Choosing FTPS Explicit vs. SFTP in FileZilla: A Practical Decision Guide

Decision Context

FileZilla supports three secure transfer modes: FTPS (explicit and implicit) and SFTP. In most production environments, the choice boils down to FTPS explicit versus SFTP. The decision hinges on firewall constraints, performance expectations, and certificate management needs.

Key constraints to consider:

• Firewall behavior – FTP streams can be inspected and blocked; SFTP uses a single port that is usually allowed.
• Server support – Does your host provide SSH (for SFTP) or an FTP server that can negotiate TLS?
• Client compatibility – Legacy clients may lack SFTP support.
• Certificate trust – FTPS requires a valid TLS certificate; self‑signed certs trigger warnings.
• Performance – Large file throughput can differ due to protocol overhead.

Comparison Table

Feature	FTPS (Explicit)	SFTP	Comments
Control channel encryption	TLS negotiated over port 21	SSH over port 22	Both are encrypted
Data channel encryption	TLS per data connection (passive mode)	Encrypted within SSH session	SFTP avoids separate data sockets
Default port	21 (or 990 for implicit)	22	Port 21 often inspected by firewalls
Firewall compatibility	May be blocked by FTP inspection	Generally allowed; single port	Prefer SFTP in strict firewall environments
Performance (large files)	Higher packet overhead, possible throttling	Lower overhead, better throughput	Use SFTP for bulk data
Server requirements	FTP server with TLS support	SSH server with SFTP subsystem	Check available services on host
Certificate management	Requires CA‑signed or trusted self‑signed cert	Uses SSH host key; easier to trust	Consider trust chain complexity
Client compatibility	Supported by most FTP clients	Requires SFTP‑capable client	Legacy environments may lack SFTP support
Overhead	Separate control and data sockets, TLS handshake per data transfer	Single encrypted channel, no separate data socket	SFTP reduces connection churn

Trade‑Offs

Security – Both protocols provide strong encryption. FTPS relies on TLS certificates; SFTP relies on SSH host keys. If you already maintain an SSH infrastructure, SFTP may be simpler.

Firewall friendliness – SFTP’s single port (22) is less likely to be blocked. FTPS explicit may be intercepted or dropped by deep‑packet inspection. If your network enforces strict FTP filtering, SFTP is the safer bet.

Performance – FTPS can suffer from TLS renegotiation on each data connection, especially in passive mode. SFTP keeps all traffic in one encrypted stream, resulting in lower overhead for large files.

Client support – Almost all FTP clients understand FTPS explicit. SFTP requires a client that implements the SSH File Transfer Protocol. Verify that your team’s tools support SFTP before committing.

Certificate complexity – FTPS demands a valid TLS certificate. If you only have a self‑signed cert, you’ll need to add it to the client’s trusted store to avoid warnings. SFTP’s SSH host key can be accepted with a simple prompt or added to the known_hosts file.

Concrete Implementation Example

Below is a step‑by‑step configuration for both protocols in FileZilla Client (version 3.70+). All commands are executed locally on the client machine; no elevated privileges are required.

1. FTPS (Explicit) Configuration

# Open FileZilla Client
# 1. Go to File → Site Manager
# 2. Click "New Site" and name it "FTPS-Example"
# 3. In the "General" tab:
#    Host: ftps://example.com
#    Port: 21
#    Protocol: FTP - File Transfer Protocol
#    Encryption: Require explicit FTP over TLS
#    Logon Type: Normal
#    User: your_username
#    Password: your_password
# 4. Click "Connect"
# 5. In the status bar, look for the lock icon indicating TLS encryption.

After connecting, FileZilla will perform a TLS handshake on the control channel and negotiate TLS for each data channel in passive mode. If the server presents a self‑signed certificate, you’ll see a warning; you can add the cert to the trusted store to suppress it.

2. SFTP Configuration

# Open FileZilla Client
# 1. Go to File → Site Manager
# 2. Click "New Site" and name it "SFTP-Example"
# 3. In the "General" tab:
#    Host: sftp://example.com
#    Port: 22
#    Protocol: SFTP - SSH File Transfer Protocol
#    Logon Type: Normal (or Key file if using SSH keys)
#    User: your_username
#    Password: your_password (or leave blank for key authentication)
# 4. Click "Connect"
# 5. The status bar will show a lock icon and the SSH banner.

For key‑based authentication, place your private key in the default location (%APPDATA%\FileZilla\ssh\id_rsa on Windows, ~/.ssh/id_rsa on Linux/macOS) and select it in the "Key file" field.

Verification & Validation

After establishing a session, verify the protocol by inspecting traffic with Wireshark or a similar packet capture tool:

1. Start Wireshark and capture on the interface used for the connection.
2. Filter for tcp.port==21 for FTPS or tcp.port==22 for SFTP.
3. For FTPS, you should see a TLS handshake (ClientHello, ServerHello) on port 21, followed by encrypted data packets.
4. For SFTP, the capture will show SSH packets on port 22; the payload will be opaque, confirming encryption.

Alternatively, use FileZilla’s status bar: a lock icon indicates an encrypted session. For FTPS, the icon appears after the TLS handshake on the control channel; for SFTP, it appears immediately upon connection.

Limitations & Practical Checks

• Both protocols require the server to be configured accordingly. If the host only offers plain FTP, FTPS explicit will fail.
• FTPS explicit can be blocked by network devices that inspect FTP traffic. If you encounter a connection timeout, test with SFTP first.
• Self‑signed TLS certificates in FTPS may trigger client warnings unless explicitly trusted. Use a CA‑signed cert for production deployments.
• Large file transfers may still be limited by the underlying network bandwidth; protocol choice alone will not overcome physical constraints.

To confirm a successful secure transfer, perform a test upload of a small file and verify the file’s integrity on the server. Use a checksum tool (e.g., sha256sum) before and after the transfer to ensure no corruption.

By evaluating firewall policies, server capabilities, and performance requirements, you can choose the protocol that best fits your environment. The configuration steps above provide a quick path to set up either FTPS explicit or SFTP in FileZilla and verify the connection’s security status.