FTP vs. SFTP

FTP and SFTP are both data transfer protocols. Nev­er­the­less, they differ in the transfer and in their in­te­grat­ed security measures. We’ll show you how the network protocols work and when you should use FTP or SFTP.

What is FTP?

FTP stands for File Transfer Protocol and is used to exchange files between servers and clients. It contains rules for com­mu­ni­ca­tion in an IP network. This allows data to be trans­ferred to a server using a browser or FTP client.

FTP was developed as early as 1971. At that time, people weren’t aware of the internet’s potential dangers. Many of the FTP’s security gaps, which could be exploited by hackers, were only later noticed and closed. However, FTP still has its risks.

What is SFTP?

SFTP means SSH File Transfer Protocol and is an extension of FTP. It was published in 2001 by the Internet En­gi­neer­ing Task Force (IETF) and is also known as Secure Transfer Protocol. Unlike its pre­de­ces­sor, SFTP ad­di­tion­al­ly uses an encrypted secure shell con­nec­tion.

SSH is a tunneling protocol that transmits files securely over TCP port 22. In­for­ma­tion isn’t trans­mit­ted in plain text but encrypted using cryp­to­graph­ic al­go­rithms. This makes it more difficult for hackers to access passwords and con­fi­den­tial data. SFTP uses version 2 of the SSH protocol, which can be used to tunnel any TCP/IP ap­pli­ca­tion.

FTP vs. SFTP – what’s the dif­fer­ence?

FTP and SFTP can both be used to upload and download files to a server. Most FTP clients, like FileZilla, support both protocols.

FTP uses two channels: a command channel and a data channel. This is the same as TCP ports 20 and 21, except that the con­nec­tion is un­en­crypt­ed. In contrast, SFTP with TCP port 22 offers only a single channel for data trans­mis­sion, which is also cryp­to­graph­i­cal­ly secured by SSH.

Another dif­fer­ence is the permitted file size for transfers. For FTP it’s 4 gigabytes and for SFTP it’s 16 gigabytes.

What’s better, FTP or SFTP?

Overall, SFTP is the more secure protocol for data transfers between a client and server. This means that sensitive in­for­ma­tion like con­fig­u­ra­tion files can also be trans­ferred in encrypted form. With FTP, on the other hand, hackers can intercept data in plain text.

SFTP also supports public-key au­then­ti­ca­tion, which provides more pro­tec­tion than passwords. In addition, trou­bleshoot­ing and con­fig­ur­ing the client and server is easier with SFTP.

What are FTP and SFTP suitable for?

The question of FTP vs. SFTP depends on your data transfer re­quire­ments. FTP is suitable for data transfers that don’t need to be protected from unau­tho­rized access. This might include publicly ac­ces­si­ble documents or released software packages. In addition, FTP is suf­fi­cient for transfers in local, private networks, as long as they’re suf­fi­cient­ly secured.

If, on the other hand, con­fi­den­tial in­for­ma­tion needs to be exchanged between server and client, SFTP should be used. This makes it possible to transfer sensitive data securely and encrypted even in public networks. This includes, for example, personal data like financial in­for­ma­tion or health and login data. It’s also rec­om­mend­ed to use SFTP between different branches of a company.