![\"BackendsideFTP](\"https:\/\/backendside.com\/images\/backendsideftp_logorect.png\")
FTP, FTPS, SFTP — what each one actually is<\/h2>\n
The three protocols people lump together are radically different on the wire. Knowing which is which is the difference between a transfer that’s safe and one that’s broadcasting credentials to anyone on the network.<\/p>\n
- \n
- FTP<\/strong> (RFC 959, 1985) — the original. Two TCP channels: control on port 21, data on a separate negotiated port. Everything is plaintext<\/strong>, including the username and password. Active and passive modes exist to work around NAT, but neither adds encryption. Still appropriate inside a closed LAN; never appropriate over the internet.<\/li>\n
- FTPS<\/strong> — the same FTP protocol, wrapped in TLS. Comes in two variants: explicit<\/strong> FTPS, which starts on port 21 and upgrades the connection with an
AUTH TLS<\/code> command, and implicit<\/strong> FTPS, which expects TLS from the first byte on port 990. The protocol is otherwise identical to FTP; the difference is that the wire is now encrypted, the server certificate is verified, and credentials can’t be sniffed.<\/li>\n- SFTP<\/strong> — not<\/em> “FTP with an S”. A completely separate protocol, defined as part of the SSH-2<\/strong> spec (RFC 4253 plus the SFTP draft), running over a single encrypted SSH channel on port 22. Authenticates with a password or, much better, an SSH private key<\/strong>; verifies the server with the host’s SSH public key fingerprint. Modern, well-understood, and what almost every Linux server you connect to is offering you.<\/li>\n<\/ul>\n
The short version: FTP is the diary you read on a billboard. FTPS is the diary in a TLS envelope. SFTP is the diary in a vault.<\/strong> A modern client must speak all three — many corporate environments still require FTPS, and many appliances still only offer FTP — but it should default people toward SFTP whenever possible.<\/p>\n
Security in the AI era is more than the wire<\/h2>\n
Encrypting the bytes in flight is necessary, but it is not where modern file-transfer security ends. The interesting risks in 2026 are around<\/em> the transfer:<\/p>\n
- \n
- Credential exposure.<\/strong> An attacker who lifts your
.ftpconfig<\/code>,filezilla.xml<\/code> or browser-saved password gets every site you’ve ever connected to. Any client that writes credentials to disk in plaintext is a vulnerability waiting to happen. Encrypting them at rest, tied to the OS user account, is now baseline.<\/li>\n- Host-key trust on first connect.<\/strong> SFTP’s security model only works if you actually verify the server’s SSH host key. Clients that auto-trust on first connect (and never warn when the fingerprint changes) silently lose the man-in-the-middle protection SSH was designed to give you.<\/li>\n
- TLS certificate validation for FTPS.<\/strong> The same problem in the TLS world. A client that doesn’t verify the server’s certificate — or that lets you click through a warning with no fingerprint-pinning — turns FTPS into “FTP with extra steps.”<\/li>\n
- The AI-pipeline blast radius.<\/strong> Model files and training datasets are often dozens of gigabytes. Large, slow transfers are also the worst possible time for a credential or trust mistake — nobody is going to interrupt a 4-hour upload to read a host-key warning carefully. Getting the trust decisions right before<\/em> the bytes start moving is non-negotiable.<\/li>\n
- Workflow leakage.<\/strong> An AI assistant that pastes a connection string with credentials into a chat window is a 2026 problem nobody had in 2015. The client’s job is to make the credentials live in the client, not in shared text.<\/li>\n<\/ul>\n
- Host-key trust on first connect.<\/strong> SFTP’s security model only works if you actually verify the server’s SSH host key. Clients that auto-trust on first connect (and never warn when the fingerprint changes) silently lose the man-in-the-middle protection SSH was designed to give you.<\/li>\n
- FTPS<\/strong> — the same FTP protocol, wrapped in TLS. Comes in two variants: explicit<\/strong> FTPS, which starts on port 21 and upgrades the connection with an