How to Connect to an SFTP Server from a Mac

SFTP is the easiest of the file transfer protocols to use from a Mac, because macOS already has everything it needs: the OpenSSH client is part of the system, and any server you can reach with ssh almost certainly accepts SFTP too. There’s nothing to install and no service to enable on the server.

What the Mac doesn’t have is a graphical way in. The Finder’s Connect to Server doesn’t understand sftp://, so it’s either the Terminal or an app. This guide covers both. For plain FTP and FTPS, see connecting to an FTP server on a Mac.

What you need from your host

• Host name or IP address — example.com, 203.0.113.10.
• Port — 22 unless your host says otherwise. Some move SSH to 2222 or another port to cut down on automated login attempts.
• Username — the SSH/SFTP user, which on shared hosting is often different from the control-panel login.
• A password or an SSH key — keys are stronger and, once set up, more convenient.

If your host only lists “FTP” credentials with port 21, that is not SFTP: it’s FTP or FTPS. The differences between SFTP and FTPS explain why the names mislead.

Connecting from the Terminal

Open Terminal (Applications ▸ Utilities) and run:

sftp deploy@example.com

Variants you will need sooner or later:

# A non-standard port — note the capital P (lowercase -p means something else)
sftp -P 2222 deploy@example.com

# A specific private key
sftp -i ~/.ssh/id_ed25519 deploy@example.com

# Start straight in a folder
sftp deploy@example.com:/var/www/html

The first time you connect, you’ll see the server’s host key fingerprint and a question: Are you sure you want to continue connecting (yes/no/[fingerprint])?. That’s SSH asking you to confirm you’re talking to the right machine. Compare it with the fingerprint your host publishes if you can, then type yes. The key is saved in ~/.ssh/known_hosts and checked on every later connection. Certificates and host keys explains why this step matters.

The sftp commands you actually need

Once you see the sftp> prompt, commands without a prefix act on the server, and the same commands prefixed with l act on your Mac:

Tab completion works on remote paths too, which makes long paths bearable.

Save typing with ~/.ssh/config

If you connect to the same server often, give it an alias. Create or edit ~/.ssh/config:

Host mysite
    HostName example.com
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Now sftp mysite is enough, and the same alias works for ssh and scp. Servers reachable only through a jump host take one extra line, ProxyJump bastion — see file transfer through a bastion.

Quick one-off copies: scp and rsync

For a single command without an interactive session:

# Copy one file up
scp index.html mysite:/var/www/html/

# Mirror a folder, sending only what changed (needs rsync on the server as well)
rsync -avz --dry-run ./public/ mysite:/var/www/html/

Drop --dry-run once the list of files looks right. rsync is the right tool for scripted deploys; modern scp actually uses the SFTP protocol under the hood.

Using a graphical client

The Terminal is fine for a quick put, but it doesn’t show you both sides at once, can’t preview a file, and makes you retype paths. A dual-pane client is faster for daily work. In Upstream it takes five steps.

Step by step

1. Create a site — press ⌘N, choose SFTP, and enter host, port and username.
2. Choose how to log in — a password, which is stored in the macOS Keychain, or a private key (ed25519 or RSA, with its passphrase if it has one). Pick the private key file, not the .pub.
3. Or import what you already have — if your servers are already in ~/.ssh/config, import them: host, user, port, key and jump host come across.
4. Connect and verify the host key — on first connection the app shows the server’s fingerprint; check it and trust it. If it ever changes, you’ll be warned before anything is sent.
5. Work in two panes — your Mac on the left, the server on the right. Drag files between them or from the Finder, press the spacebar for Quick Look, and let the transfer queue resume anything interrupted.

SFTP, SSH keys and the site import are all in Upstream’s free tier.

When it doesn’t connect

Permission denied (publickey) — the server only accepts keys and didn’t accept yours. Check that the public key is in ~/.ssh/authorized_keys on the server, that you’re using the right username, and that the key file’s permissions are tight (chmod 600 ~/.ssh/id_ed25519). If the key works in Terminal but not in an app, these are the usual causes.

Permission denied (password) or repeated password prompts — wrong password, wrong user, or password login is disabled on the server.

Connection refused — nothing is listening on that port. Wrong port, or SSH isn’t enabled for your account (common on shared hosting until you turn it on in the control panel).

Operation timed out — a firewall is dropping the connection, or the address is wrong. Some hosts only allow SSH from whitelisted IP addresses.

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! — the server’s host key is different from the saved one. That happens when a server is reinstalled or migrated, but it is also exactly what an interception looks like. Confirm with your host, then remove the old entry with ssh-keygen -R example.com.

subsystem request failed — you can SSH in, but SFTP is disabled on the server. The admin needs to enable the sftp subsystem in sshd_config.

Questions people ask

How do I connect to an SFTP server from the Mac Terminal?

Run sftp username@hostname. Add -P port for a non-standard port and -i ~/.ssh/keyfile for a specific key. macOS includes OpenSSH, so no installation is needed.

Can I connect to SFTP from the Finder?

No. The Finder’s Connect to Server supports SMB, NFS, AFP and read-only FTP, but not sftp://. Use the Terminal or an SFTP client.

What port does SFTP use?

Port 22 by default, the same as SSH, because SFTP runs inside SSH. Some hosts use a different port such as 2222; in the Terminal you pass it with a capital -P.

Is SFTP the same as FTP over SSH?

Essentially yes in everyday language — SFTP is the SSH File Transfer Protocol. It is not FTP running through an SSH tunnel, and it has nothing to do with FTPS, which is FTP over TLS.

Do I need an SSH key for SFTP?

No. Most servers accept a password, unless the admin has disabled password logins. A key is more secure and saves typing, and some managed servers require one.

How do I upload a whole folder with sftp?

Use put -r foldername at the sftp> prompt. For repeat uploads where only a few files changed, rsync or a client with folder sync is faster, because it sends only the differences.