Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →OpenSSH’s sftp command gives you encrypted file transfers over SSH without leaving the Linux terminal. Connect with sftp user@host, check the remote and local working directories, then use get to download or put to upload. The same client handles custom ports, identity files, directory transfers, remote file management, and repeatable batch jobs.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SFTP is and when to use it
SFTP is OpenSSH’s file-transfer program. It performs file operations through an encrypted SSH transport, so the connection, authentication exchange, and file data are protected by the SSH session rather than sent as plain FTP traffic. It is a different protocol from FTP, even though many of the interactive command names look familiar.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The Linux client is useful when you need to move configuration files, game-server builds, logs, backups, or release artifacts between a workstation and a remote host. It is included with the OpenSSH client package on most Linux distributions. The server must expose an SFTP subsystem, and your account must have permission for the directories and files you intend to use.
SFTP has two directory contexts:
- Remote: the filesystem on the SSH server. Commands such as
pwd,ls, andcdoperate here. - Local: the filesystem on your Linux computer. Commands prefixed with
l, includinglpwd,lls, andlcd, operate here.
Keeping those contexts straight is the key to avoiding a transfer from the wrong directory.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before connecting
Check the client and account
Run sftp -h or open man sftp to confirm that the OpenSSH client is installed. The exact flags and extensions depend on the OpenSSH release shipped by your distribution, so the manual installed on the machine is the authority for optional behavior.
Obtain these details from the server administrator:
- the hostname or IP address;
- the login name;
- the SSH port, if it is not the default;
- the remote directory you should use; and
- whether the account accepts a password, an SSH public key, or another configured method.
For uploads, also confirm that the account can write to the destination. Read access is enough for a download, but creating a directory, changing ownership, or deleting a file requires additional permissions.
Understand the first host-key prompt
On a first connection, SSH normally asks you to verify the server’s host key. Compare the fingerprint with a value supplied through a trusted administrative channel before accepting it. Accepting an unexpected key can connect you to the wrong machine; refusing a legitimate new key can block access after a server rebuild or key rotation. Do not bypass a warning merely to make a script run.
Connect from the shell
These are the common connection forms:
| Command | Purpose |
|---|---|
sftp [email protected] |
Connect to example.com as alice on the default SSH port. |
sftp -P 2222 [email protected] |
Use TCP port 2222 instead of the default SSH port. The option is uppercase -P. |
sftp -i ~/.ssh/id_ed25519 [email protected] |
Select a particular private-key identity file. |
sftp [email protected]:/var/tmp |
Connect and request /var/tmp as the initial remote directory. |
You can also use an sftp:// URI where your client and environment support it. A remote path in the command changes the starting location; it does not change the account’s permissions.
After the host-key check, authenticate using the method configured on the server. A successful session ends at the sftp> prompt. If the connection fails before that prompt, troubleshoot it as an SSH connection first: check the name, port, network route, host key, and authentication method.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteOrient yourself at the sftp> prompt
Start every unfamiliar session by checking both working directories:
sftp> pwd
sftp> lpwd
sftp> ls -la
sftp> lls -la
sftp> cd incoming
sftp> lcd ~/Downloadspwd prints the current remote directory, while lpwd prints the local one. Likewise, ls -la lists remote files and lls -la lists local files. cd changes the remote directory; lcd changes the local directory. The tilde in lcd ~/Downloads is expanded as a local home-directory path.
This check matters because a relative source or destination is interpreted in the corresponding context. If lpwd shows an old build directory, a command such as put app.tar.gz may upload a different file than you intended. If pwd shows a production directory, a relative get may download a live configuration rather than a test copy.
Download files with get
get copies from the remote server to the local machine. With one argument, the client uses the remote filename as the local filename in the current local directory:
sftp> get report.csvSupply an explicit local path when you want a different name or location:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sftp> get /remote/path/report.csv ./report.csvA safe download sequence is:
- Run
pwdandls -lato verify the remote source. - Run
lpwdand, if needed,lcdto select the local destination. - Use
getwith an explicit destination when the filename or location matters. - Use
lls -lafter completion to confirm that the local file appeared.
For a directory, use the recursive form supported by your installed client, commonly:
sftp> get -r remote_dirCheck help get inside the session or man sftp before relying on recursive or release-specific flags. Verify that the resulting local tree is where you expect it before using it in a build or restore.
Upload files with put
put copies from the local machine to the remote server:
Recommended Free Tools
sftp> put ./build.tar.gz
sftp> put ./build.tar.gz /incoming/build.tar.gzThe first command reads from the current local directory and uses the same filename remotely. The second names the complete remote destination. An explicit destination is preferable for deployment because it documents where the artifact should land and avoids depending on a previously selected remote directory.
Before uploading, inspect both sides:
sftp> lpwd
sftp> lls -l build.tar.gz
sftp> pwd
sftp> ls -la /incomingFor a local directory, the recursive form is commonly:
sftp> put -r local_dirRecursive transfers can create many files and consume substantial space. Confirm the destination and available permissions first, and inspect the remote directory after the transfer. If a server applies quotas, a large tree can fail partway through even when the connection itself is healthy.
