The history of FTP: from RFC 114 to SFTP and FTPS

The File Transfer Protocol predates almost everything else you use on the internet. It’s older than TCP/IP, older than email as you know it, older than the web by two decades. Its long life is also why “FTP”, “FTPS”, and “SFTP” get tangled together: they come from different eras and different design lineages. Here’s the actual history.

1971: RFC 114, the beginning

FTP started with RFC 114, written by Abhay Bhushan at MIT in April 1971, on the ARPANET. This was four years before TCP/IP existed. The early protocol ran over NCP, the ARPANET’s original host protocol, and was concerned with moving files between time-sharing mainframes.

1980: RFC 765, the TCP era

As the ARPANET migrated to TCP/IP, FTP was rewritten for it. RFC 765 (1980) defined FTP over TCP, introducing the two-connection design FTP still uses: a control connection for commands and a separate data connection for the file bytes.

1985: RFC 959, the version still in use

RFC 959, by Jon Postel and Joyce Reynolds in October 1985, is the FTP specification that’s still current today. The numeric reply codes (220, 226, 530, 550, and the rest) and the active/passive data-connection modes you deal with now all come from RFC 959. When people say “FTP”, they mean this.

The extensions

FTP kept getting patched for a changing internet:

• RFC 2228 (1997) added security extensions (the AUTH command), the basis for FTPS.
• RFC 2428 (1998) added IPv6 and NAT-friendly passive mode (EPSV).
• RFC 4217 (2005) defined FTPS properly: FTP secured with TLS.

The fork people still confuse: FTPS vs SFTP

Here’s the part that causes endless mix-ups. There are two unrelated ways to “secure FTP”:

• FTPS is FTP (the RFC 959 lineage) wrapped in TLS. Same numeric reply codes, same two-channel design, now encrypted.
• SFTP is not FTP at all. It’s a subsystem of SSH, designed in the late 1990s as part of the SSH protocol suite. It never became a finished RFC (it remains an IETF draft), uses completely different status codes (SSH_FX_*, not numbers), and runs over a single SSH connection.

So FTPS and SFTP share three letters and almost nothing else. If you’re decoding which one you’re using, the FTP and SFTP code reference makes the difference concrete, and SFTP vs FTPS covers when each fits.

Why it matters today

Most modern file transfer to cloud storage uses SFTP, the SSH-based protocol, because it runs cleanly over one port and needs no TLS certificate management. Plain FTP, the RFC 959 original, sends everything in cleartext and shouldn’t cross the public internet at all (see why plain FTP is insecure). Fifty years on, the protocol Abhay Bhushan sketched in 1971 is still moving files, just usually under a layer of SSH he never could have anticipated.