Updated: 8 October 2026 · Applies to: OpenSSH 10.0 sftp client and server (Debian 13); the same commands work on Ubuntu, AlmaLinux, Rocky Linux, macOS and the OpenSSH client in Windows; FileZilla 3.68

Connect with sftp user@server using your normal SSH login, then upload with put and download with get:

sftp alice@203.0.113.10
sftp> put backup.tar.gz
sftp> get logs/access.log
sftp> bye

SFTP runs inside SSH: same port (22 unless you changed it), same users, same passwords and keys. Your password and your files are encrypted. If you can log in with SSH, you can almost certainly use SFTP.

SFTP, FTPS and SCP are different things

  • SFTP (SSH File Transfer Protocol) is part of SSH. It is not "FTP over SSL" and needs no FTP server or SSL certificate. On Debian the SSH server enables it with the line Subsystem sftp /usr/lib/openssh/sftp-server in /etc/ssh/sshd_config. See What port does SFTP use.
  • FTPS is the old FTP protocol with TLS encryption. It needs an FTP server such as vsftpd, as in How to set up vsftpd with TLS.
  • SCP also runs over SSH. Since OpenSSH 9.0 the scp command uses the SFTP protocol by default (in our test scp -v showed Sending subsystem: sftp). For copying folders with scp, see How to copy a folder recursively with scp.

Step 1: Connect

  1. Open a terminal (on Windows, PowerShell; according to Microsoft, sftp is part of the OpenSSH client available since Windows 10 build 1809 and Windows Server 2019) and connect: 
    $ sftp alice@203.0.113.10
The authenticity of host '203.0.113.10 (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:8d9USgzilrduvwBzF1+9RNwJSbqeX3mPxrBVDGncq3g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '203.0.113.10' (ED25519) to the list of known hosts.
alice@203.0.113.10's password:
Connected to 203.0.113.10.
sftp>
  2. The fingerprint question appears only on the first connection. To be sure you reached the right server, compare it with the fingerprint shown on the server itself (from the console or an existing SSH session): 
    $ ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:8d9USgzilrduvwBzF1+9RNwJSbqeX3mPxrBVDGncq3g root@server (ED25519)
  3. SSH on another port: sftp -P 2222 alice@203.0.113.10 (capital -P; ssh uses lower-case -p). More in How to connect to SSH on a different port.
  4. With an SSH key, sftp uses your default key automatically and skips the password prompt. For another key file: sftp -i ~/.ssh/id_ed25519 alice@203.0.113.10. To create and install a key, see How to set up SSH keys for authentication.

Step 2: Upload and download files

The sftp> prompt has two sides: commands work on the server, and the same commands with an l in front work on your computer (pwd and lpwd, cd and lcd, ls and lls). Files you upload come from your local folder; files you download land there.

sftp> pwd
Remote working directory: /home/alice
sftp> lpwd
Local working directory: /home/dev
sftp> put backup.tar.gz
Uploading backup.tar.gz to /home/alice/backup.tar.gz
backup.tar.gz                                 100% 4883KB  12.7MB/s   00:00
sftp> cd logs
sftp> get access.log
Fetching /home/alice/logs/access.log to access.log
access.log                                    100%    9    21.3KB/s   00:00

Other everyday commands:

  • ls -l, cd folder, mkdir uploads, rmdir folder
  • rename old.html new.html, rm file
  • chmod 644 home.html (prints Changing mode on /home/alice/public_html/site/home.html)
  • df -h shows free space on the server; !command runs a command on your computer
  • help lists every command; bye or exit ends the session

Upload or download a whole folder

sftp> cd public_html
sftp> put -r site
Entering site/
Entering site/css
Entering site/img
sftp> get -r site
Retrieving /home/alice/public_html/site
Retrieving /home/alice/public_html/site/css
Retrieving /home/alice/public_html/site/img

The manual documents the flag as -R; lower-case -r worked the same in our test. According to the sftp manual, symbolic links inside the folder are not followed. For large or repeated folder copies, rsync over SSH only sends what changed.

Resume an interrupted transfer

If a large upload stops, reput continues from where the remote copy ends instead of starting again (reget does the same for downloads):

sftp> reput backup.tar.gz
Resuming upload of backup.tar.gz to /home/alice/backup.tar.gz
backup.tar.gz                                 100% 4883KB   8.2MB/s   00:00

Use SFTP in scripts and cron jobs

  • Download one file in a single command: 
    $ sftp alice@203.0.113.10:logs/access.log /tmp/dl/
Connected to 203.0.113.10.
Fetching /home/alice/logs/access.log to /tmp/dl/access.log
  • Run a list of commands from a file with sftp -b commands.txt alice@203.0.113.10. Batch mode cannot type a password, so set up key login first. It stops at the first failing command; put - in front of a command (for example -rm old.zip) to carry on when that one fails.
  • According to the sftp manual, -l limits the bandwidth in Kbit/s, for example sftp -l 8000 alice@203.0.113.10.

Using FileZilla or another graphical program

  1. In FileZilla, open File > Site Manager... and click New site.
  2. Set Protocol to SFTP - SSH File Transfer Protocol, enter the server in Host, and leave Port empty for 22 or enter your SSH port.
  3. Choose a Logon Type: Normal (user and saved password), Ask for password, or Key file to log in with a private key. Enter the User, then click Connect and accept the host key on the first connection.

You can also add keys for all sites under Edit > Settings... > Connection > SFTP > Add key file.... If the key is in a format FileZilla does not read, it asks whether to convert it into a supported format. Do not choose the "FTP" protocol with encryption: that is FTPS, not SFTP. On Windows, WinSCP also works; according to its documentation it uses SFTP by default. For FileZilla basics, see Uploading files using FileZilla.

Common errors

  • Permission denied (publickey,password). Wrong user name, password or key, or the server accepts keys only. Check that ssh with the same user works.
  • ssh: connect to host 203.0.113.10 port 2200: Connection refused Wrong port, SSH is not running, or a firewall blocks it.
  • Received message too long 1281977973 followed by Ensure the remote shell produces no output for non-interactive sessions. Something on the server prints text at login for every session, for example an echo in ~/.bashrc or a login banner script. SFTP reads that text as protocol data. Test with ssh alice@203.0.113.10 true, which must print nothing. In our test it printed the server's "Linux ..." login banner (the number is that text read as a length: 1281977973 is "Linu").
  • stat remote: No such file or directory after cd: the remote folder does not exist. Use ls to check the path.
  • dest open "/etc/backup.tar.gz": Permission denied Your user cannot write to that folder. Upload into your home folder or a folder you own.

To give someone file access without a shell, see How to create an SFTP-only user with a chroot.

Official documentation: sftp(1) manual, OpenSSH for Windows (Microsoft).

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (0 Votes)