Short answer: sftp user@host opens an interactive file-transfer session over SSH — put uploads a file, get downloads one, ls/ cd look around on the server, and lcd changes the directory on your own side. It uses the same port and the same keys as SSH (22 by default), nothing extra to open or configure.
Connecting
sftp user@203.0.113.10sftp -P 2222 user@203.0.113.10sftp -i ~/.ssh/id_ed25519 user@203.0.113.10A successful connection drops you at an sftp> prompt. Everything below is typed there, not in your normal shell.
The commands you need inside an sftp session
| Command | What it does |
|---|---|
| ls | List files in the current remote directory |
| lls | List files in the current local directory |
| cd path | Change the remote directory |
| lcd path | Change the local directory |
| pwd | Print the current remote directory |
| lpwd | Print the current local directory |
| get file | Download file to the current local directory |
| get -r dir | Download a directory recursively |
| put file | Upload file to the current remote directory |
| put -r dir | Upload a directory recursively |
| mkdir name | Create a remote directory |
| rm file | Delete a remote file |
| rmdir name | Delete an empty remote directory |
| rename old new | Rename a remote file |
| chmod 644 file | Change a remote file's permissions |
| bye / exit / quit | Close the session |
get and put both take an optional second argument to save the file under a different name: get remote-name.txt local-name.txt.
Transferring a file without the prompt
For a script, or just to skip the back-and-forth, give sftp a path directly and it transfers the file without opening an interactive session:
sftp user@203.0.113.10:/var/www/site/backup.tar.gz ./sftp user@203.0.113.10:/var/www/site/ <<< $'put ./backup.tar.gz'cat > commands.txt <<'EOF'
cd /var/www/site
put ./index.html
bye
EOF
sftp -b commands.txt user@203.0.113.10sftp vs scp
| sftp | scp | |
|---|---|---|
| Interactive session | Yes — browse, list, rename, delete | No — one command, one transfer |
| Resume a broken transfer | Yes (re-get/re-put the file) | No — starts over from the beginning |
| Protocol | Its own subsystem over SSH | Historically a wrapper around rcp over SSH |
| Current OpenSSH default | — | scp now uses the SFTP protocol internally since OpenSSH 9.0 |
For copying a single file in one shot without an interactive session, see the scp command — since OpenSSH 9.0 it actually transfers the data over the same SFTP protocol under the hood, so the two are closer than their different interfaces suggest.
sftp vs FTP vs FTPS
| SFTP | FTP | FTPS | |
|---|---|---|---|
| Port | 22 (SSH) | 21 + data ports | 21/990 + data ports, over TLS |
| Encrypted | Always | Never | Yes, with a valid certificate |
| Authentication | SSH key or password | Plain-text username/password | Username/password, over TLS |
| Firewall friendliness | One port, no extra config | Needs passive-mode port ranges opened | Same passive-mode complexity as FTP |
FTP sends the username, password and file contents in plain text — anyone on the same network segment can read a login as it happens. FTPS encrypts the same protocol with TLS but keeps FTP’s awkward need for a range of passive-mode ports to be open through any firewall in between. SFTP needs none of that: it is a single TCP connection on port 22, encrypted by SSH from the first byte, which is why it has mostly replaced both for anyone who controls the server.
Still need plain FTP or FTPS for an older system? The port and firewall details are in the FTP port guide.
Using sftp from a GUI client
FileZilla and WinSCP both speak SFTP as a connection protocol choice — in FileZilla, pick sftp:// rather than ftp:// as the protocol in the Site Manager; in WinSCP, SFTP is the default file protocol. Either authenticates the same way the command line does: a password, or a private key file pointed at in the client’s settings.
Common sftp errors
- “Connection refused” — nothing is listening on the port you gave; confirm sshd is running and the port matches (22 unless you changed it).
- “Permission denied” on put — the remote user does not have write access to that directory;
pwdto confirm where you are, and check ownership on the server. - “This service allows sftp connections only” — the server’s account is restricted to SFTP (a
ForceCommand internal-sftpor a similarsshd_configmatch block) and cannot open a normal SSH shell — expected behaviour for an upload-only account, not an error to fix.
For the wider picture of moving files to and from a VPS — sftp, scp, rsync and when each one fits — see transferring files to a VPS.
Frequently asked
How do I use the sftp command?
sftp user@host connects and drops you at an sftp> prompt. From there, get file downloads, put file uploads, cd/ls browse the remote side, and lcd/lls do the same locally. bye closes the session.
What port does sftp use?
22, the same port as SSH — sftp is a subsystem of the SSH protocol, not a separate service. Use sftp -P 2222 (capital P) if the server runs SSH on a non-default port.
What is the difference between sftp and ftp?
FTP sends usernames, passwords and file contents in plain text over port 21. SFTP runs entirely inside an encrypted SSH connection on port 22, using the same keys or password SSH does, and needs no extra firewall ports opened for passive mode the way FTP does.
Is scp the same as sftp?
They are closer than their interfaces suggest — scp is a single, non-interactive copy command, sftp an interactive session, but since OpenSSH 9.0 scp transfers the actual data using the SFTP protocol under the hood instead of the old rcp-based protocol.