SSH vs SFTP

What it means

SSH (Secure Shell) is a protocol family for protected remote access, authentication and encrypted channels. The OpenSSH ssh client commonly opens a remote shell or runs an authorized command. SFTP (SSH File Transfer Protocol) is a separate file-transfer protocol usually carried inside an SSH connection. It can list, upload, download and manage remote files within the permissions granted to that account. SSH manual SFTP manual

Despite its name, SFTP is not ordinary, unencrypted FTP, and is not FTPS (FTP protected by TLS). SSH access and SFTP access can use the same account and SSH transport, but a server can deliberately allow SFTP-only sessions without granting an interactive shell.

Try it

Example — two authorized activities on a fictional server. These are command shapes, not operations performed by this site. Replace the documentation-only hostname only for infrastructure you administer.

ssh editor@server.example.com
sftp editor@server.example.com

The first requests an SSH session, typically with a shell if the server permits it. The second requests a file-transfer session; a graphical SFTP client can use that capability without a terminal. Neither command promises access: authentication, account restrictions, host keys and server configuration decide the result. Never paste a private SSH key into a web form to make either work.

Shared security fundamentals

The SSH client should verify the server host key identity using a known trusted fingerprint or policy; a changed host key warning needs investigation, not a reflexive bypass. Authentication may use public keys or other allowed methods. A private key stays on the trusted client, protected by file permissions and preferably a passphrase or secure agent. Authentication and host keys

SFTP inherits encryption from SSH, not from the filename extension or graphical client. Encryption protects transport but cannot prevent an authorized user from uploading the wrong file, overwriting production, or exposing data through incorrect remote permissions. Host restrictions, least privilege, backups and checksums still matter. SFTP transport

Which should you choose?

Choose SFTP when the job is moving files: for example delivering a verified source package into a private incoming directory. Prefer SSH for approved status checks, controlled build commands or reviewing a server's logs. Do not assume SFTP clients can run server shell commands or that every SSH-enabled user is permitted to modify production files.

For websites built from static source, upload a complete candidate package, verify SHA256 on the destination, build and preview it outside the active web root, and switch a release only through the approved publisher. Do not overwrite a live site's HTML and hashed JavaScript piecemeal. The transport choice does not replace the release process.

In practice

Use SFTP for secure transfer and SSH for authorized remote execution, both with verified server identity and narrow permissions. For the files worth retaining, see Back up a small website. For serving several upstream services, see Reverse proxy. A verified transfer is not yet a verified deployment.