File Transfer Protocol

File Transfer Protocol (FTP)

Company type	Communication protocol
Industry	Computer networking
Founded	1971-04-16
Founder	Abhay Bhushan
Products	File transfer services

The File Transfer Protocol (FTP) serves as a widely recognized communication protocol designed to facilitate the exchange of computer files between a client and a server across a computer network. Functioning on a client–server architecture, FTP utilizes distinct channels for control commands and data transmission. Typically, users provide authentication through plaintext usernames and passwords, though anonymous access is allowed when enabled. To ensure secure data transfer, FTP is commonly supplemented with SSL/TLS (known as FTPS) or substituted by the SSH File Transfer Protocol (SFTP).

Early FTP clients were command-line utilities that predated graphical user interfaces and continue to be included by default in most Windows, Unix, and Linux operating systems. Today, a wide variety of specialized FTP clients and automation solutions are available for desktops, servers, mobile platforms, and embedded devices. Additionally, FTP capabilities are often embedded within productivity tools such as HTML editors and file manager applications.

FTP was once broadly supported by web browsers through the "ftp://" URI scheme. However, in 2021, leading browsers including Google Chrome and Firefox removed native FTP support, shifting preference toward more secure alternatives like SFTP and FTPS. Despite this shift, these protocols have yet to achieve widespread browser integration.

History of FTP servers

The initial specification for the File Transfer Protocol was authored by Abhay Bhushan and released on 16 April 1971. Originally, FTP functioned over the NCP, which preceded the adoption of the TCP/IP. The protocol migrated to TCP/IP with publication of in June 1980 and was standardized with in October 1985—a version that remains authoritative today. Later enhancements introduced capabilities such as Firewall-Friendly FTP (passive mode) in 1994, security extensions in 1997, as well as support for IPv6 and extended passive mode in 1998.

Communication and data transfer

FTP supports two modes—active and passive—which determine how data connections are established.

• In active mode, the client opens port M and issues the PORT M command to the server; subsequently, the server initiates a data connection from its port 20 back to the client’s specified port.
• Passive mode is employed when clients reside behind firewalls that block inbound connections. Here, the client sends a PASV command, receives the server’s IP address and port number in response, then initiates the data connection from an arbitrary local port to that server port.

Both modes were revised in 1998 to incorporate IPv6 compatibility along with an extended passive mode.

FTP servers communicate over the control channel using three-digit ASCII status codes that indicate whether commands succeed or fail; these codes are often supplemented with descriptive text messages for easier interpretation. Interruptions during file transfers can be signaled through commands sent on the control connection.

The protocol requires two separate ports—one dedicated to control commands and another for data transfer—stemming from its original design for NCP, which operated as a simplex protocol using distinct ports for each communication direction. Although TCP/IP supports full-duplex communication over a single port, FTP retains this dual-port approach to maintain compatibility with legacy implementations.

NAT and Firewall Traversal

FTP commonly transfers data by having the server establish a connection back to the client following the client's PORT command. This method poses challenges for NAT devices and firewalls, which typically block unsolicited inbound connections from external networks to internal hosts. In NAT scenarios, the PORT command specifies the internal host’s IP address and port rather than the public-facing IP and port, complicating proper communication.

There are two primary approaches to resolve this issue: utilizing the PASV command, where the client initiates the data connection to the server—this approach is prevalent in contemporary FTP clients—or deploying an application-level gateway that adjusts the PORT command parameters to ensure compatibility with NAT environments.

Data Types

FTP specifies five distinct data types for transferring information over networks:

• ASCII (TYPE A): Intended for text files, this type converts characters between host-specific formats and 8-bit ASCII. It is inappropriate for binary or non-textual files.
• Image (TYPE I or Binary mode): Transfers data as raw bytes without any conversion; this mode is recommended for all FTP implementations.
• EBCDIC (TYPE E): Used for plain text files exchanged between hosts utilizing EBCDIC encoding.
• Local (TYPE L n): Designed for transfers between systems with byte sizes other than 8 bits (e.g., 36-bit architectures). Most clients support only L 8, which corresponds to binary mode.
• Unicode UTF-8 text (TYPE U): Introduced in an expired draft, it is implemented by some FTP servers and clients.

These data types are often referred to as "modes," distinct from communication modes such as active/passive or settings controlled by the MODE command.

For text-based types (A and E), three format control variants manage carriage control characters:

• Non-print (TYPE A N/E N) – excludes printer control characters
• Telnet (TYPE A T/E T) – incorporates ASCII control characters like carriage return (CR) and line feed (LF)
• ASA (TYPE A A/E A) – employs ASA printer control codes

These format controls were primarily designed for line printers; currently, most FTP clients support only the default non-print format.

