What Is SFTP? SSH File Transfer Protocol Explained

SFTP stands for SSH File Transfer Protocol, and it is often written out as Secure File Transfer Protocol. It moves files between a client and a server over a single encrypted Secure Shell (SSH) connection, normally on TCP port 22. The SSH layer authenticates the server, encrypts commands, credentials, and data in transit, and protects the connection against tampering. SFTP is a separate protocol from FTP and is different from FTPS, which adds TLS to FTP.

SFTP protects data in transit, but it does not scan files for malware, enforce data policies, or give compliance teams a governed record of who accessed what. Regulated organizations therefore pair SFTP with key management, access controls, and audit logging. Kiteworks provides a control plane for secure data exchange that brings SFTP, managed file transfer, email, and file sharing under the same encryption, access control, and audit logging.

Key Takeaways

1. SFTP Is Not FTP With Encryption Added

SFTP is a distinct protocol that runs inside an SSH session, not a secured version of FTP. It does not use FTP commands or FTP’s separate control and data connections, which is why it is easier to run through firewalls than FTPS.

2. SFTP Protects Data in Transit, Not Everything Else

Encryption in transit covers confidentiality and integrity during the transfer. Files at rest, malware inside files, and governance of who may send what are separate problems that need separate controls.

3. Key-Based Authentication Beats Passwords

Public key authentication, ideally combined with multi-factor authentication, resists the credential guessing that passwords invite. The trade-off is key management: unmanaged keys accumulate and become a quiet risk.

4. Port 22 Is a Default, Not a Security Feature

The port number does not change encryption strength. Moving SFTP to another port can reduce automated scanning noise, but it is not a substitute for strong authentication, current algorithms, and monitoring.

5. Compliance Depends on the System Around SFTP

SFTP can satisfy transmission security expectations, but audit trails, access control, and key ownership decide whether an exchange is defensible. Auditors look for evidence of who transferred which data, when, and under what policy.

What Does SFTP Mean?

The “S” in SFTP refers to Secure Shell, the protocol that provides the secure channel. SSH was designed as a replacement for insecure remote access tools. SFTP was designed alongside it to handle file operations inside that channel, including uploading, downloading, listing directories, renaming, and deleting files.

The protocol is defined in a series of IETF drafts from the SSH working group rather than in a published standard. The drafts expired, and implementations such as OpenSSH follow an earlier version of the protocol (version 3) that has become the de facto reference. The SSH transport that SFTP relies on is standardized in RFC 4251 through RFC 4254.

People sometimes confuse SFTP with other terms:

• FTP (File Transfer Protocol) sends commands, credentials, and data in plaintext. See our glossary entry for FTP.
• FTPS is FTP wrapped in TLS. It uses FTP’s command structure, which is why it needs more than one port.
• SCP is a separate SSH-based copy tool with fewer features than SFTP.
• TFTP (Trivial File Transfer Protocol) uses UDP and has no authentication or encryption. It is limited to simple tasks such as booting network devices.

How Does SFTP Work?

An SFTP session follows a predictable sequence:

1. Connection. The client opens a TCP connection to the server, usually on port 22, and the two sides agree on protocol versions and algorithms.
2. Key exchange and server authentication. The client and server establish shared session keys with a key exchange method, and the server proves its identity with its host key. The client checks that key against one it already trusts, which protects against man-in-the-middle attacks.
3. Encryption and integrity. From this point, all traffic is encrypted with a symmetric cipher such as AES or ChaCha20-Poly1305 and protected with a message authentication code or an authenticated encryption mode.
4. User authentication. The user proves who they are with a password, an SSH key pair, keyboard-interactive prompts such as a one-time code, or other supported methods.
5. File operations. The client starts the SFTP subsystem and sends requests to read, write, list, and manage files on the same connection.

Because commands and data travel over one connection, SFTP needs only one open port. That simplicity is a main reason administrators prefer it to FTPS. Key exchange in modern SSH is commonly based on elliptic curve Diffie-Hellman, and host and user keys are commonly Ed25519, ECDSA, or RSA. For background on how these key types work, see our guide to public key and private key encryption, and for the symmetric cipher most often used for the data stream, see AES-256 encryption.

