SFTP, short for SSH File Transfer Protocol and also called Secure File Transfer Protocol, is a network protocol that gives file access, file transfer and file management over a Secure Shell (SSH) connection. It replaces the earlier File Transfer Protocol (FTP) for most uses because it encrypts both the commands and the data.
History of SFTP
Creator: Tatu Ylönen with Sami Lehtinen (proprietary, 1997); IETF Secsh working group (drafts). Year: 1997.
SFTP began as a proprietary protocol of SSH Communications Security. Tatu Ylönen designed it in 1997 with help from Sami Lehtinen. The IETF later designed SFTP as an extension of Secure Shell. The same working group also drafted an extension for file transfer that runs over SSH.
The project grew from file transfer to file access and file management. Some committee members began to view SFTP as a file system protocol. That placed it beyond the scope of the working group. After a seven-year hiatus, an attempt in 2013 restarted the work. It used the version 3 draft as the baseline.
The IETF drafts are numbered from 00 to 13. Drafts 00 to 02 of version 3 came out from January 2001 to October 2001. Draft 05 of version 5 came out in January 2004. Drafts 06 to 13 defined version 6, from October 2004 to July 2006. Draft 13 specifies the text-seek, supported2 and versions extensions.
The protocol runs over a data stream, such as an SSH connection. Many clients and servers use it through the SSH connection on port 22. The sftp program in OpenSSH is the usual client.
Changelog and latest update
OpenSSH 9.0 was released on 8 April 2022. Its release notes say that scp switched from the scp and rcp protocol to SFTP by default. The quoting rules that the old protocol needed for shell characters are gone. The release notes call this an area of potential incompatibility. Quoting from the earlier style can now make transfers fail. The OpenSSH 9.0 notes place the scp change under a heading for potentially incompatible changes.
The SFTP protocol has no native way to expand a ~user path. OpenSSH 8.7 and later sftp-server support an expand-path@openssh.com extension for this. The scp client can use the legacy protocol with the -O flag. The project publishes release notes with each version, and those notes list changes to the sftp client and the sftp server.
Latest update: OpenSSH 10.6 (SFTP client and server included), 2026-10-06
OpenSSH 10.6 was released on 6 October 2026. The release notes page lists it. The release includes the sftp client and server, which implement the SSH File Transfer Protocol. The page also gives the mirror list for the download. The same page lists OpenSSH 9.0, released on 8 April 2022.
Usage examples
SFTP runs inside an SSH connection, so the user signs in with the same identity or password that SSH uses. The sftp command opens an interactive session with commands such as cd, put, get and bye. A batch file holds one command per line, and the b option runs it without prompts. The scp command also uses SFTP in OpenSSH 9.0 and later. The four examples show a session, a batch run, a directory copy and a connection with a custom port.
sftp -P 22 jane@files.example.comThe sftp command connects to the host files.example.com as the user jane. The capital P option sets the port, and 22 is the usual SSH port. After the connection opens, the prompt accepts commands such as cd, ls, put and get. The session ends with the bye command.
cd public_html
put index.html
get report.csv
byeThe batch file holds one command per line. The cd command changes to the public_html directory on the server. The put command uploads index.html, and the get command downloads report.csv. Running sftp with the b option and this file performs all four steps without a prompt.
scp -r site jane@files.example.com:www/The scp command copies the local site folder to the server through SFTP in OpenSSH 9.0 and later. The r option copies the folder and its contents. The colon separates the host from the destination folder www, which is relative to the user home directory on the server.
sftp -i ~/.ssh/id_ed25519 \
-P 2222 jane@files.example.comThe i option names the file that holds the private key the client uses for public key sign-in. The P option sets port 2222 for servers that do not listen on port 22. This command uses the same authentication as an SSH login with that key.
References
These sources are outside Websnoogie and were checked on 2026-10-12.
SSH File Transfer Protocol
Wikipedia
The encyclopedia article on SFTP. It covers the design goals and the IETF draft history. It describes the proprietary origin in 1997 and the OpenSSH implementation. Each draft is listed with its date.
SSH File Transfer Protocol, draft-ietf-secsh-filexfer-13
IETF Datatracker
The last Internet Draft of the SFTP protocol, dated July 2006 in the series. It defines the packet types and file attributes. It also defines the version 6 extensions. Implementers use it as the reference for message formats.
OpenSSH Release Notes
OpenSSH project
The release notes for each OpenSSH version. They include OpenSSH 9.0 from 8 April 2022, which made SFTP the default for scp. They also include OpenSSH 10.6 from 6 October 2026. Each entry lists its changes.
OpenSSH Manual Pages
OpenSSH project
The manual pages for the sftp, scp and ssh commands. Each page lists the options and the batch mode. It also lists the configuration keys. The examples on this page use the port and identity file settings.
RFC 4251: The Secure Shell (SSH) Protocol Architecture
RFC Editor (IETF)
The IETF document from January 2006 that describes the architecture of the Secure Shell protocol. It defines the transport, authentication and connection layers. It states the security goals of the protocol suite. It is the base that SFTP runs on.
Secure transfers start with a check of the login
The first thing we check on a client site is who can log in, and how. SFTP, or SSH File Transfer Protocol, moves site files over an encrypted connection. A plain FTP login can expose a password while it travels. An SFTP connection scrambles that data from end to end, so a stranger on the same network cannot read it.
Non-CMS (HTML/PHP) hosting is $129 a year and includes free SSL. CMS (WordPress) hosting is $149 a year. Free SSL puts the padlock on your site, so visitors know the pages they load are protected. Both hosting plans are built to keep your site private and steady.
Our hosting carries 99.999% uptime, so your site and your file server stay reachable. When we move files for you, we use the secure method and review the login accounts on the site. We remove any account that no longer needs access.
Send us your current login method and the folders you need to reach. We will reply with a plan and a price, and we will tell you exactly what we will change. Call 402-813-4034 to talk it through.
