Both move files. One of them broadcasts your password to anyone listening on the path. If you are choosing a protocol today, this page ends the debate with facts, not fashion.
FTP is older than the web, and it was designed for a friendlier internet where nobody on the wire was assumed hostile. That assumption is dead. Below is what actually travels on the wire in each protocol, why firewall teams hate FTP, and the one place you will still meet it - old devices that know nothing else.
This is not a theoretical weakness. In FTP the username, the password and every byte of every file cross the network exactly as typed, as the panel above shows. Anyone positioned on the path - a rogue device on the office LAN, a compromised router, a neighbour on shared Wi-Fi - can read all of it without attacking anything.
SFTP encrypts the entire session before any credential is sent, and it also checks the data for tampering on the way. The same listener gets nothing usable.
FTP uses port 21 for commands and then opens separate, shifting connections for the data itself. Firewalls and NAT routers have to guess and poke extra holes, which is why FTP so often half-works: login succeeds, folder listing or transfer hangs.
SFTP runs everything through the single SSH connection on port 22. One rule in the firewall, no passive port ranges to configure, and it behaves the same through almost any network.
Do not let the similar names blur together:
When a client says their software supports "secure FTP", check which of the last two it means. They are not interchangeable and the wrong choice fails silently at connection time.
There is also a speed myth worth retiring: the encryption in SFTP costs almost nothing on any modern machine. People repeat benchmarks from twenty year old hardware as if they were laws of nature. On the PCs and servers in use today, your network and your disk will slow down long before the encryption does, so speed is never a honest reason to stay on plain FTP.
Honesty matters here: you will still meet FTP in the wild. Some old network printers, CCTV recorders and legacy machines offer nothing newer. The rule is containment, not panic:
See the whole Ubuntu SFTP setup done live, with the exact clicks and commands, in the Technical Anshu video.
Watch Full VideoNo. SFTP is its own protocol built into SSH. FTPS is the original FTP protocol with TLS added. The names look alike but the software, ports and behaviour are different.
Yes. A free packet capture tool on the same network shows FTP credentials in plain text within seconds. This is the main reason plain FTP disappeared from serious use.
Not immediately. Keep it off the internet, give it a unique password, and restrict it to one folder. Replace it on the normal upgrade cycle, not in a panic.