FTP / SFTP
Also known as: SFTP, FTP client, SCP, file transfer, FileZilla, WinSCP
FTP (File Transfer Protocol) is the original internet standard for uploading and downloading files.
It's largely replaced by SFTP, which encrypts the connection using SSH. Web developers use SFTP to upload website files to servers; data teams use it to transfer files between systems when APIs aren't available.
FTP / SFTP, explained at three levels
At home
FTP is a way to transfer files between computers over the internet. Web designers traditionally used FTP to upload website files to a hosting server. Today, SFTP (the secure version) is used instead, because regular FTP sends your username and password in plain text: anyone watching the network could see them.
At work
FTP is the original protocol for moving files between computers, and SFTP is its secure successor in practice, running over an encrypted SSH connection. Businesses still rely on SFTP to exchange bulk files with banks, payroll providers, insurers, and government agencies, because it's simple, widely supported, and auditable, and it works when a partner has no real-time API.
At home
SFTP uses port 22 (same as SSH) and encrypts both the authentication and the data transfer. You authenticate with a password or SSH key pair (keys are more secure: no password to steal). SFTP clients: FileZilla, WinSCP, Cyberduck, and command-line `sftp`. SFTP supports directory listing, file upload/download, rename, delete, and permission changes.
At work
SFTP is standard for B2B file exchange: payroll processors, payment networks, and healthcare clearinghouses often receive data via SFTP batch uploads. Managed file transfer (MFT) platforms (GoAnywhere, MOVEit) add scheduling, logging, error handling, and partner management on top of SFTP. Compliance policies often require regular rotation of SFTP keys.
At home
SFTP is built on the SSH-2 protocol, using the SSH transport layer for encryption and authentication negotiation. Unlike FTP (which uses separate control and data connections requiring firewall configuration), SFTP uses a single connection: friendlier to firewalls and NAT. SFTP servers can be chrooted to restrict users to a specific directory.
At work
Modern data engineering has largely replaced SFTP with cloud storage APIs (S3, Azure Blob) or streaming platforms (Kafka), but legacy integrations still depend on SFTP drops. Automating SFTP transfers uses tools like lftp (Linux), WinSCP scripting, or Python's Paramiko library. Monitoring SFTP file arrival as a pipeline trigger (polling a directory for new files) is a common legacy ETL pattern.
Real-world examples
At home
Jerome manages a website on a small hosting provider. He uses FileZilla (an SFTP client) to upload updated HTML and image files. The server shows up like a file browser; he drags files to upload.
At work
Fatima's finance team receives monthly expense reports from 50 branch offices via SFTP. An automated script checks the SFTP server hourly, downloads new files, validates the format, and loads them into the accounting system.
How it compares
| feature | FTP | SFTP | FTPS |
|---|---|---|---|
| Encryption | None (plaintext) | Full (SSH) | SSL/TLS |
| Port | 21 (control), 20 (data) | 22 | 21 or 990 |
| Auth methods | Username/password | Password or SSH key | Password or certificate |
| Firewall-friendly | No (passive mode needed) | Yes (single port) | Moderate |
| Use today | Legacy/avoided | Standard | Some enterprise use |
For analysts
BAs working with external data partners often coordinate SFTP file transfers: understanding the protocol helps when troubleshooting delayed data feeds, specifying file exchange requirements with vendors, or auditing data pipeline reliability.
History & origin
FTP was first defined in 1971, making it one of the oldest internet protocols. It was the standard for file sharing before the web. FTPS (FTP over SSL) and SFTP (SSH File Transfer Protocol) emerged in the 1990s and 2000s as security became critical: FTP transmits credentials and data in plain text. SFTP is technically not an extension of FTP but a separate protocol built on SSH. Most FTP clients support SFTP, and many servers have disabled plain FTP entirely. Cloud storage and object storage have largely replaced FTP for new systems.