Choosing Between FTP, FTPS, and SFTP in FileZilla: A Decision Guide

Decision and Constraints

You need to move files with FileZilla but must satisfy security, firewall, and performance requirements. The choice of transfer protocol determines whether data is encrypted, which ports must be open, and what credentials you manage.

Option Comparison

Protocol	Default Port	Encryption	Firewall Impact	Typical Auth
FTP (plain)	21	None	Only control port; data ports needed in active or passive mode	Username/password
FTPS Explicit	21	TLS on control channel (optional on data)	Control port 21 plus passive data port range	Username/password (certificate trust)
FTPS Implicit	990	TLS from start	Same as explicit plus data ports	Username/password
SFTP	22	SSH encrypts both control and data	Single port (22) – easier NAT/firewall	Password or SSH key

Trade‑offs

• FTP is simplest to configure but sends credentials and data in clear text – unsuitable for sensitive information.
• FTPS adds TLS encryption. Explicit FTPS uses the same port as plain FTP and upgrades with AUTH TLS, but the protocol may open separate data connections that must be allowed by firewalls. You also need to manage server certificate trust.
• SFTP encrypts everything over a single SSH port, reducing firewall complexity. Authentication relies on SSH keys or passwords, so you must protect the private key and verify the host key on first connect.

Configuring FTPS Explicit in FileZilla

1. Open FileZilla and choose File → Site Manager.
2. Click New Site, name it (e.g., Example FTPS).
3. Set Protocol to FTP – FTP over TLS (Explicit encryption).
4. Enter the Host (e.g., ftp.example.com) and keep Port at 21 unless your server uses a different one.
5. Choose Logon Type Normal, fill in User and Password.
6. Under the Transfer Settings tab, select Passive transfer mode.
7. Click Connect.

Validating the Connection

After connecting, watch the top message log. A successful FTPS explicit session should show lines similar to:

Status: Resolving address of ftp.example.com
Status: Connecting to 203.0.113.10:21...
Status: TLS connection established.
Status: Logged in
Status: Retrieving directory listing...

If you see TLS connection established followed by Logged in without any 530 Login authentication failed or TLS handshake errors, the encryption layer is active.

To confirm the data channel works, transfer a small test file (e.g., a 100 KB text file). In the transfer queue, check that the Transferred size matches the source file size reported by your local file explorer. Equality indicates the TLS‑protected data stream transferred the file without corruption.

Limits and Practical Checks

• FTPS explicit requires the server’s passive port range to be open on any intermediate firewalls; otherwise the TLS handshake succeeds but data transfers hang.
• If the server’s TLS certificate is self‑signed or issued by an unknown CA, FileZilla will abort unless you explicitly trust it (not recommended for production).
• For environments where opening additional ports is problematic, SFTP may be preferable because it only needs port 22.