP, use a trusted network and change the password afterwards, or ask for SFTP or FTPS.

Active and passive mode

FTP uses a control connection on port 21 and separate connections for data. In active mode the server connects back to your computer, which firewalls and routers often block. In passive mode the client opens both connections, so passive mode is the default in most clients and the one that works behind home routers. If a client connects but cannot list folders, switching to passive mode is the first fix to try.

Which one should you use?

SFTP if your host gives SSH access: it is secure, uses one port, and supports key-based login.
FTPS if the host offers FTP with TLS but no SSH.
Plain FTP only when nothing else is available and the data is not sensitive.

Popular clients include FileZilla, WinSCP, Cyberduck and Transmit, and on a terminal the sftp command is available on most systems.

Connecting with SFTP from a terminal

sftp user@example.com
sftp> put index.html
sftp> ls
sftp> exit

Frequently asked questions

What is the difference between FTP and SFTP?

FTP transfers files and credentials in plain text, while SFTP is a different protocol that runs inside an encrypted SSH connection. They sound similar, but SFTP is not just FTP with a letter added.

Is FTPS the same as SFTP?

No. FTPS is the old FTP protocol secured with TLS and uses FTP ports, while SFTP is a file transfer protocol built on SSH and uses port 22. Clients must be set to the correct one.

What port does FTP use?

FTP uses port 21 for the control connection, plus additional ports for data transfers depending on the mode. SFTP uses port 22, and implicit FTPS uses port 990.

Why can I connect by FTP but not see my files?

This is usually a passive mode problem. Switch your client to passive mode, check that your firewall allows the server's passive port range, and make sure you are in the correct folder, often public_html or www.

Is FTP still safe to use in 2026?

Plain FTP is not safe for credentials or sensitive files because everything is readable on the network. Use SFTP or FTPS when possible, and limit access to trusted networks if you must use FTP.

Which FTP client is best?

FileZilla is a popular free client for all platforms, WinSCP is widely used on Windows, and Cyberduck and Transmit are common on macOS. All support FTP, FTPS and SFTP.