What Is SFTP & How Does It Work?


A file transfer requires 2 or more computers to communicate with each other. The method they use to communicate is called a file transfer protocol.

There are two types of protocols: secure and insecure.

Secure protocols encrypt the channel that files are transferred over so that if someone intercepts the files, they can’t read them. Insecure protocols don’t encrypt the channel, which means anyone can intercept and read the files. This is especially a problem when files contain confidential information like social security numbers, credit card numbers, etc.

SFTP, HTTPS and FTPS are secure protocols while HTTP and FTP are insecure.

SFTP vs FTP secure file transfer encryption

This guide explains everything you need to know about SFTP, including what it is, how it works and when to use it.


What is SFTP?

SFTP stands for SSH File Transfer Protocol. SFTP transfers files using SSH (Secure Shell), which is an encrypted protocol. I’ll dive into what SSH is below.

There are two important things to know about SFTP:

  1. Before any files are transferred, the connection is encrypted.
  2. There’s no way to send files over SFTP unencrypted.

What is SFTP used for?

SFTP is used across many different industries and in a variety of situations.

Here are some hypothetical examples in which SFTP could be used:

  • Hospitals sending confidential health data to insurance companies
  • Banks receiving loan applications from their clients
  • Law firms receiving signed contracts and other documents from their clients

What port does SFTP use?

SFTP uses port 22, which represents an SSH server. It’s convenient that SFTP only uses one port (unlike other file transfer protocols) because administrators spend less time configuring firewalls to allow SFTP transfers.


Does SFTP use TCP or UDP?

SFTP uses TCP (transmission control protocol), not UDP (user datagram protocol). Here’s why that matters:

Before computers send or receive data, they can either verify that the other computer is ready to receive files or not.

TCP is a connection-oriented protocol, which means that both computers verify a connection before files are sent. TCP does this with a three-way handshake.

There are two computers involved:

  1. The sending computer will send the data.
  2. The receiving computer will receive the data.

There are three steps in a three-way handshake:

  1. Sending computer sends a message called a SYN.
  2. Receiving computer sends back an acknowledgement message called a SYN ACK.
  3. Sending computer sends an ACK RECEIVED MESSAGE to the receiving computer.

After the handshake is complete, data is delivered. If data doesn’t arrive, TCP will make sure that it is re-sent.

tcp secure file transfer between two computers

Unlike TCP, UDP is a connectionless protocol, which means that neither computer acknowledges the other before sending or receiving files. If UDP is used, the receiving computer may get a file out of order or in pieces.


So SFTP uses SSH. How does SSH work?

There are three steps for an SSH connection to be established:

  1. The client verifies the server.
  2. The client and server generate a session key together.
  3. The server authenticates the client.

sftp uses ssh to establish a connection

Step 1: The Client Verifies the Server

As mentioned above, the SSH server at port 22 is always waiting for client requests.

When a client initiates a connection, it starts by verifying the server’s identity.

There are two possible scenarios:

  1. The client is accessing the server for the first time, so the user has to manually verify the public key of the server.
  2. The client isn’t accessing the server for the first time, so the server’s identity was recorded before and can be verified without user involvement.

Step 2: Generating a Session Key

The client and server agree on a session key that will encrypt and decrypt the data. This key is randomly generated and known as “symmetric” because it’s used for encryption and decryption.

Step 3: The Server Authenticates the Client

The server authenticates the client using an SSH key pair. A key pair is made of a public key, which both parties know, and a private key, which should only be known to the right client.

To verify that the client has the right private key, the server uses a random number it picks and the shared session key. It calculates the MD5 hash of this value. (MD5 is a hashing algorithm that produces a unique, fixed-length string. Think of it as a code that always delivers the same result for the same string.)

If the client’s MD5 hash matches the server’s, it proves that the client has the private key. SSH authentication is complete.


How does SFTP work?

Before an SFTP file transfer can occur, the client and server verify the connection via a three-way handshake (see the TCP section above). Then, they authenticate each other (see the SSH section above).

Finally, the file is transferred over the encrypted channel in packets. Each packet has some of the data being transferred. At the receiving end, the packets are put back together into the original file.

sftp transfers packets over encrypted channels and then put back together


What is the difference between SFTP and SSH?

SFTP and SSH are both protocols, but SFTP runs over the SSH protocol. On its own, SSH can’t transfer files – it can only create a secure connection. Users can do certain actions with files if they’re using SFTP, but they can’t do those actions with SSH.

These actions include

  • Copying a file from a local computer to a remote host
  • Renaming a file on the remote host
  • Deleting a file on the remote host

How secure is SFTP? Is it more secure than FTPS?

SFTP is very secure because the connection always begins encrypted. SFTP is more secure than FTPS because FTPS connections begin in an unencrypted state.


What are the differences between SFTP and FTPS?

Category SFTP FTPS
Port Number 22 Usually 990, sometimes port 91
Ports To Open 22 989 and 990
Firewall Configuration Complexity Less complex More complex
Certificate for Server Not required Required – X.509 certificate
Custom Commands Supported No Yes
Transfer Speed Slower because there are more steps involved Faster

What are the differences between SFTP and SCP?

SCP (Secure Copy Protocol) and SFTP both use the SSH protocol for authentication, meaning they’re equal in security.

However, SCP can only transfer data, not manage it. Unlike SFTP, SCP

  • Can’t rename or remove files
  • Doesn’t have a graphical user interface (GUI)
  • Can’t resume interrupted file transfers
  • Can’t read command scripts — everything must be written by a user on a command line

What is an SFTP client?

An SFTP client is any software that can connect to an SFTP server. You can use a client to upload or download files to the server.

Clients typically have lower processing power and less resources than servers. They always request information from servers.

Some popular SFTP clients are

  • Solar-PuTTY
  • WinSCP
  • FileZilla
  • CyberDuck

What is an SFTP server?

An SFTP server is a repository where files are stored. Servers have higher processing power and more resources than clients. They give clients the information they’re requesting.


Beyond SFTP for Secure File Transfers

SFTP is a great choice to keep your confidential business information protected, but it doesn’t have everything you need. Thru, our cloud managed file transfer (MFT) solution, gives your IT team visibility and control of file transfers. It fully secures file transfers and supports FTPS and HTTPS too.




Have questions about managed file transfer?

Get answers, not a sales pitch. Our experts have analyzed, discussed and solved difficult file transfer challenges since 2002. We are here to help you.

Scroll to Top