A practical field guide from Automation Ace.
The short answer
FTP sends files and passwords unencrypted. FTPS is FTP with TLS encryption added. SFTP is a separate, SSH-based protocol that encrypts everything over a single port. For file transfer automation, SFTP is usually the best choice: it is secure, firewall-friendly, supports SSH key authentication, and is what most banks, vendors, and enterprise partners ask for. In Zapier, SFTP by Zapier is the built-in way to automate it.
This guide explains the differences, when you might still meet FTP or FTPS, and what each means for your automations. For how the Zapier app works, see SFTP by Zapier explained.
SFTP vs FTP vs FTPS at a glance
| FTP | FTPS | SFTP | |
|---|---|---|---|
| Full name | File Transfer Protocol | FTP over SSL/TLS | SSH File Transfer Protocol |
| Encryption | None: credentials and files travel in plain text | TLS encryption layered on FTP | Everything encrypted inside an SSH session |
| Default port(s) | 21 plus separate data ports | 21 (explicit) or 990 (implicit) plus data ports | 22, a single port |
| Authentication | Username and password | Username and password, optionally client certificates | Password or SSH key pair |
| Firewall friendliness | Poor: multiple ports, active/passive modes | Poor: same multi-port design, harder to inspect | Good: one port |
| Related to FTP? | — | Yes, FTP with TLS added | No, a different protocol built on SSH |
| Use in automation today | Legacy only; avoid for sensitive data | Acceptable where partners require it | The default choice for secure file exchange |
| Zapier support | Via third-party apps | Via third-party apps | SFTP by Zapier (built-in) |
What is FTP?
FTP is one of the oldest internet protocols, designed in an era before encryption was common. It uses one connection for commands and separate connections for data, which is why it has “active” and “passive” modes and why firewalls struggle with it. Because usernames, passwords, and file contents are sent in plain text, anyone who can observe the network traffic can read them.
In automation: treat plain FTP as legacy. If a partner still requires it, isolate the account, use it only for non-sensitive files, and plan a move to SFTP.
What is FTPS?
FTPS keeps FTP's design but wraps the connections in TLS, the same encryption used by HTTPS. Explicit FTPS starts on port 21 and upgrades to TLS; implicit FTPS uses TLS from the start, usually on port 990. It secures the data but inherits FTP's multi-port complexity and adds certificate management.
In automation: acceptable when a partner mandates it, particularly in industries that standardized on it years ago, but it is rarely the first choice for new integrations.
What is SFTP?
Despite the name, SFTP is not FTP with security bolted on. It is a file transfer protocol that runs inside an SSH (Secure Shell) connection, normally on port 22. Commands, credentials, and file data all travel through one encrypted channel. It supports password login and SSH key pairs, where the server trusts a public key and your automation proves its identity with the matching private key.
In automation: SFTP is the modern default for exchanging files with other organizations: payroll exports, bank files, EDI documents, data feeds, and nightly reports. See 10 practical SFTP by Zapier use cases.
Why the protocol matters for automation
- Security and compliance. Contracts, audits, and regulations often require encryption in transit. FTP fails that test. See the automation security checklist.
- Credentials. SSH keys can be rotated and scoped without sharing a human password. Store them like any other secret; see credential terms.
- Network access. Cloud automation platforms connect from their own IP addresses. Servers that restrict access by IP need an allowlist, and SFTP's single port keeps firewall rules simple.
- Tool support. Zapier includes a built-in SFTP app; FTP and FTPS typically require third-party connectors or a Code step with a library.
Which should you choose?
- You control the server? Use SFTP with key authentication.
- A partner requires FTPS? Use FTPS, and ask whether SFTP is an option.
- A partner only offers FTP? Push for SFTP; meanwhile, send nothing sensitive.
- You just need to share files with your team? Cloud storage may be simpler. See SFTP vs cloud storage.
When you are ready to build, follow how to automate file uploads, downloads, and processing with SFTP by Zapier.
Frequently asked questions
What is the difference between SFTP, FTP, and FTPS?
FTP transfers files without encryption. FTPS adds TLS encryption to FTP. SFTP is a different protocol that runs over SSH, encrypting commands, credentials, and data over a single port, usually 22.
Is SFTP the same as FTPS?
No. FTPS is FTP secured with TLS and uses FTP's multi-port design. SFTP is a separate protocol built on SSH that uses one port and supports SSH key authentication.
Which is best for file transfer automation?
SFTP is usually best: it is encrypted, firewall-friendly, supports SSH keys, and is widely required by banks, vendors, and enterprise partners. Zapier supports it with the built-in SFTP by Zapier app.
Is FTP still safe to use?
Plain FTP sends usernames, passwords, and files unencrypted, so it is not safe for sensitive data. Use it only for legacy, non-sensitive transfers while planning a move to SFTP.
What port does SFTP use?
SFTP normally uses port 22, the SSH port, though some servers use a custom port. FTP uses port 21, and implicit FTPS commonly uses port 990.
Disclaimer: Zapier features, plan availability, and settings can change. Confirm current details in Zapier's help documentation and your SFTP server or hosting provider's documentation before relying on a specific setting. This article may include links to apps, products, or services; some links may be affiliate links, which means Automation Ace may earn a commission at no extra cost to you.