Use Linux’s built-in OpenSSH sftp client to move files through an encrypted SSH connection. Connect with sftp user@host, verify the remote and local working directories, then use get to download or put to upload. For scheduled transfers, place commands in a batch file and authenticate with an SSH key rather than a password.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SFTP is and why to use it
SFTP is OpenSSH’s file-transfer program. The sftp(1) manual describes it as a file-transfer program similar to FTP that performs all operations over an encrypted SSH transport. Your files, commands and authentication exchange travel through that SSH connection instead of an unencrypted file-transfer session.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The client is useful for both one-off work and repeatable jobs. An interactive session lets you inspect directories and decide what to transfer. Batch mode reads commands from a file or standard input, making it suitable for deployment or backup scripts when authentication does not require an interactive password prompt.
What you need before connecting
- An OpenSSH client with the
sftpcommand installed on your Linux machine. - A server name or address, a user account, and an account that is allowed to use the server’s SFTP subsystem.
- Permission on the remote path you intend to read, write, create or remove.
- One of the authentication methods configured by the server: a password, an SSH public key, or another SSH-compatible method.
The exact options and extensions depend on the OpenSSH version shipped by your distribution. Use the installed manual with man sftp and the interactive help command when a flag behaves differently from an example written for another release.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Connect from the Linux shell
Run sftp followed by the account and host. The command opens an interactive prompt named sftp> after the SSH connection and authentication succeed.
sftp [email protected]
sftp -P 2222 [email protected]
sftp -i ~/.ssh/id_ed25519 [email protected]
sftp [email protected]:/var/tmp| Command form | Use |
|---|---|
sftp [email protected] |
Connect to the host using its default SSH connection settings and the server’s normal authentication methods. |
sftp -P 2222 [email protected] |
Use a server listening on a non-default SSH port. The capital -P is the SFTP client’s port option. |
sftp -i ~/.ssh/id_ed25519 [email protected] |
Select a particular private-key identity instead of relying on the client’s default key selection. |
sftp [email protected]:/var/tmp |
Connect and request /var/tmp as the initial remote directory. |
First-connection checks
On a new host, SSH may display the server host key and ask whether you trust it. Confirm it only after checking the fingerprint through a trusted channel or the server administrator. A host-key warning on a previously known server deserves investigation rather than an automatic confirmation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11After the connection opens, the prompt changes to:
sftp>If authentication fails, verify the account name, host name, port and identity path before changing files or permissions. The troubleshooting section below shows how to obtain detailed SSH diagnostics.
Understand local and remote locations
SFTP maintains two working directories: one on the server and one on your Linux machine. The commands look similar, so check both before every important transfer.
| Command | Filesystem affected | Purpose |
|---|---|---|
pwd |
Remote | Print the server-side working directory. |
ls |
Remote | List entries in the current remote directory. |
cd directory |
Remote | Change the remote working directory. |
lpwd |
Local | Print the local working directory used for transfers. |
lls |
Local | List entries on the local machine. |
lcd directory |
Local | Change the local working directory. |
A safe inspection sequence is:
sftp> pwd
sftp> lpwd
sftp> ls -la
sftp> lls -la
sftp> cd incoming
sftp> lcd ~/DownloadsThe -la options in this example request detailed directory listings. If your server or client handles listing options differently, run help ls or consult man sftp. Keeping the l prefix in mind—lpwd, lls and lcd are local—prevents a transfer from using an unintended directory.
Download files with get
get copies data from the remote host to the local machine. With one argument, the client uses the remote name as the local name in the current local directory.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sftp> get report.csv
sftp> get /remote/path/report.csv ./report.csvThe second form specifies both sides explicitly. Use it when you are downloading into a particular local directory, changing the filename, or working with paths that could otherwise be confused with the current directories.
Download a directory
For a directory tree, use the recursive form supported by your installed client, for example:
sftp> get -r remote_dirRecursive behavior and related options can vary between OpenSSH releases. Before moving a large tree, run help get inside the session or read the local sftp manual. Confirm the local destination with lpwd first; a recursive download can create many files beneath that directory.
