What is the Difference Between FTP, FTPS and SFTP?

Today, mostly used protocols for file transfers are FTP, FTPS and SFTP. It is of great importance to understand what your options are and what advantages each one has. It's too easy to get confused so let's point some key differences between them.

FTP ( File Transfer Protocol) :

File transfer Protocol is well known and commonly used for about 40 years now. The FTP typically  runs on port 21, responsible for communication and commands exchange between the FTP client ( such as Filezilla) and the server. There the so called Command Connection takes effect. After authenticating by username and password, the client and the server will establish a new common port , known as Data Connection, over which the files will be transferred. 

As far as security is concerned, we can tell it is not a priority here. The information is transmitted in plain text – data is  left unencrypted and unprotected over the Internet. This makes FTP pretty untrusted.

FTPS (FTP over SSL) :

As an alternate solution here comes the FTP over SSL, or FTPS.A set of security extensions were added to the old FTP so that it allows encryption on both command and data connections. That is actually greater than it sounds, since SSL connection is time-consuming and it can be a heavy job to negotiate it twice.  The certificate is installed on the server, so all you need to do is configure your preferred client.

FTPS is running  on port 990 but can also run on port 21 – these are respectively the Implicit FTPS and the Explicit FTPS. Once a call is made through port 990, the presumption is that the client intends to use SSL or otherwise the connection will be refused by the server.

Both encrypted and unencrypted connections can be supported on port 21. Clients who wish to use SSL via that port will need to explicitly request that the server switch to the encrypted channel by sending command AUTH TLS ot AUTH SSL. Only after that the SSL handshake takes place and a secure connection is settled. This process gives the opportunity to act according to your current needs – activate high security level or enjoy faster communication when simple  files are uploaded.

SFTP (Secure FTP) :

Secure File Transfer Protocol is comparatively new protocol evolved in the 1990s. The data transfer is possible over the SSH (Secure Shell protocol) also used for secure tunnel access to remote devices. Unlike FTPS, the SFTP does not use two separate channels – all the information is encrypted in packets and sent via a single connection, usually on port 22. Single super secure connection, in fact. Sessions can be even further protected by public and private keys. They can be used as an alternative way of authentication or on top of the regular username and password authentication. Another asset is that the SFTP can serve much more detailed information about the files – date and time of creation, size, etc. - something not available to FTP.