FTP, SFTP and FTPS: Three Protocols, Not Three Versions

FTP, FTPS and SFTP sound like versions of one protocol, and are not. FTP is the original file transfer protocol, in plain text. FTPS is FTP with TLS added. SFTP is a separate protocol that runs inside an SSH connection and shares nothing with FTP but its purpose and three letters.

Picture a partner who tells a team to upload reports "by SFTP" and sends a host name and port 22. The team's FTP client, set to use TLS, fails to connect, and they spend an afternoon on firewall rules.

The symptom. An FTP or FTPS client cannot talk to an SFTP server, or the reverse, and the error mentions an unexpected greeting or a protocol mismatch rather than a refused connection.

Why it happens. The names suggest a family. FTP and FTPS do share a design: a control connection on port 21 for commands, and separate data connections for each transfer, which is why they cause trouble with firewalls and NAT. FTPS adds TLS to those connections. SFTP was designed as part of SSH, uses one connection on SSH's port 22, and authenticates with SSH keys or passwords. Its specification never became an RFC, but servers and clients everywhere implement it.

What it costs. Time spent on networks and firewalls for what is a protocol mismatch. Plain FTP still turns up in old systems and sends passwords in clear text, which no current guidance accepts.

How to tell which one a server speaks. Port 22 almost always means SFTP. Connect with ssh or sftp and see an SSH greeting. Port 21 means FTP or FTPS: an FTP server greets with a line starting 220, and supports TLS if it accepts the AUTH TLS command. Port 990 usually means FTPS with TLS from the first byte. When choosing for new work, SFTP is usually simplest, because it needs one port and reuses SSH keys.