FTP is the File Transfer Protocol: a way for one computer to list, upload, download and delete files on another. It was standardised in 1971, predates the web by two decades, and still runs a surprising amount of the internet’s plumbing — shared hosting, NAS boxes, routers, industrial equipment and the deployment step of a great many websites.
It is also widely misunderstood, mostly because of one unusual design decision made at the very beginning.
The one thing that makes FTP strange
Almost every internet protocol uses a single connection. You open a socket, you send requests, you get answers back, you close it. HTTP works that way. SSH works that way.
FTP uses two.
The first is the control connection, normally on port 21. It carries commands and replies as plain text lines, and it stays open for the whole session:
> USER deploy
< 331 Password required for deploy
> PASS ••••••••
< 230 User deploy logged in
> CWD /var/www/html
< 250 CWD command successful
The second is the data connection, opened fresh for each transfer and for each directory listing, then closed when that transfer finishes. The actual bytes of your file never travel on the control connection.
This split is why a directory listing is a transfer in FTP, why you can be “connected” and still fail to list a folder, and why FTP has such a difficult relationship with firewalls. Everything odd about FTP traces back to this.
Why two connections?
In 1971 the network was small, trusted, and the design goal was different: FTP was meant to let a user at one machine move files between two other machines without the data passing through their own terminal. Two connections made that natural — the control channel steers, the data channel flows wherever it is told.
That original feature became the FXP “site-to-site transfer” mode, and it also became a security problem serious enough that virtually every server now disables it. The two-connection architecture, however, stayed.
Commands you will actually see
FTP’s vocabulary is small and human-readable. If you ever open a client’s protocol log, this is what you are looking at:
| Command | What it does |
|---|---|
USER / PASS | Authenticate |
PWD / CWD | Print / change working directory |
LIST / MLSD | List a directory (over the data connection) |
RETR / STOR | Download / upload a file |
DELE / RNFR + RNTO | Delete / rename |
MKD / RMD | Create / remove a directory |
PASV / EPSV | Ask the server for a passive data port |
TYPE | Switch between ASCII and binary mode |
REST | Resume a transfer from a byte offset |
FEAT | Ask which optional features the server supports |
Replies are three-digit codes with a text message. The first digit is the whole story: 2xx means success, 3xx means “send more information”, 4xx is a temporary failure worth retrying, 5xx is permanent. There is a full reference of FTP error codes if you are staring at one right now.
ASCII mode: the classic way to corrupt a file
TYPE A (ASCII) tells the server it may rewrite line endings during transfer, converting between the CRLF used on the wire and whatever the local platform uses. It exists because in 1971 machines genuinely disagreed about how a line ended.
Today it is a footgun. Transfer a JPEG, a ZIP or a compiled binary in ASCII mode and some bytes get rewritten — the file arrives subtly, permanently corrupted, usually with a size a few bytes off from the original. Every modern client defaults to TYPE I (binary) for everything, and that is the right default.
If you have ever downloaded an archive over FTP that would not open, this was probably why.
FTP sends your password in the clear
The control connection is plain text. Not hashed, not obfuscated — the literal characters of your password cross every network between you and the server, readable by anything on the path. On a café Wi-Fi or a shared network, that is a real and trivially exploitable exposure.
This is not a flaw that can be patched, because it is not a bug: FTP was designed before encryption was a routine expectation. The answer is to use one of the two protocols that fixed it:
- FTPS — FTP with a TLS layer wrapped around it. Same protocol, same two connections, now encrypted.
- SFTP — a completely different protocol that runs inside SSH. One connection, encrypted, and none of FTP’s quirks.
The differences between FTP, FTPS and SFTP are worth understanding before you pick one, because the names suggest a family resemblance that does not exist.
So is FTP obsolete?
Not quite, and pretending otherwise is unhelpful. Plain FTP should not be used across the public internet — there is no good argument for it in 2026. But the protocol persists for solid reasons: it is trivially simple to implement, it is supported by hardware that will never receive another firmware update, and on a private network the encryption argument is weaker.
The realistic position is: use SFTP when the server offers SSH, use FTPS when it offers TLS, and use plain FTP only when the other side genuinely offers nothing else — knowing what that costs you.
Step by step
- Find out what your server actually supports — your host’s control panel will say FTP, FTPS or SFTP. If SSH access exists at all, SFTP is available.
- Prefer SFTP, then FTPS, then FTP — in that order, every time. The first two encrypt your password; the third does not.
- Use a client, not the Finder — macOS can no longer write to FTP servers from the Finder, so a real client is required. Connecting to an FTP server on a Mac covers the details.
- Leave transfers in binary mode — never let a client “fix” line endings on anything but plain text you specifically want converted.
- Read the protocol log when something fails — FTP’s error codes are specific, and the log tells you whether the control or the data connection is the problem.
Questions people ask
What port does FTP use?
Port 21 for the control connection. The data connection uses port 20 in active mode, or a high-numbered port chosen by the server in passive mode. FTPS implicit mode traditionally uses port 990, and SFTP uses port 22 because it is really SSH.
Is FTP the same as SFTP?
No, and the similar names cause endless confusion. SFTP is not FTP with encryption added — it is a different protocol that runs inside SSH and shares no code, commands or design with FTP.
Why does my FTP connection log in but then hang on the directory listing?
Because listing a directory requires opening the second connection, and that is what is failing. This is almost always an active-versus-passive mode or firewall issue. See active vs passive FTP.
Can I still use FTP in a browser?
No. Chrome, Firefox and Safari all removed FTP support between 2020 and 2021. You need a dedicated client.
Is FTP fast?
The protocol itself adds very little overhead, so raw throughput is good. What it lacks is parallelism: one data connection moves one file at a time. Clients get their speed from opening several connections at once, which is why a queue that transfers concurrently makes a much bigger difference than the protocol choice.