Skip to content
shellmap

sftp — Interactive file transfer over SSH — the secure replacement for FTP across all 5 shells

Equivalents in every shell

Bashunix
sftp user@host

Opens an interactive file-transfer session over SSH (port 22). Drops you at an `sftp>` prompt with `get`, `put`, `ls`, `cd`, `lcd`. Uses the SAME SSH credentials (keys, agent, `~/.ssh/config`) as `ssh user@host` — there is no separate SFTP server config beyond `Subsystem sftp` in `sshd_config`.

Zshunix
sftp user@host

Same external (OpenSSH `sftp(1)`). macOS bundles it in the base system. `~/.ssh/config` `Host` aliases resolve, so `sftp prod` picks up the right user / port / key automatically.

Fishunix
sftp user@host

Same external. Fish has shell-level completion for known SSH hosts (`~/.ssh/config` + `~/.ssh/known_hosts`) so tab-completing `sftp <space>` lists configured hosts.

PowerShellwindows
sftp user@host

Available on Windows 10 1803+ as part of OpenSSH Client (`Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0`). Identical syntax to Unix. For pipeline-friendly scripted use, the third-party `Posh-SSH` module's `Get-SFTPFile` / `Set-SFTPFile` cmdlets return PSObjects you can pipe.

cmd.exewindows
sftp user@host

Same OpenSSH binary as PowerShell once OpenSSH Client is enabled. For unattended runs use `sftp -b batchfile user@host` — but the batch file CANNOT prompt for passwords; key-based auth or `ssh-agent` is mandatory.

Worked examples

Copy a single file FROM the remote host

Bash
sftp user@host:/var/log/syslog ./
PowerShell
sftp user@host:/var/log/syslog .

Run a batch of SFTP commands non-interactively

Bash
sftp -b commands.txt user@host
PowerShell
sftp -b commands.txt user@host
cmd.exe
sftp -b commands.txt user@host

Recursively mirror a remote directory to local

Bash
sftp user@host <<< $'get -r /remote/dir local/'
PowerShell
'get -r /remote/dir local/' | sftp user@host

Gotchas

  • `sftp` is SSH's file-subsystem — NOT FTP-over-SSL/TLS. The two share only a name fragment. `FTPS` (port 990 or 21 with `AUTH TLS`) is the FTP family wrapped in TLS; `SFTP` (port 22) is SSH's subsystem. The tools, server config, and even authentication models are completely different — verify which protocol the remote actually speaks before switching tools.
  • `scp` was the historical OpenSSH file-copy command. OpenSSH 9.0+ (April 2022) switched `scp` to use the SFTP protocol UNDER THE HOOD by default. The user-visible flags are similar but edge cases (`scp -r dir/.` vs `scp -r dir`) behave subtly differently. New scripts should use `sftp -r` or `rsync -e ssh` directly.
  • SFTP follows SSH's `~/.ssh/config` — `Host`, `User`, `Port`, `IdentityFile`, `ProxyJump`. Setting `IdentityFile ~/.ssh/id_ed25519` in `~/.ssh/config` makes `sftp prod` work without passing keys on the command line. The Windows OpenSSH client respects the same file under `%USERPROFILE%\.ssh\config`.
  • `sftp -b batchfile` is the documented non-interactive mode. It STOPS on the first error (no `set -e` equivalent needed) and CANNOT prompt for passwords — key-based auth or `ssh-agent` is mandatory. For password-only servers, an interactive wrapper (`expect` on Unix, `Posh-SSH` on Windows) is the only option.
  • SFTP transfers go through ONE SSH connection sequentially — no parallel streams. For multi-GB transfers over high-latency links `rsync -e ssh --partial --progress --bwlimit=10M` is significantly faster because it can resume partial files and pipeline the metadata. Plain `sftp get` of an interrupted transfer starts over from byte zero.

WSL & PowerShell Core notes

pwshOnce OpenSSH Client is installed (`Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0`), `sftp` works identically on Windows, Linux, and macOS pwsh. For pwsh-idiomatic, pipeline-friendly SFTP work the third-party `Posh-SSH` module's `Get-SFTPFile` / `Set-SFTPFile` cmdlets return PSObjects with predictable error semantics.
WSLWSL Linux's `sftp` is independent of the Windows OpenSSH client — different `~/.ssh/config`, different `known_hosts`. To share credentials, either symlink `~/.ssh` from WSL to `/mnt/c/Users/<you>/.ssh` (watch permissions — sshd refuses 0777 keys) or `cp` the key files into both locations and `chmod 600` the WSL side.

Related commands