Article FTP & File Management

FTP, FTPS and SFTP: which to use

Three protocols with confusingly similar names, one of which sends your password in the open. Here is what actually separates them.

iFastHosting Support Team Updated 26 August 2026 8 min read Beginner

Three protocols, three very similar names, and one meaningful difference between them that most people never think about until somebody asks whether their password was sent safely. FTP, FTPS and SFTP all do the same visible job — they move files between your computer and your hosting account — but only two of them protect what you type into the login box.

The short answer: use SFTP if your control panel offers it, FTPS if it does not, and plain FTP only when nothing else is available. The rest of this article explains why, and what each one is actually doing under the surface.

FTP — the original, and the one to avoid where you can

File Transfer Protocol dates from long before encryption was a routine expectation on the internet. It sends everything — your username, your password, and the files themselves — as plain, readable text. Anyone positioned on the network between your computer and the server, which could be a compromised router, a shared public network, or an internet provider, can read every byte of that exchange, including your login details.

It still works, and every hosting platform still supports it for compatibility with old software that has no other option. But there is no good reason to choose it deliberately when an encrypted alternative exists, because the risk it carries — a leaked password — is entirely avoidable.

Plain FTP sends your password in clear text

This is the whole reason FTPS and SFTP exist. If you connect over plain FTP on a network you do not fully trust — a hotel, a café, a shared office — assume the password could be read by someone else on that network, and change it afterwards if you have any doubt.

FTPS — FTP with encryption bolted on

FTPS is FTP with a layer of TLS encryption added around it — the same encryption technology behind HTTPS. It keeps the familiar structure of FTP, including its use of a separate command channel and data channel, but wraps both in encryption so a network observer sees scrambled traffic instead of readable text.

There are two flavours: implicit FTPS, which encrypts from the moment the connection opens, and explicit FTPS, which connects in the clear and then asks the server to switch to encryption partway through. Explicit is far more common today and is what most control panels and clients mean when they simply say "FTPS". It still uses port 21, the same port as plain FTP, which occasionally causes confusion — the port does not tell you whether a connection is encrypted, the protocol setting in your client does.

SFTP — a different protocol entirely, despite the name

Despite the similar name, SFTP is not FTP with encryption added. It is SSH File Transfer Protocol, built on top of the SSH protocol used for secure remote server access, and it works completely differently under the surface. Everything travels over a single encrypted connection on port 22, rather than the two-channel structure FTP and FTPS use.

That single-connection design has a practical side effect: SFTP tends to have fewer problems with restrictive firewalls and network address translation, because there is only one connection to worry about rather than a command channel plus a second data channel that has to be negotiated separately. This is part of why SFTP connections are often more reliable on networks with strict outbound rules, such as corporate offices.

Comparing the three directly

	FTP	FTPS	SFTP
Encrypted	No	Yes (TLS)	Yes (SSH)
Standard port	21	21	22
Underlying protocol	FTP	FTP + TLS	SSH
Firewall friendliness	Fair	Fair — two channels to allow	Good — one connection
Recommended	Only if nothing else is offered	Yes, where SFTP is unavailable	Yes — the usual first choice

Does it matter which one you pick?

For the files themselves, no — a file uploaded over FTP arrives exactly as intact as one uploaded over SFTP. What differs is what is exposed while the transfer happens. If your account or your client is compromised through a leaked FTP password, the practical outcome is the same as any other stolen login: whoever has it can read, replace or delete your website's files.

Since SFTP and FTPS cost you nothing extra — no separate purchase, no extra setup beyond selecting a different option in the same client — there is no real trade-off involved in choosing the encrypted option. The only reason to stay on plain FTP is a client or device old enough not to support anything else, which is now genuinely rare.

How to tell which one you are using

In FileZilla and most other clients, the protocol is a dropdown or a prefix on the host field rather than something implied by the port alone. Look for a setting literally labelled "FTP", "FTP over TLS" or "FTPS", and "SFTP" — they are usually presented as separate, explicit choices rather than left for the software to guess. Our guide to connecting with FTP shows where to find your account's supported options.

Switching from FTP to something encrypted

If you are currently connecting over plain FTP and want to move to something safer, nothing about your files or your website changes — only the connection method does. Check the FTP section of your control panel for which encrypted option your account supports, update the protocol setting in your client, keep the same username, and use the port your control panel lists for that protocol. If you are setting up access for someone else, such as a freelance developer, our guide to giving a developer FTP access safely covers doing that with SFTP from the start.

If a connection that used to work over plain FTP behaves differently after switching protocols — timing out, refusing to list folders, or failing partway through a transfer — that is usually a firewall or connection-mode issue rather than anything wrong with the new protocol itself. Fixing FTP connection problems covers the most common causes.