Move around and manage remote files
Create, rename, and remove
Several filesystem operations are available at the prompt:
Free tools Windows power users keep installed
One-click scans. No signup required.
sftp> mkdir incoming
sftp> rename old.txt archive/old.txt
sftp> rm failed-upload.tmpmkdir creates a remote directory, rename changes a remote pathname, and rm deletes a remote file. Treat rm as destructive: check pwd and ls immediately before using it, especially when a script constructs paths. Server permissions and the SFTP implementation determine whether each operation is allowed.
Inspect space and metadata
df -h requests human-readable filesystem statistics from the remote server:
sftp> df -hThe manual also documents commands for changing mode bits, ownership, and group, plus link and filesystem-statistics operations. These may be unavailable or restricted by the server. Ownership changes generally require privileges that ordinary upload accounts do not have; do not assume that an SFTP login can administer the remote filesystem just because it can transfer files.
End a session
Use bye to close the SFTP session cleanly:
sftp> byeIf a transfer is still running, let it finish or interrupt it deliberately, then reconnect and verify the resulting file before treating it as complete.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose an authentication method
Password authentication
A password is convenient for an interactive transfer. The client can stop and ask for it during login. That interaction is exactly why a password is unsuitable for an unattended batch job: there is no person at the terminal to answer the prompt.
SSH public-key authentication
Public-key authentication is the usual choice for automation. The server stores the public key for the account, while the client uses the matching private key. Protect the private-key file with restrictive local permissions and select it explicitly when necessary:
sftp -i ~/.ssh/id_ed25519 [email protected]The key must already be authorized on the server, and the client must be able to read it. If an agent is being used, confirm that the expected key is loaded; otherwise provide the identity path with -i. A key that exists on disk but is not authorized for the target account will still produce an authentication failure.
FIDO2-backed SSH keys
A hardware-backed FIDO2 key is an optional stronger control for accounts that need protection against theft of an ordinary private-key file. Yubico’s SSH guidance states that FIDO2 key types such as ed25519-sk and ecdsa-sk require OpenSSH 8.2 or newer and an OpenSSH build with FIDO support, such as support provided through libfido2. The same guidance identifies OpenSSH 8.3 or newer for resident-key download and 8.4 or newer for verify-required.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
These requirements apply to the installed client and its build, not merely to the Linux distribution name. Check ssh -V, the package documentation, and man sftp before choosing this method. FIDO2 hardware is not required for ordinary SFTP; a conventional authorized SSH key is sufficient when the server and account policy allow it.
Automate transfers with batch mode
Batch mode reads SFTP commands from a file or standard input instead of waiting for an interactive operator. Create a file such as upload.sftp:
lcd ./dist
cd /incoming
put app.tar.gz
put checksums.txt
byeRun it with:
sftp -b upload.sftp [email protected]The batch file still uses the same local and remote contexts as an interactive session. lcd ./dist selects the local source directory, while cd /incoming selects the remote destination. Keeping those selections near the top makes the script auditable and reduces dependence on a user’s shell working directory.
Make a batch job non-interactive
Because batch mode has no interactive password prompt, configure public-key authentication or another non-interactive method before scheduling it. Test the exact command interactively first:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Connect with the same account, host, port, and identity.
- Run the planned
lcd,cd, and transfer commands manually. - Confirm the remote permissions and resulting filenames.
- Run the batch command from the same environment that the scheduler will use.
Schedulers often start with a different home directory and a minimal environment. Use absolute paths in the batch file when a relative path could select the wrong files, and make the identity path explicit when relying on a particular key.
Handle failures deliberately
The client can abort when a transfer or filesystem command fails. The manual documents a per-command prefix that suppresses termination when continuing is explicitly desired. Use that behavior sparingly: ignoring a failed upload can leave a deployment incomplete while the surrounding script reports apparent progress. A safer default is to let the batch job stop, capture its exit status, and alert on failure.
Record the command’s standard output and error in the scheduler’s logs. A successful SSH login does not prove that every file was transferred; the batch process status and a post-transfer check are separate signals.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Interactive work or a script?
| Need | Best fit | Reason |
|---|---|---|
| One-off inspection or a few files | Interactive sftp> |
You can inspect directories and respond to prompts while deciding what to move. |
| Repeatable release or backup transfer | Batch mode with -b |
The command sequence is stored in a reviewable file and can run from a scheduler. |
| Human login with occasional transfers | Password or public key | Both can work interactively, subject to server policy. |
| Unattended transfer | Public key or another non-interactive method | A batch process cannot answer an interactive password request. |
| Extra protection for high-value credentials | FIDO2-backed SSH key | Requires compatible OpenSSH and FIDO support, but keeps key operations hardware-backed. |
| Several files in one tree | Recursive get or put |
Moves a directory hierarchy; verify the installed client’s supported syntax first. |
A dependable transfer workflow
Use this checklist for a manual upload, download, or deployment:
- Identify the endpoint. Write down the account, hostname, port, and intended remote path.
