File transfer protocols

FTP (RFC 959) holds a text conversation on a control connection to port 21 (USER, PASS, LIST, RETR, STOR) and moves listings and files over a separate data connection. In active mode the server connects back to the client; in passive mode (PASV) the client connects to a port the server names, which gets through firewalls more easily. Everything, the password included, crosses the network as plain text.

FTPS keeps FTP and adds TLS, either after an AUTH TLS command on port 21 (explicit) or from the first byte on port 990 (implicit). SFTP, despite the name, isn’t FTP at all: it’s a binary request and response protocol that runs as the sftp subsystem inside an SSH session, usually on port 22, with commands and data on the same connection.

SFTP is usually the easier choice: one port, SSH keys for login, and no second connection to open in a firewall. FTPS suits partners whose tools expect FTP with certificates. Plain FTP belongs only on networks where nobody else can listen.