Technical Anshu
Tutorials Blog
Windows Clients

Connect to an Ubuntu SFTP Server From Windows With WinSCP and FileZilla

Your server is Ubuntu, but most desks run Windows. Two free clients bridge the gap - and both show a strange fingerprint warning on first connect that decides whether the encryption actually protects you.

By Technical AnshuUbuntu Server8 minute read
Watch the complete Ubuntu SFTP server setup step by step in the video

WinSCP and FileZilla are the standard Windows faces for SFTP. Setup is genuinely a one minute job: protocol, address, port, login. The single moment that deserves your full attention is the host key prompt on the first connection. This guide gives the steps for both clients and then explains what that prompt is really asking.

Server side - read your real fingerprint before trusting any prompt
$ ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:Kx7f...9dQ2 ubuntu-server (ED25519)
 
First connection prompt must show this same fingerprint.
The fingerprint is your server's identity card. The value shown is a shortened example - yours is read from your own server with this command.
1

Connect With WinSCP

  1. Open WinSCP and start a New Site
  2. File protocol: SFTP - not FTP, not SCP
  3. Host name: your server address, for example 192.168.1.50; Port number: 22 (or your changed port)
  4. User name and password for the transfer account, then Login
  5. For key login, point the private key setting at your key file; a key made with OpenSSH tools may ask to convert to PuTTY format - allow it, that copy is for WinSCP's own use
  6. Save the site so the user repeats none of this tomorrow
2

Connect With FileZilla

  1. In the Quickconnect bar, the address must carry the protocol: sftp://192.168.1.50 - typing the bare address makes FileZilla try plain FTP, which your server does not offer
  2. Username, password, port 22, then Quickconnect
  3. Or use the Site Manager for a saved entry with protocol set to SFTP - SSH File Transfer Protocol

That sftp:// prefix is the most common FileZilla failure in offices: the user swears the server is down, while the client was simply speaking the wrong protocol.

3

The Fingerprint Prompt Is the Security, Working

On the first connection both clients stop and show a fingerprint, asking whether you trust this server. What they are really asking: is this machine actually your server, or something pretending to be it? Encryption to an impostor protects nothing.

  1. Before the first user connects, run the command in the panel on the server itself and note the fingerprint
  2. The prompt on the Windows side must show the same fingerprint - compare it, do not just accept
  3. Send users the fingerprint on a separate channel, like a printed note or a message, so they can check it themselves
  4. After acceptance, the client remembers it and stays silent - until the day it warns the key has changed. Treat that warning as a stop sign, not an annoyance: it means a different machine answered, or the server was rebuilt. Ask before accepting, every time
4

Keys on Windows, Briefly

If your server follows the key-login guide in this series, Windows users need their key in the client: WinSCP takes a private key file per saved site, FileZilla takes one under its SFTP settings page. Keys generated by OpenSSH on Windows may need converting to PuTTY .ppk format with PuTTYgen for WinSCP - a format change only; the key itself is unchanged. Passwords should never be saved into the site profile on a shared office PC; typing it each time is the correct inconvenience.

Watch the Full Video

See the whole Ubuntu SFTP setup done live, with the exact clicks and commands, in the Technical Anshu video.

Watch Full Video
Frequently Asked Questions

FileZilla says connection refused or times out, but WinSCP works. Why?

Usually the protocol: a FileZilla quick connection without the sftp:// prefix attempts plain FTP on port 21, which the Ubuntu server does not listen on. Add the prefix or set SFTP in the Site Manager.

The client says the host key has changed. Should I accept?

Not blindly. A changed key means the answering machine is not the one you trusted before. It is innocent if the server was reinstalled, and it is an attack if it was not. Verify with whoever runs the server first.

Can I use the normal Windows Explorer or a browser instead?

Explorer and browsers do not speak SFTP natively. Use WinSCP or FileZilla - both free - or the sftp command built into modern Windows from a terminal window.

This guide is based on the Technical Anshu Ubuntu SFTP server video - Stuck on a step? Ask in the video comments and you will get a reply.