SFTP Server for Windows: Options and How to Choose (2026)

You need an SFTP server running on Windows. There are four kinds to choose from, and which one fits depends on three things: how many people will use it and who creates their accounts, whether logins have to come from Active Directory, and whether you will ever have to prove what was transferred. Answer those and the field narrows to one category, usually in a few minutes.

We make a Windows SFTP server, CompleteFTP, so this guide cannot be neutral. It is organised around the decisions rather than around product names, because the decisions do the narrowing.

The four kinds of SFTP server for Windows

Kind Fits Stops fitting when
Windows's built-in OpenSSH One or two users, a dev box, command line is fine You need a GUI, per-user folders, audit logs or domain group mapping
Lightweight SFTP server Small team, simple file drops, no compliance pressure An auditor asks for logs, or you need clustering
Commercial Windows-native SFTP server Active Directory, audit logs, automation, or a compliance regime Rarely; this is where most production Windows shops land
Enterprise managed file transfer platform Partner onboarding portals, EDI translation, complex cross-system workflows The requirement is simply a secure SFTP server

SFTP is the SSH File Transfer Protocol: file transfer over an SSH connection, on port 22, unrelated to FTP and its secure extension FTPS despite the name. If the difference matters to you, see FTPS vs SFTP and which ports each protocol uses.

Customers ask the question in exactly these terms:

"I use CompleteFTP Professional edition already for a customer. I have another customer which need to have a SFTP server on which we can connect with rsa key. I know CompleteFTP can do it, but I can't see wich version is needed to accomplish this (Standard or Professional)"
a French IT services organization (EnterpriseDT support archive)

Three questions that pick the category

How many users, and who creates them?

With two or three accounts, editing a config file and creating Windows users by hand is fine. With twenty, it is a standing chore, and offboarding is the part that gets forgotten. Past a handful of users you want a management console where an account, its home folder and its permissions are one screen, and you want accounts that expire.

Does authentication have to come from Active Directory?

If you have a domain, the answer is usually yes, because a separate user database is a second place to forget to remove someone. What "AD integration" means varies. At its simplest a server accepts domain credentials. A better implementation maps AD groups to folders and permissions. The most complete picks up group changes automatically, so removing someone from a group removes their access without an administrator doing anything.

Windows's OpenSSH will authenticate domain accounts and you can restrict logins to a domain group in sshd_config, but there is no console, no group-to-folder mapping, and no Entra ID support. Commercial Windows-native servers generally do all three. Our SFTP server with Active Directory guide works through the options step by step.

Do you have to prove what happened?

HIPAA, PCI DSS, SOX and most partner contracts come down to the same question: can you show who transferred which file, when, and that it was encrypted on the way. That needs a per-transfer audit log you can read and ship to a SIEM, per-user access control, and often encryption at rest. OpenSSH logs to the Windows event trace by default, and you build the rest yourself. Commercial servers ship it as a feature. Auditors notice the difference.

In regulated environments the question arrives in that form:

"A question arose that CompleteFTP was not HIPAA compliant. We have done research on our end, and I'm sure others probably asked as well. What is CompleteFTP's response to that? And how do we satisfy our auditors?"
a US healthcare organization (EnterpriseDT support archive)

Two other things that separate them

Licensing model. OpenSSH is free. Many other "free" Windows file transfer servers do FTP and FTPS only, not SFTP, so check the protocol list; our guide to what is actually free in a Windows SFTP server goes through them. Commercial servers are either a perpetual licence per server (pay once, own the version, renew support annually if you want updates) or an annual subscription that scales with users, tiers or data volume, often into tens of thousands per server per year at the enterprise MFT end. Subscription pricing is rarely published, which makes comparing options before a sales call close to impossible. A published per-server price sidesteps that, and over three to five years the totals look very different.