File Structures

The organization of files during transfer is dictated by the STRU command. According to Section 3.1.1 of RFC959, file structures include:

• F or FILE structure (stream-oriented): Treats files as a continuous sequence of bytes, typical for operating systems such as Unix, CP/M, MS-DOS, and Windows. (Section 3.1.1.1)
• R or RECORD structure (record-oriented): Files are segmented into fixed or variable-length records, common on mainframe and midrange platforms like MVS, VM/CMS, OS/400, and VMS that utilize record-oriented filesystems.
• P or PAGE structure (page-oriented): Divides files into pages containing data or metadata along with headers; originally intended for TENEX systems but generally unsupported elsewhere and discouraged by RFC1123 section 4.1.2.3.

Most modern FTP software supports only STRU F; STRU R remains relevant primarily in mainframe and minicomputer environments.

Data Transfer Modes

FTP supports three modes for transferring data:

• Stream mode (MODE S): Sends data as an uninterrupted stream, relying on TCP to handle transmission details. An end-of-file marker is unnecessary unless data is segmented into records.
• Block mode (MODE B): Intended for record-structured files (STRU R), though it can also be applied to stream-structured files (STRU F). In this mode, FTP encapsulates each record into blocks with headers and byte counts before forwarding them to TCP.
• Compressed mode (MODE C): Builds upon MODE B by incorporating run-length encoding compression techniques.

Currently, most FTP implementations do not support MODE B or MODE C except in mainframe or minicomputer contexts.

Certain FTP variants offer a DEFLATE-based compression mode known as "Mode Z," activated via a specific command. Although described in an Internet Draft, it has never been formally standardized.

GridFTP introduces additional modes—MODE E and MODE X—as extensions of MODE B to enhance file transfer functionality.

Additional FTP commands

Modern FTP implementations often incorporate the Modify Fact: Modification Time (MFMT) command, which permits clients to remotely set the modification timestamp of files, ensuring this attribute remains intact during uploads. To obtain the modification time of remote files, the MDTM command is utilized; certain servers and clients also support a nonstandard variant accepting two arguments, resembling MFMT functionality.

Authentication

FTP authentication relies on a conventional username and password mechanism. The client transmits the username using the USER command, followed by the password via PASS. Since these credentials are sent without encryption, they are vulnerable to interception through network monitoring. Once authentication succeeds, the server grants session access and begins communication. Some servers permit access without requiring login details but impose corresponding limitations on functionality.

Anonymous access

Certain FTP servers allow anonymous login, where users enter 'anonymous' as the username. Although an email address is typically requested as the password, it is not verified. This approach is widely employed by servers distributing software and updates.

File management applications

Numerous file managers offer built-in FTP capabilities; for example, File Explorer on Microsoft Windows provides FTP access but is generally advisable only for small file transfers due to its limited feature set compared to specialized clients. Additionally, it lacks support for SFTP.

Linux KDE's native file managers, such as Dolphin and Konqueror, support both FTP and SFTP protocols. On Android, Samsung Galaxy’s My Files app includes integrated FTP and SFTP client functionality.

Web browsers

Traditionally, most web browsers could fetch files from FTP servers, although support for protocol extensions like FTPS varied between browsers. FTP URLs rendered directory listings similarly to web pages.

Starting with version 88, Google Chrome eliminated FTP support, impacting Chromium-based browsers including Microsoft Edge. Firefox disabled FTP by default in version 88 and completely removed it by version 90.

The discontinued FireFTP browser add-on offered comprehensive FTP client features within Firefox; following Firefox’s removal of FTP support, its developer recommended switching to Waterfox. Some browsers, such as the text-oriented Lynx, continue to support FTP access.

URL format

FTP URLs adhere to the syntax ftp://user:password@host:port/path, where only the host component is mandatory.

Implementation details regarding username and password handling differ among browsers, as documented in Firefox and Internet Explorer resources. Most browsers default to passive (PASV) mode to facilitate firewall compatibility.

Path resolution behavior may vary when users’ home directories are not located at the root level.

Download utilities

Popular download managers commonly include functionality for retrieving files from FTP servers. For instance, DownloadStudio allows users both to download files and navigate directory structures on FTP servers.

Other

Support for FTP was discontinued in LibreOffice starting with its 7.4 version and was completely eliminated by the 24.2 release. Conversely, Apache OpenOffice, which evolved from OpenOffice.org, still maintains FTP compatibility.

