Free SFTP Server for Windows: What's Actually Free (and What's Worth Paying For)

Someone needs to send you files, the files are sensitive, and the answer everyone gives is SFTP. The next question is what to install, and the budget for it is zero.

We sell a commercial file transfer server, so the position is worth stating up front. CompleteFTP has no free SFTP tier. The Free Edition supports FTP and FTPS only, and SFTP starts at the Standard edition. If your requirement is free SFTP today, the useful part of this page is the first half, and you should take it on its own terms.

First, the honest answer

For most people asking this question, the answer is OpenSSH, which Microsoft ships as an optional feature of Windows 10 build 1809 and later, and of Windows Server 2019 and later. There is nothing to download, no additional licence, and no per-user cost. Enabling the OpenSSH Server optional feature, starting the sshd service and opening port 22 takes about ten minutes on a machine you already control.

That covers a genuinely large share of real requirements: a handful of accounts, a scheduled upload from a partner, a drop folder that a script picks up overnight. Deployments of that shape run on OpenSSH for years without anyone regretting it.

"Free SFTP" tools that aren't actually SFTP

Several Windows file transfer servers advertised as free support FTP and FTPS but not SFTP, so the protocol list is worth checking before you install one. The naming does not help. FTPS and SFTP sound like variants of one protocol and are unrelated in every way that matters.

FTPS is FTP wrapped in SSL/TLS, using certificates and the same control-and-data-channel architecture as plain FTP. SFTP is a subsystem of SSH, using a single connection and SSH host keys. The protocols are incompatible: an SFTP client cannot connect to an FTPS server, and no configuration setting on either side changes that. Our FTPS vs SFTP comparison goes through the differences in detail.

Checking before you install takes about a minute. Open the product's documentation, find the page that lists supported protocols, and look for the word SFTP or SSH specifically. "Secure FTP", "FTP over SSL" and "encrypted transfers" are all claims that a product with no SFTP support can make truthfully. If the docs list a port 22 listener or an SSH host key setting, the support is real. The same check applied to our own Free Edition returns FTP and FTPS, which is why it is described that way above.

The categories of free SFTP server for Windows

Four broadly different things get returned by a search for a free Windows SFTP server, and they fail in different ways.

OpenSSH, already on the machine

The default answer, and the one to rule out deliberately rather than by omission. It is maintained by Microsoft as part of the operating system, and it is patched through normal Windows Update.

What you do not get is a management interface. There is no user list to click through, no Active Directory wizard, no built-in log viewer, and no reporting. User accounts are Windows accounts, key management is file management, and every change is a text edit followed by a service restart.

This is the point to be careful about. SFTP runs over SSH, so unless you restrict it explicitly, an account you created purely to transfer files can also log in and run commands on the server. A partner given SFTP credentials may be able to open a shell, read files outside their own directory, and see much more of the machine than anyone intended. Two settings prevent it: ForceCommand internal-sftp, which permits file transfer and nothing else, and ChrootDirectory, which confines the account to one directory tree. Neither is applied by default. Check both before the server is reachable from outside your own network, and check them per account rather than assuming a global setting covers everyone.

Lightweight third-party servers

A small number of independent Windows servers implement genuine SFTP and are free to use. They tend to be the work of one developer or a small team, they usually offer the management GUI that OpenSSH lacks, and some of them are very good.

The conditions vary and are worth reading rather than assuming. Common ones are a cap on concurrent users or accounts, a restriction to non-commercial use, a limit on the number of configured folders, or an absence of any support commitment. A licence that excludes commercial use is the one that catches organisations out, because it is easy to install a tool for a personal experiment and harder to notice when the same install quietly becomes a business process.

Free tiers of commercial servers

Several commercial vendors offer a free edition alongside their paid ones. The free tier is a real product and often a good way to evaluate the software, and the thing to look at is what happens at the boundary. A free tier that caps users at five, and then requires a full re-platform when you hit six, has a different long-run cost from one where the paid edition is the same software with more of it switched on.

Check specifically whether the free edition supports SFTP or only FTP and FTPS, because a vendor whose paid product is a strong SFTP server may still restrict SFTP out of the free tier.

DIY builds on OpenSSH

Some teams build on OpenSSH deliberately, tightening its configuration, confining each group of users to its own directory, distributing keys through whatever tooling they already use, and forwarding logs into their existing monitoring. The result can be very good. The cost is the engineering time to build it and the ongoing obligation to maintain it.

This works well where there is a platform team that owns Linux and Windows infrastructure with the same tooling. It works badly where the SFTP server is one of forty things a two-person IT department looks after.

What "free" usually means in practice

The constraints below are not defects. They are the reasonable consequences of software given away, and they map fairly closely onto the reasons people eventually pay for something.

  • User limits. Free tiers commonly cap accounts somewhere between one and five. OpenSSH has no such cap, since accounts are Windows accounts.
  • No Active Directory group mapping. Authenticating a domain user is one thing. Mapping an AD group to a set of folder permissions, so that access follows group membership automatically, is a different feature and is rarely present.
  • Logging without reporting. Free servers generally log events. Turning those logs into something an auditor accepts, filtered by user and date range and exportable, is usually not included.
  • Manual key management. Adding a partner's public key means editing a file on the server. At five partners this is fine. At fifty, with rotations, it is a recurring task with no audit trail of its own.
  • Licence terms that exclude commercial use. Applies to some third-party free servers, and not to OpenSSH.
  • No clustering or failover. If the server goes down, transfers stop until someone brings it back.