Operations and maintenance. Every SFTP server has to be patched, hardened, monitored and backed up. The differences are in clustering for high availability, audit logs you can ship to a SIEM, scripting hooks so the server can act on files as they arrive, storage on S3, Azure or SharePoint behind the same endpoint, and whether hardening is a set of defaults or a project. OpenSSH inherits all the standard SSH hardening guidance, and the work is yours.

Setting up a Windows SFTP server

The OpenSSH route, in four commands

OpenSSH Server ships as an optional feature of Windows Server 2019 and later and Windows 10 build 1809 and later, and is installed by default on Windows Server 2025. In an elevated PowerShell prompt:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'
New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

Setup normally creates the firewall rule for you; the last line is for when it has not. Windows accounts can now log in over SFTP; on Windows Server 2025 only members of the local OpenSSH Users group can, so add users or a domain group to it. Before you let anyone else near it, edit %programdata%\ssh\sshd_config to set ForceCommand internal-sftp and a ChrootDirectory for transfer-only users, because by default an SFTP login can also open a shell and read outside its own folder. Restart the service after any change to the file.

That is a working SFTP server in about ten minutes. What it is not is a managed one: no console, no per-user folder mapping without config edits, and logs in the event trace unless you set SyslogFacility LOCAL0.

The managed route

A commercial Windows-native server is an installer, a console and a user list. With CompleteFTP the sequence is: run the installer (it installs as a Windows service and starts with the machine), open CompleteFTP Manager, add a user, set a password or click Random to generate one, accept the default home folder, and connect with any SFTP client. The trial starts you on the top edition and lets you switch editions in the Licensing panel while you evaluate. Our step-by-step guide to setting up an SFTP server on Windows covers both routes in full, including hardening, audit logging and backup, and connecting with FileZilla and WinSCP covers the client side.

Which Windows SFTP server for which shop

Windows shop with Active Directory and 50+ users

You need AD integration with group-to-permission mapping, audit logs, and a console your other admins can use. Shortlist in the commercial Windows-native category. If you want a perpetual licence rather than a subscription, that points to CompleteFTP Professional or Enterprise MFT. If you need partner portals, complex automation and EDI, step up to Enterprise MFT or an enterprise MFT platform.

Healthcare or finance under HIPAA or PCI DSS

You need audit logs an auditor can read, encryption in transit and at rest, role-based access and multi-factor authentication. Shortlist commercial servers and MFT platforms that publish HIPAA and PCI support; they differ mainly in licensing model and in how cleanly their audit reporting maps to your auditor's framework. CompleteFTP Enterprise MFT covers all four on a perpetual licence.

Dev team that needs SFTP working today

Use OpenSSH. It is already on the box and takes the four commands above. Lock each account to file transfer only. If the use case grows into something production-shaped (more users, audit needs, AD), move to a commercial Windows-native server on your own schedule rather than under pressure once the requirement appears. OpenSSH does not grow into those capabilities, so outgrowing it means migrating, and our guide to moving an SFTP server to a new machine covers how to do that without a locked-out cutover.

Where CompleteFTP fits

CompleteFTP runs on 64-bit Windows, from Windows Server 2003 through 2022 and Windows 8 through 11, with .NET Framework 4.7.2 or later; the Enterprise MFT edition also runs on Linux. It supports SFTP, SCP, FTP, FTPS, HTTP and HTTPS. Licensing is per server and perpetual: you pay once, own the version you bought, and every edition allows unlimited users. Upgrading between editions later costs the price difference plus a small administration fee.

Against the four categories:

  • Standard is the lightweight option with a full console: SFTP, FTPS and FTP, Windows users, network folders, user expiry.
  • Professional is the commercial Windows-native server most shops land on: adds Active Directory users, auditing, email and process triggers, disk and bandwidth quotas, IP filtering with auto-banning, HTTPS with web-based file managers and administration, SCP, and server-side JavaScript extensions.
  • Enterprise MFT reaches into the managed-file-transfer tier: two-factor authentication, SAML single sign-on, encryption at rest, native PGP, automated transfers, an administration REST API, multiple sites, a multi-protocol gateway, active/active clustering behind a load balancer such as Windows NLB, and folders on Azure, Amazon S3, Google Cloud Storage, SharePoint and OneDrive. It does not include the partner-onboarding portals and EDI translation of the largest platforms.