Upload files with put
put copies a local file to the remote host. The default remote name follows the local filename.
sftp> put ./build.tar.gz
sftp> put ./build.tar.gz /incoming/build.tar.gzUse the two-argument form to choose the remote directory or name. Check that the account can write to the destination and that the destination directory exists. If a transfer appears to succeed but the application cannot find the file, run pwd and ls to verify where it was placed.
Upload a directory
The recursive equivalent is available on current OpenSSH clients, such as:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sftp> put -r local_dirBecause option details are release-dependent, verify the syntax with help put or man sftp on older systems. Set the local location with lcd and inspect it with lls before starting a recursive upload.
Manage remote files and inspect space
An SFTP session can do more than transfer data. These commands operate on the remote filesystem and should be used with the same care as their shell equivalents:
sftp> mkdir incoming
sftp> rename old.txt archive/old.txt
sftp> rm failed-upload.tmp
sftp> df -h
sftp> byemkdircreates a remote directory when the account has permission.renamechanges a remote file’s name or moves it within a filesystem path supported by the server.rmdeletes a remote file. Treat it as destructive; SFTP does not provide a general undo command.df -hrequests remote filesystem statistics in a human-readable form when the server supports that operation.byecloses the session cleanly.
The manual also documents remote permission and metadata commands such as chmod, chown, chgrp, link operations and filesystem-statistics commands. Their availability and effect depend on server support and your account’s privileges. Ownership changes are commonly restricted to administrators, so do not assume that a successful connection grants them.
Choose an authentication method
| Method | Best fit | Important limitation or requirement |
|---|---|---|
| Password | Occasional, attended sessions | Requires an interactive prompt and therefore does not work for a batch job that has no way to answer that prompt. |
| SSH public key | Regular access and automation | The matching public key must be authorized for the account on the server; protect the private key and select it with -i when necessary. |
| FIDO2-backed SSH key | Accounts needing hardware-backed key protection | Requires an OpenSSH 8.2-or-newer client build with FIDO support, such as support provided by libfido2. Hardware interaction policies can make it unsuitable for unattended jobs. |
Use an SSH key with SFTP
Because SFTP inherits SSH authentication and connection options, ordinary SSH public-key setup also applies here. Once the server has authorized the public key, select the corresponding private key explicitly:
sftp -i ~/.ssh/id_ed25519 [email protected]Check that the path is correct and that the private key is protected with appropriate filesystem permissions. If an SSH agent is being used, verify that the intended key is loaded; otherwise the client may offer a different identity or exhaust its available keys before trying the one you expected.
FIDO2 hardware-backed keys
FIDO2 SSH keys are optional; ordinary SFTP does not require a security key. Yubico’s SSH guidance identifies two FIDO-backed key types, ed25519-sk and ecdsa-sk. It requires OpenSSH 8.2 or newer and an OpenSSH build compiled with FIDO support. Additional capabilities have their own minimum versions:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Capability | Minimum OpenSSH version stated in the guidance |
|---|---|
| FIDO2-backed SSH key types | 8.2 or newer, with FIDO support in the build |
| Downloading a resident key | 8.3 or newer |
verify-required support |
8.4 or newer |
Check the OpenSSH version and build features on the machine that will actually run SFTP. A key created on one system is not proof that another distribution’s client supports the same FIDO options.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Automate transfers with batch mode
Batch mode reads SFTP commands from a file or standard input. It is the right choice for a repeatable transfer, but it cannot stop for an ordinary interactive password prompt. Configure public-key authentication or another non-interactive method before scheduling a batch job.
Create a batch file
Create a file named upload.sftp containing only SFTP commands:
lcd ./dist
cd /incoming
put app.tar.gz
put checksums.txt
byelcd selects the local source directory, cd selects the remote destination, and each put uploads one file. The final bye makes the intended end of the session explicit.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Run the batch file
sftp -b upload.sftp [email protected]Use the same host, port and identity options you would use interactively when the server requires them. For example, add -P for a non-default port or -i to select a private key. Test the exact command in an interactive session first so you can confirm the remote path, filenames and permissions.
Make a scheduled job dependable
- Use a key or other non-interactive authentication; a scheduled process cannot answer a password question.