When you'll outgrow free

Three conditions predict the move to a paid server more reliably than transfer volume or company size do.

User management has become manual work. The threshold varies by organisation, but somewhere past a handful of accounts, the combination of onboarding, offboarding, key rotation and permission changes turns into a standing task. The cost is real and mostly invisible, because it is distributed across many small interruptions rather than appearing as a line item.

Compliance has arrived. An auditor asking for evidence of who transferred what, and when, changes the requirement from "files move securely" to "files move securely and I can prove it". HIPAA and PCI DSS both push in this direction, and so does a customer security questionnaire that asks about access logs and retention.

This is not a hypothetical trigger. It arrives as a list of requirements rather than a question, and the list is usually written by somebody who will not accept a partial answer. One organization opened its enquiry by asking for a HIPAA business associate agreement, followed by the table of capabilities it was assessing vendors against:

"Encryption at rest ... Activity logs ... IP lockouts and alerts ... Validated HIPAA compliance ... Ability to view logs per user connection ... Last user access report"
a US healthcare benefits organization (EnterpriseDT support archive)

Automation and onboarding become workflows. Scheduled transfers, post-upload processing, alerting when a partner's nightly file fails to arrive, and a repeatable process for onboarding a new trading partner are all things that get scripted around a free server first and eventually outgrow the scripts.

One organization described the arrangement they were trying to replace:

"replace our existing legacy ftp system, which was hacked together eons ago by a long gone developer, consisting of windows Batch scripts, powershell, vbs and WinScp all scattered about in various folders and ran using a couple different scheduling tools with something where it is all contained in a single easy to grasp interface.. so CompleteFTPs Events tab looks like it could be a really good option, especially as it also has scheduling built in"
a US financial services organization (EnterpriseDT support archive)

What to look for in a paid SFTP server

Per-server perpetual licensing

A perpetual licence means you pay once and own the version you bought, with support and updates renewing annually and the software continuing to run if you stop renewing. Subscription pricing means the software stops when payment does. Over three to five years the difference is substantial, and it is worth calculating rather than assuming.

Unlimited users at every tier

Per-user pricing turns every new partner into a purchasing conversation, and it interacts badly with seasonal or project-based access. A server licensed per machine with no per-user component removes that friction entirely.

Active Directory integration with group mapping

Authenticating against AD is the minimum. The feature that saves ongoing work is mapping a domain group to a set of folder permissions, so that adding someone to the group grants access and removing them revokes it, without a separate step on the file transfer server.

Audit logging an auditor can read

Look for logs that record the user, the file, the action, the timestamp and the source address, retained for a configurable period, filterable and exportable. The test to apply is whether you could answer "show me everything this partner downloaded in March" in a few minutes.

An upgrade ladder that doesn't force a re-platform

Requirements grow in a fairly predictable order: SFTP, then AD integration and real logging, then automation, then encryption at rest and high availability. A product where each of those is the next edition up is much cheaper to grow into than one where the next step is a different product entirely.

Where CompleteFTP fits

CompleteFTP is the paid path beyond free rather than a free SFTP option. The Free Edition supports FTP and FTPS, and SFTP begins at the Standard edition, which also adds Windows user accounts. The Professional edition adds SCP, SSH terminals, HTTPS, Active Directory and Windows domain users, process triggers, IP filtering, quotas and reporting. Enterprise MFT adds encryption at rest, Azure and Amazon storage backends, clustering, the command-line interface and two-factor authentication.

Licensing is per server and perpetual, and the number of users is unlimited in every edition, including the free one.

If OpenSSH is doing the job, keep it. It is free, supported by Microsoft, and appropriate for a great many deployments. The point at which a commercial server starts to pay for itself is the point at which user administration, audit evidence or transfer automation has become somebody's recurring job.

Frequently asked questions

Is there a free SFTP server for Windows?

Yes. Microsoft ships OpenSSH as an optional feature of Windows 10 build 1809 and later, and of Windows Server 2019 and later. Enabling the OpenSSH Server feature gives you a working SFTP server with no download and no additional licence. Several small third-party servers also offer genuinely free SFTP, usually with limits on user count or on commercial use.

Does Windows have a built-in SFTP server?

Windows includes OpenSSH as an optional feature rather than as something enabled by default. Install the OpenSSH Server optional feature, start and enable the sshd service, and open port 22 in the firewall. The SFTP subsystem is part of that package, so SFTP works as soon as SSH is running.

What is the best free SFTP server for Windows?

For most requirements it is OpenSSH, because it is already on the machine, it is maintained by Microsoft alongside the operating system, and it is patched through normal Windows updates. Third-party free servers become interesting when you specifically want a management GUI, and the trade-off is usually a cap on users or a licence that excludes commercial use.

Can I use OpenSSH as a free SFTP server?

Yes, and it is a legitimate production choice for small deployments. Configuration lives in sshd_config and is edited by hand. Pay particular attention to separating SFTP access from shell access, because an account that can transfer files over SSH can generally also open a terminal session unless you restrict it explicitly.

What are the limits of free SFTP servers?

The common limits are caps on the number of accounts, no Active Directory group mapping, logging that records events without producing reports an auditor can use, manual key management, no clustering or failover, and licence terms that exclude commercial use. None of these matter at five users, and most of them matter at fifty.

Other technical articles

Download Free Trial