Every edition can be administered from the CLI and by an AI assistant over MCP. Built by a company that has been shipping file-transfer software since 1999, with customers including NASA, Boeing, Lockheed Martin, IBM, Siemens, Deutsche Bank, Disney and Walmart.

One real gap: CompleteFTP does not have the analyst coverage of the large subscription platforms, which affects how often it reaches a shortlist assembled from published research. The practical response is to run it against your own environment and judge it there.

Not sure which SFTP server fits your environment? Ask our AI assistant

What to avoid

  • Port 22 open to the internet with password authentication on. Use keys or AD-backed authentication, and rate-limit or geo-restrict connections.
  • Logs that rotate out after a week. Useless for compliance and for the post-incident question of what left the building. Ship them to a SIEM or a long-term store.
  • One shared account for all partners. Each partner gets its own user scoped to its own folder, or you cannot revoke one without affecting the rest. Our guide to receiving files from partners over SFTP covers per-partner isolation and alerting when a file does not arrive.
  • Old SSH versions and weak algorithms. SSH-2 only, deprecated ciphers, key exchanges and MACs off. If a scanner has already flagged yours, hardening SSH ciphers explains what to disable and why the scanner flags algorithms nobody negotiates.
  • No vendor due diligence. Every product in this space will have a vulnerability eventually. Ask any vendor, including us, about patch cadence and advisory history before you commit.
  • No backup of the server configuration. The host can be rebuilt; the user database, key pairs and trigger configuration cannot.

Frequently asked questions

How do I set up an SFTP server on Windows?

Either enable the built-in OpenSSH server (the four PowerShell commands above, then lock accounts to SFTP only in sshd_config) or install a commercial Windows-native server and add users in its console. Our step-by-step setup guide walks through both, including hardening and audit logging.

Does Windows Server have a built-in SFTP server?

Yes. OpenSSH Server is an optional feature of Windows Server 2019 and later and Windows 10 build 1809 and later, and is installed by default on Windows Server 2025. It has no console, no per-user folder mapping without config edits, and logs to the event trace by default.

What is the best free SFTP server for Windows?

For a genuinely free SFTP server on Windows, OpenSSH is the main option. Many servers advertised as free do FTP and FTPS only, so check the protocol list. Our guide to what is actually free in a Windows SFTP server covers where the limits fall.

How do I connect to an SFTP server from Windows?

With the built-in client from a command prompt (sftp user@host), or with a graphical client such as FileZilla or WinSCP. Connecting to an SFTP server with FileZilla and WinSCP covers both.

Can an SFTP server use Active Directory?

Only if the server supports it. OpenSSH accepts domain credentials and can restrict logins to a domain group, but has no console or folder mapping. Commercial Windows-native servers, including CompleteFTP from the Professional edition, map AD users and groups to folders and permissions. See the SFTP server with Active Directory guide.

Is SFTP more secure than FTPS?

Both can be configured to be equally secure. SFTP uses one port and SSH; FTPS uses TLS and usually several ports, which is where most FTPS firewall trouble starts. See FTPS vs SFTP.

Do SFTP servers support HIPAA and PCI DSS compliance?

The protocol does not make you compliant; the configuration does. You need encryption in transit, a per-transfer audit log, per-user access control and usually encryption at rest. Commercial SFTP servers expose these as features. With OpenSSH you build the audit and access layers yourself.

Try CompleteFTP as your Windows SFTP server

CompleteFTP is compact, installs as a Windows service, and has users connecting over SFTP within minutes of the installer finishing. SFTP is included from the Standard edition up.

Other technical articles

Download Free Trial