The DSM checkbox honestly labels it: FTP service, no encryption. This page shows what no encryption looks like on the wire, and how to move to SFTP or FTPS without breaking your users.
FTP is the oldest door on your NAS and the only one that introduces itself to the whole network. On plain FTP, the username, the password and every file travel as readable text. Anyone who can listen on the path — a compromised PC on the same Wi-Fi is enough — can read them. Here is what that really means, and the two encrypted exits Synology already gives you.
When DSM's FTP tab says Enable FTP service (No encryption), the words in brackets are the whole story. The control connection on port 21 carries commands — including USER and PASS — exactly as typed, and the data connection carries the file itself unchanged. There is no scrambling anywhere in classic FTP. It was designed in 1985 for a small, trusting academic network, and it behaves like it.
Be precise, not dramatic: reading FTP traffic needs a listening position — the same LAN, a tapped cable, a rogue device, or any hop on an internet path. That is why plain FTP inside a wired office LAN is a small risk, plain FTP over office Wi-Fi is a real risk (the air is shared), and plain FTP across the internet is not a risk but a donation — of your password first, then your files.
SFTP replaces the whole design with SSH encryption: one port (22), everything sealed, and support in WinSCP, FileZilla and every script you will ever write. On Synology you enable it via Control Panel → Terminal & SNMP → Enable SSH service, then connect with the same username and password you already use. For most people this is the end of the story: turn plain FTP off entirely and keep SFTP.
Some older software and devices can do FTP and nothing else — except their slightly newer sibling, FTPS. On the same DSM FTP tab, tick Enable FTPS (FTP over SSL/TLS). In FileZilla, the matching choice is FTP over TLS. The password and data are then encrypted, though FTPS keeps FTP's awkward habit of opening a range of passive data ports, which your firewall must allow.
Devices that genuinely cannot encrypt get a tiny, read-only, LAN-only exception — not a network-wide plain door.
The full Synology File Services setup, including the FTP tab and the WinSCP SFTP test on port 22.
▶️ Watch Full VideoNo. On plain FTP a strong password is simply a strong sentence read aloud — it travels as readable text, so anyone listening copies it exactly and reuses it. Strength does not help; encryption does.
First check for an FTPS option in its settings — many devices have one hiding. If it truly only speaks plain FTP, keep it on the wired LAN, give it its own limited account with access to one folder, and never open that door to the internet.
Nothing. SFTP is a separate service on Synology (it comes with the SSH service), with the same accounts and folders. Users just connect with the SFTP protocol selected in WinSCP or FileZilla instead of plain FTP.