Three names that sound like versions of one thing are actually two different protocols and one upgrade. Choosing between them is easy once the real differences are on the table.
✍️ Technical Anshu🪟 Windows Networking⏱️ 7 minute read
🎥 The full deployment is in the video — the FTP feature install, users, folder permissions, firewall and passive mode, shown live step by step
Admins mix these up constantly, and vendors encourage the confusion. So, plainly: FTP is the original 1970s protocol with no encryption. FTPS is that same FTP wrapped in TLS. SFTP is a completely different protocol that rides inside SSH — the shared letters are a historical accident. All three move files; they differ in safety, in ports, and in what Windows gives you for free. Here is the honest comparison, then the verdict by scenario.
The Three Protocols at a Glance
FTPNo encryption — passwords in plain text
FTPSFTP + TLS — control port 21, passive range for data
SFTPSSH protocol — everything on single port 22
Built into IISFTP and FTPS yes — SFTP never
If you remember one row, remember the ports: FTPS inherits FTP's two-connection design, SFTP does not.
1
Encryption and Identity
FTP protects nothing: credentials and files are readable by anyone who can observe the traffic. FTPS encrypts both channels with TLS and uses a certificate to prove the server's identity — the same trust model as HTTPS. SFTP encrypts everything inside the SSH connection and proves identity with the server's host key, and users can also log in with SSH keys instead of passwords — a genuine operational advantage for automation. Security verdict: FTP last, FTPS and SFTP both sound, with different machinery.
2
Ports and Firewalls — Where SFTP Wins Quietly
FTP/FTPS: port 21 plus a passive data range that must be configured in three agreeing places — and with FTPS the firewall cannot inspect the encrypted control channel to help. Every page in this series about NAT pain traces back to this design.
SFTP: one port, 22, for everything. One firewall rule, one router forward, works through NAT without special fields. For connections across the internet this simplicity is not a luxury; it is the difference between an afternoon and a week.
That is the whole technical story behind the industry's drift: same encryption strength class, dramatically less network plumbing.
3
What Windows Gives You Natively
IIS includes FTP and FTPS — everything in this series is built on it, free with Windows. IIS has no SFTP, and never has. For SFTP on Windows you install Microsoft's OpenSSH Server (an optional Windows feature) or a third-party server. OpenSSH SFTP uses Windows accounts and NTFS permissions, but it is a different management world from IIS — no IIS Manager pages, configuration lives in sshd_config. Plan accordingly: choosing SFTP on Windows means learning a second tool, and it is usually still worth it for internet-facing work.
4
The Verdict by Scenario
Legacy device inside the LAN (old scanner, printer, camera that speaks only FTP): plain FTP, isolated folder, own user, LAN only. Reality wins; the cage matters more than the protocol.
Existing IIS shop needing encryption: FTPS on the current site — same users, same folders, one certificate. The FTPS page shows the steps.
Anything across the internet, new deployments, automation and scripts: SFTP. One port, key-based logins, no passive-range saga.
Ad-hoc sharing with people: honestly, none of the three — a cloud drive link or your file platform will serve humans better than any protocol from this family.
5
The Line to Stop Repeating
You will hear "FTP is dead, never use it" and "FTP is fine, everyone exaggerates". Both are shortcuts. The accurate sentence is longer: plain FTP is a plain-text protocol acceptable only inside networks you trust; the moment a connection crosses the internet, it must be FTPS or SFTP. Admins are paid for the longer sentence.
🔴 One rule before anything else: classic FTP sends the username, the password and every file in plain readable text. Inside a trusted office LAN it still has honest uses. On the open internet it does not — there the answer is FTPS or SFTP, and these pages will keep saying so.
🎥 Watch the Complete FTP Server Deployment
The video sets up the whole FTP server on Windows live — including the fast automated route — so you can follow it on your own server, click by click.
No. FTPS is a real, standardised extension — FTP commands and transfers protected by TLS, with certificates. The name that misleads people is SFTP, which sounds like a variant but is the SSH protocol instead.
Can IIS do SFTP if I install an extra role
No. There is no Microsoft role that adds SFTP to IIS. On Windows, SFTP comes from OpenSSH Server or third-party products, managed separately from IIS.
We already expose plain FTP on the internet and nothing bad happened — should we still change
Yes. Absence of a noticed incident is not evidence of safety with a plain-text protocol — the exposure is silent by design. Move the same users and folders to FTPS, or to SFTP, and close the plain port.
This guide is based on the Technical Anshu video — Windows FTP Server Deployment Guide for IT Admins • Stuck on a step — ask in the video comments and you will get an answer there 🙏