Security

FTP was originally developed without security considerations and is vulnerable to numerous threats such as brute-force attempts, FTP bounce exploits, packet interception, port hijacking, spoofing, username harvesting, and denial-of-service (DoS) attacks. Since it transmits credentials, commands, and data in plaintext, these elements can be easily captured through packet sniffing. This absence of encryption is typical among early Internet protocols like SMTP, Telnet, POP, and IMAP.

To mitigate these security risks, organizations generally:

1. Utilize secure variants like FTPS as an alternative to FTP or employ TelnetS instead of Telnet.
2. Choose more robust protocols such as SSH File Transfer Protocol or Secure Copy Protocol.
3. Implement encrypted channels including Secure Shell (SSH) or virtual private network (VPN) tunnels.

FTP over SSH

FTP sessions can be encapsulated within a Secure Shell connection through FTP over SSH. Nonetheless, because FTP operates using multiple TCP connections—one for control and separate ones for data—tunneling presents challenges. Typical SSH clients often secure only the control connection on port 21, leaving the data connections exposed during transmission.

For effective FTP-over-SSH functionality, SSH clients must interpret FTP control commands and dynamically forward data channels accordingly. Software that provides this capability includes:

• Tectia ConnectSecure (available for Windows, Linux, and Unix) by SSH Communications Security

It is crucial to differentiate FTP over SSH from the inherently secure SSH File Transfer Protocol (SFTP), which is a separate protocol.

FTPS

Explicit FTPS builds upon the traditional FTP protocol by enabling clients to initiate encrypted sessions using the "AUTH TLS" command. Servers may choose whether to accept unencrypted connections. This method, specified in , strengthens security compared to standard FTP. Implicit FTPS, an earlier approach requiring SSL/TLS on distinct ports, has largely fallen out of use.

SSH File Transfer Protocol

The SSH File Transfer Protocol (SFTP) leverages the Secure Shell (SSH) protocol to provide secure file transfers by encrypting both commands and data streams, safeguarding passwords and sensitive information. SFTP differs fundamentally from FTP and cannot be used interchangeably with FTP software; however, some FTP clients offer SFTP support.

Trivial File Transfer Protocol

TFTP is a minimalistic file transfer protocol primarily utilized for network booting due to its simplicity. It does not include the security features or advanced capabilities found in FTP. Initially standardized in 1981, its current definition is provided in .

Simple File Transfer Protocol

Defined in , the Simple File Transfer Protocol (SFTP) was designed as an intermediate, unsecured file transfer method positioned between TFTP and FTP. It did not achieve broad usage and is currently designated as Historic by the IETF. Functioning on port 115, SFTP accommodates 11 commands and offers three modes of data transfer: ASCII, binary, and continuous. Its capabilities include user authentication, support for hierarchical directory structures, and fundamental file operations such as renaming, deleting, uploading, and downloading files.

FTP reply codes

FTP servers respond with standardized three-digit codes as specified in . The initial digit signifies the type of response: success (2yz), failure (4yz or 5yz), or incomplete/error replies (1yz or 3yz). The second digit classifies the category of the response:

• x0z – Syntax-related errors
• x1z – Informational messages
• x2z – Connection status replies
• x3z – Authentication and accounting responses
• x4z – Reserved/undefined
• x5z – File system status notifications

The third digit offers further refinement within each category.

Further reading

• – CWD Command of FTP. July 1975.
• – Standard File Transfer Protocol (FTP). J. Postel, J. Reynolds. October 1985.
• – Firewall-Friendly FTP. February 1994.
• – How to Use Anonymous FTP. May 1994.
• – FTP Operation Over Big Address Records (FOOBAR). June 1994.
• – Uniform Resource Locators (URL). December 1994.
• – FTP Security Extensions. October 1997.
• – Feature negotiation mechanism for FTP. August 1998.
• – Extensions for IPv6, NAT, and Extended passive mode. September 1998.
• – FTP Security Considerations. May 1999.
• – Internationalization of the File Transfer Protocol. July 1999.
• – Extensions to FTP. P. Hethmon. March 2007.
• – FTP Command and Extension Registry. March 2010.
• – FTP HOST Command for Virtual Hosts. March 2014.
• IANA FTP Commands and Extensions registry – The official registry listing FTP commands and extensions

External links

• FTP Server Online Tester Tool for testing authentication, encryption, modes, and connectivity
• Anonymous FTP Servers by Country Code TLD (2012): Offbeat Internet - Public Access - FTP