- Use absolute or deliberately chosen local and remote paths, and verify them with
lpwdandpwdduring testing. - Capture the process exit status and logs so a failed transfer is visible to the scheduler or monitoring system.
- Understand the client’s failure behavior. The manual documents a per-command prefix that can suppress termination when that exception is intentional; use it only after deciding which failures are safe to ignore.
- Keep the batch file and private key protected from other local users, and avoid placing secrets directly in command-line arguments or the batch file.
A batch file is a set of SFTP commands, not a shell script. Shell variables, conditionals and loops do not become available inside it unless you generate the file or wrap SFTP in a separate shell program.
Interactive commands or batch mode?
| Situation | Prefer | Reason |
|---|---|---|
| You need to browse an unfamiliar directory | Interactive session | You can inspect pwd, ls, lpwd and lls before choosing files. |
| You are moving one or two known files manually | Interactive get or put |
It keeps the operation visible and lets you respond to authentication prompts. |
| A deployment or backup runs repeatedly | Batch mode with a key | The commands are repeatable and do not depend on a person typing responses. |
| You need stronger protection for an attended administrator account | FIDO2-backed SSH key, if supported | The private-key operation can be backed by hardware, subject to the client’s version and build support. |
Troubleshoot a failed SFTP connection or transfer
| Symptom | Checks and corrective action |
|---|---|
| The client cannot connect | Run sftp -vvv user@host to view SSH negotiation and authentication diagnostics. Confirm the hostname, username and port, including any required -P option. |
| Authentication is rejected | Check the identity path supplied with -i, the private key’s local permissions, the SSH-agent state and the server-side authorized public key. Confirm that the account is permitted to use SFTP. |
| The login works but a directory is missing | Run pwd and ls. The account may start in a restricted directory, or the requested path may be outside its visible filesystem. |
| A download or upload uses the wrong location | Run lpwd and pwd immediately before the transfer. Use lcd or cd to select the intended side. |
| A file cannot be uploaded or a directory cannot be created | Check write and create permissions on the remote target, confirm that the path exists, and verify that the server exposes an SFTP subsystem for the account. |
| Recursive syntax fails | Run help get or help put and read the installed man sftp. Recursive flags and extensions can differ between OpenSSH releases. |
| A batch job stops unexpectedly | Remove assumptions about interactive prompts, use non-interactive authentication, capture the exit status and logs, and inspect which command failed. Apply the manual’s failure-suppression prefix only to commands whose failure is explicitly acceptable. |
| A FIDO2 key option is unknown | Check the OpenSSH version and whether the distribution’s build includes FIDO support. The documented minimum is 8.2 for FIDO-backed key types, with newer features requiring 8.3 or 8.4 as specified above. |
A cautious first transfer
- Connect with the correct account, host, port and identity file.
- Validate the server host key rather than accepting an unexpected change automatically.
- Run
pwdandlpwdto identify both working directories. - Use
lsandllsto confirm the source file and destination directory. - Transfer one small, known file with
getorput. - List the destination and check the resulting filename before attempting a recursive operation.
- Close the session with
bye.
Once that path works interactively, convert the known-good sequence into a batch file for repeatable use. Keep authentication, path selection and error handling explicit so a changed working directory or expired key does not silently redirect the transfer.
Essential command reference
| Command | Direction or scope | Typical use |
|---|---|---|
get remote [local] |
Remote to local | Download a file, optionally choosing the local name. |
put local [remote] |
Local to remote | Upload a file, optionally choosing the remote name. |
get -r remote_dir |
Remote to local | Recursively download a directory when supported by the installed client. |
put -r local_dir |
Local to remote | Recursively upload a directory when supported by the installed client. |
pwd, cd, ls |
Remote | Inspect or change the server-side location. |
lpwd, lcd, lls |
Local | Inspect or change the client-side location. |
mkdir, rename, rm |
Remote management | Create, rename or remove remote entries, subject to permissions. |
df -h |
Remote filesystem | Request human-readable filesystem statistics when supported. |
bye |
Session | End the SFTP connection. |
For a complete list of commands and release-specific options, use help at the sftp> prompt and read the local sftp(1) manual. That local documentation is the authority for the client actually installed on your Linux system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