- Select authentication. Use an interactive method for a person at the terminal; use a key or other non-interactive method for automation.
- Connect with explicit options. Add
-Pfor a non-default port and-ifor a specific identity. - Verify the host key. Compare a first-connection fingerprint through a trusted channel.
- Inspect both working directories. Run
pwd,lpwd,ls -la, andlls -la. - Change directories deliberately. Use
cdandlcd, preferably with absolute or clearly documented paths. - Transfer the smallest well-defined unit. Name the source and destination explicitly when a mistake would be costly.
- Verify the result. List the destination and check that the expected file or directory exists.
- Close the session. Use
byeand retain relevant logs for automated jobs.
Troubleshoot connection and transfer failures
Get SSH diagnostics
Run the client with maximum SSH diagnostic verbosity:
sftp -vvv user@hostThe output can show where name resolution, TCP connection, host-key negotiation, or authentication stops. Diagnostic output may contain usernames, paths, and server details, so handle logs as sensitive information.
Authentication is rejected
- Confirm the username is correct; a valid key for another account will not authenticate as the intended user.
- Check the identity path passed to
-iand verify that the local process can read the private key. - If using an agent, confirm that the expected key is loaded.
- Ask the administrator to verify that the matching public key is authorized for the server account.
- Check the client’s OpenSSH version and build when attempting FIDO2-backed keys.
The host or port is wrong
Recheck the hostname and use -P with the server’s actual SSH port. A custom SFTP port is an SSH port; it is not selected with lowercase -p. If the hostname resolves to more than one address, confirm that you are reaching the intended environment.
The SFTP subsystem is unavailable
An SSH account can exist without providing SFTP access. The server must expose an SFTP subsystem, and its account policy may restrict the available directories or commands. Ask the administrator to confirm the SFTP subsystem configuration rather than repeatedly changing client syntax.
A path or permission fails
Run pwd and ls -la remotely, then lpwd and lls -la locally. This separates a misspelled path from a permission problem. For uploads, verify write permission on the target directory; for downloads, verify read permission on the source. Creating directories, deleting files, and changing ownership can require separate privileges even when ordinary transfers work.
A batch job stops unexpectedly
- Run the command interactively with the same account, identity, port, and paths.
- Remove any step that expects a password or confirmation prompt.
- Use
-band check that the batch file is readable from the scheduler’s working environment. - Capture the process exit status and logs.
- Review the command immediately before the failure; a transfer or filesystem error can cause the client to stop.
- Only use the documented per-command continuation prefix when skipping a known, acceptable failure is part of the design.
Recursive syntax differs
OpenSSH releases and vendor builds can differ in supported options and extensions. If get -r or put -r is rejected, run help get, help put, and man sftp on that machine. Do not copy a flag from a different operating system or an older guide without checking the installed manual.
Security and operational practices
- Use the server’s verified host key and investigate unexpected changes.
- Protect private-key files and limit access to the account that runs the transfer.
- Use a dedicated account and a narrow remote directory for automated deployments where server policy permits.
- Prefer explicit remote and local paths in scripts so a changed working directory cannot redirect a transfer.
- Keep destructive commands such as
rm, ownership changes, and broad recursive transfers out of unattended jobs unless they are specifically required and reviewed. - Log success and failure without exposing private keys, passwords, or unnecessary secret data.
- Check free space before a large recursive transfer and verify the destination afterward.
- Review the installed OpenSSH documentation when upgrading a distribution, changing server versions, or introducing hardware-backed keys.
Example: shipping a Linux game-server build
Suppose a build pipeline creates app.tar.gz and checksums.txt in a local dist directory, while the server administrator has provided an /incoming directory and an SSH key for the deploy account. First test the connection and inspect both sides:
sftp -i ~/.ssh/id_ed25519 [email protected]
sftp> lpwd
sftp> lcd ./dist
sftp> lls -l
sftp> pwd
sftp> cd /incoming
sftp> ls -laUpload the two artifacts with explicit names:
sftp> put app.tar.gz /incoming/app.tar.gz
sftp> put checksums.txt /incoming/checksums.txt
sftp> ls -l /incoming
sftp> byeOnce that manual run is correct, place the repeatable commands in upload.sftp and invoke:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sftp -i ~/.ssh/id_ed25519 -b upload.sftp [email protected]The batch file can contain:
lcd ./dist
cd /incoming
put app.tar.gz
put checksums.txt
byeKeep the interactive test and the automated invocation aligned: the same account, host, port, identity, source directory, and destination should be used unless the change is intentional. After the job exits, have the surrounding pipeline inspect its status and retain the logs.
What to check when your Linux distribution changes
The core commands—connection, directory inspection, get, put, and batch mode—are stable across OpenSSH installations, but optional flags and extensions vary by release. Before migrating a script, compare its assumptions with man sftp on the new system. Recheck recursive-transfer syntax, authentication support, and any server-side restrictions. For FIDO2 keys in particular, verify that the new client is at least OpenSSH 8.2 and that its build includes FIDO support; resident-key and user-verification features have the later version requirements described above.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