How Secure Is SFTP?

SFTP provides strong protection for data in transit when it is configured well. The protections include:

• Confidentiality. Commands, credentials, and file contents are encrypted between client and server.
• Integrity. Tampering in transit is detected through message authentication.
• Server authentication. The host key lets clients detect an impostor server, provided the client verifies the key.
• Flexible user authentication. Key-based login and multi-factor options reduce reliance on passwords.

The limits matter just as much. SFTP does not protect files at rest on the server, does not inspect file contents for malware or sensitive data, and does not by itself provide centralized logs or approval workflows. It also does not address availability, so resilience depends on how the server and network are built. The most common real-world weaknesses are weak passwords, unmanaged keys, outdated algorithms, shared accounts, and missing monitoring. These are configuration and governance issues, not flaws in the protocol. Our overview of secure file transfer covers how these controls fit together.

What Port Does SFTP Use?

SFTP uses TCP port 22 by default, the same port as SSH, and it needs no separate data port. Administrators can run it on a different port. Doing so can reduce the volume of automated login attempts aimed at port 22, but it does not make the encryption stronger, so it should supplement rather than replace key-based authentication, IP restrictions, and monitoring.

For comparison, FTP uses port 21 for commands and a separate data connection. FTPS uses port 21 in explicit mode or port 990 in implicit mode, plus a range of ports for data connections, which complicates firewall rules. TFTP uses UDP port 69.

What Is the Difference Between FTP, SFTP, FTPS, and TFTP?

Protocol	Built on	Encryption	Typical ports	Firewall impact
FTP	TCP	None; credentials and data in plaintext	21 plus data connections	Multiple ports, passive mode needed
FTPS	FTP with TLS	TLS	21 or 990 plus data port range	Multiple ports to open and track
SFTP	SSH	SSH transport encryption	22	Single port
TFTP	UDP	None	69	Limited to trusted local networks

FTPS is a reasonable choice when partners already operate TLS-based systems and certificates, while SFTP is usually simpler to deploy across firewalls and fits SSH-centered operations. For a deeper comparison, read our guide to SFTP vs. FTP. SFTP also differs from a VPN. A VPN protects a network path and can carry any traffic, while SFTP secures one file transfer service, so organizations often use them together rather than choosing one.

What Are the Advantages and Disadvantages of SFTP?

Advantages

• Strong encryption and server authentication in a mature, widely supported protocol.
• One port and one connection, which simplifies firewall and network design.
• Support for key-based authentication, which suits automation and reduces password risk.
• Broad client and server support across operating systems and scripting tools.
• Many clients can resume interrupted transfers, which helps with large files.

Disadvantages

• Key sprawl. Keys that are not inventoried or rotated create hidden access.
• No built-in content inspection, so malware and sensitive data pass through unless other controls exist.
• Limited native governance. Logging, reporting, approvals, and retention depend on the server platform.
• Performance on high-latency links can lag, and behavior varies between implementations.
• Manual setups are hard to scale across many partners, accounts, and scripts.

What Are the Best Practices for Using SFTP Securely?

1. Prefer key-based authentication and add multi-factor authentication where users sign in interactively. Disable password logins for automated accounts. See our guide to multi-factor authentication.
2. Manage keys as assets. Keep an inventory, assign owners, rotate keys on a schedule, and remove keys when people or integrations leave.
3. Verify host keys. Pin or distribute trusted host keys so clients can detect a changed or spoofed server.
4. Allow only modern algorithms. Disable legacy ciphers, key exchange methods, and signature algorithms that are no longer considered safe.
5. Apply least privilege. Give each account only the folders and operations it needs, and avoid shared accounts. See role-based access control.
6. Restrict where connections can come from. Use IP allow lists, geofencing, and rate limiting against brute force attacks.
7. Scan and inspect files. Add antivirus scanning and data loss prevention checks, since SFTP itself will not. See our guides to antivirus and data loss prevention.
8. Log everything and send it to your SIEM. Record logins, failures, and file operations, and review them. See our guide to audit logs.
9. Patch server software promptly. SSH implementations receive security fixes regularly.

