Choosing the Right Encryption Mode in FileZilla Site Manager

The problem: one profile, many protocols

Engineers often juggle FTP, FTPS, and SFTP servers in the same workflow. FileZilla’s Site Manager lets you keep every connection in one place, but the protocol dropdown and encryption radio buttons hide decisions that affect security, compatibility, and credential safety. Picking the wrong mode can leave passwords in plain text, expose data to a man‑in‑the‑middle, or simply fail to connect behind a firewall.

Protocol and encryption options at a glance

• FTP – clear‑text, no encryption. Use only on trusted LANs.
• FTPS (Explicit) – starts on port 21, upgrades with AUTH TLS (RFC 4217). Works with most firewalls because the control channel stays on the standard port.
• FTPS (Implicit) – TLS from the first byte on port 990. Deprecated in many compliance frameworks; many modern servers disable it.
• SFTP – runs over SSH (default port 22). Supports password or public‑key authentication; the protocol handles encryption, integrity, and host‑key verification in one stack.

When you create a new site entry (File → Site Manager → New Site) the protocol selector shows all four choices. For FTPS you then choose Explicit or Implicit via radio buttons. For SFTP the encryption controls disappear because SSH already provides them.

Credential storage: master password vs. plain‑text base64

FileZilla stores every site in sitemanager.xml. Without a master password the Pass elements are only base64‑encoded — anyone with read access to the file can decode them instantly. Enabling a master password ( Edit → Settings → Interface → Master password ) encrypts the whole XML with AES‑256. The trade‑off is simple: you must type the master password once per FileZilla session. If you forget it, the stored credentials are unrecoverable.

Practical check: after setting a master password, restart FileZilla, open sitemanager.xml (located in %APPDATA%\FileZilla on Windows or ~/.config/filezilla/ on Linux/macOS) and verify that Pass values are no longer readable base64 strings.

Worked example: SFTP with an OpenSSH key

1. Generate or locate an OpenSSH private key (e.g., ~/.ssh/id_ed25519). If you only have a PuTTY .ppk, convert it first:

   puttygen key.ppk -O private-openssh -o ~/.ssh/id_ed25519

   Run this in a terminal where puttygen is installed (Windows: PuTTYgen GUI → Conversions → Export OpenSSH key).
2. Open Site Manager, click New Site, set:
   • Protocol: SFTP
   • Host: sftp.example.com
   • Port: 22
   • Logon Type: Key file
   • User: your remote username
   • Key file: browse to ~/.ssh/id_ed25519
3. Click Connect. On first connect FileZilla prompts to trust the server’s host key (TOFU). Accept only after verifying the fingerprint out‑of‑band (e.g., ssh-keyscan sftp.example.com on a trusted machine). The accepted fingerprint is stored in ~/.config/filezilla/known_hosts.
4. Enable Synchronized Browsing (Site Manager → Advanced → Default local/remote directory) so local and remote panels stay in step.

Result: a single encrypted profile that uses key‑based auth, avoids password storage entirely, and works through most NAT/firewall setups because SFTP uses a single TCP connection.

Limitation: optional master password and host‑key trust on first use

Many users skip the master password, leaving all saved credentials exposed. Additionally, FileZilla does not enforce host‑key pinning; the first‑connect prompt can be accepted blindly, opening a MITM window. Mitigation: enforce a master password policy in your team and distribute known good host fingerprints (e.g., via a shared known_hosts file) before the first connection.

Actionable closing checklist

• Set a master password today and verify sitemanager.xml encryption.
• Migrate any Implicit FTPS sites to Explicit FTPS or SFTP.
• Convert all PuTTY keys to OpenSSH format and store them outside the FileZilla config directory.
• Run the Network Configuration Wizard (Edit → Network Configuration → Auto‑detect) to align passive port ranges with your firewall.
• Test a >4 GiB upload, interrupt at 50 %, restart FileZilla, and confirm the Resume option appears — this validates large‑file resume support.

Following these steps gives you a hardened, maintainable Site Manager that scales across heterogeneous servers without sacrificing security.