When Should You Use SFTP?

SFTP fits scheduled and automated exchanges between known parties. Common examples include healthcare organizations exchanging claims and records files with partners, financial institutions delivering batch reports, manufacturers exchanging order and EDI files with suppliers, government agencies receiving submissions, media teams delivering large assets, and development teams distributing build artifacts. For ad hoc sharing with people who need an interactive experience, secure file sharing or email protection is often a better fit than asking recipients to use an SFTP client. See how managed file transfer extends SFTP for recurring workflows.

What Role Does SFTP Play in Compliance?

SFTP helps organizations meet obligations to protect data in transit, but no protocol makes an organization compliant on its own. Examples of requirements it can support include the transmission security standard in the HIPAA Security Rule (HIPAA), PCI DSS requirements for strong cryptography when cardholder data crosses open networks (PCI DSS), the security of processing obligation in the GDPR, and NIST SP 800-171 controls for protecting controlled unclassified information during transmission (NIST 800-171). Auditors typically ask for more than encryption evidence. They want to see who exchanged which data, who approved access, how keys are controlled, and whether cryptography is validated. Organizations that need validated cryptography should look for FIPS validated modules.

What Should You Look for in an SFTP Solution?

• Authentication options: key-based login, multi-factor authentication, and integration with your identity provider.
• Key management: self-service key registration, policy controls, and clear ownership.
• Granular permissions: role-based folder access and the ability to run read-only.
• Session controls: concurrent session limits and idle timeouts.
• Audit logging: complete records of logins, failures, and file operations, with feeds to your SIEM.
• Content controls: antivirus and DLP integration.
• Cryptography: modern algorithms and FIPS validated modules for regulated environments.
• Deployment flexibility: options that match your data residency and isolation requirements. See our overview of secure deployment options.
• Automation and scale: scheduling, workflows, and resumable large transfers.

Current Status: Post-Quantum Key Exchange and Legacy Algorithms

This section is reviewed and updated separately from the rest of the page. Last reviewed: October 2026.

OpenSSH 10.0, released in April 2025, made the hybrid post-quantum key exchange method mlkem768x25519-sha256 the default for the client, combining the ML-KEM-768 algorithm standardized by NIST with the X25519 elliptic curve method. The same release removed support for the weak DSA signature algorithm. Hybrid key exchange is designed to protect SFTP sessions recorded today from being decrypted later by a future quantum computer, while keeping the protection of today’s algorithms.

Whether an SFTP connection uses post-quantum key exchange depends on both ends. The client and the server software must support it, and the server must permit it in its configuration. When you assess an SFTP server or service, ask which key exchange methods it supports and whether legacy algorithms can be disabled.

Transfer Files Securely and in Compliance With Kiteworks SFTP

Kiteworks provides a control plane for secure data exchange that applies the same governance to SFTP as it does to email, file sharing, and managed file transfer. The Kiteworks SFTP Server gives external parties SFTP access to shared folders, while employees reach the same folders through the web and mobile interfaces under the same access controls. The platform helps organizations in these ways:

• Key-based and policy-controlled authentication. Administrators can require key-based authentication, and users and administrators can register and manage SSH public keys for automated and manual transfers.
• Configurable ports. SSH and SFTP can run on ports other than 22.
• Role-based folder permissions. Permissions apply to every read, write, rename, and delete, so SFTP users can do only what their role allows, and an SFTP server can run in read-only mode.
• Session controls. Administrators can cap concurrent sessions per user and end idle sessions automatically.
• Audit logging. SFTP logins, failed attempts, denied access, and file operations are recorded in the platform’s single audit log, which can be fed to your SIEM.
• Large file transfer with resume. Large uploads and downloads are streamed in chunks, and uploads can resume after an interruption.
• Validated cryptography and customer-owned keys. The SFTP service uses FIPS 140 validated cryptography for environments that require it, and customers own their encryption keys. See the platform’s FIPS 140-3 Level 1 validated encryption.

For recurring and automated workflows, add secure MFT on the same platform. Explore the Kiteworks data control plane to see how SFTP fits into governed data exchange.