SFTP Server for Windows: How to Choose the Right One (2026)

Choosing an SFTP server for Windows is largely a question of which kind of server the situation calls for, and that follows from a small number of structural decisions about authentication, licensing, operational features and ongoing maintenance.

We make an SFTP server for Windows, CompleteFTP, so this guide cannot be neutral. We have tried to be even-handed anyway, and it is organised around those decisions rather than product names, because they narrow the field faster than a feature-by-feature comparison does.

What SFTP is

SFTP (SSH File Transfer Protocol) is a protocol for transferring files securely over an SSH connection. It runs as a subsystem of SSH and is unrelated to FTP despite the similar name, and it is the standard secure file-transfer protocol on Windows and Linux. If you want the deeper explainer including SCP and SSH, skip to the full section further down.

Which kind of server fits your shop

If your shop looks like...	The kind of server to use
One or two users, a dev box, command line is fine	Windows's built-in OpenSSH
Small team, simple file drops, no compliance pressure	A lightweight SFTP server
Active Directory, audit logs, automation, encryption at rest, or a compliance regime	A commercial Windows-native SFTP server
Partner onboarding portals, EDI translation, or complex cross-system workflows	An enterprise managed file transfer platform

The rest of this page explains those choices and covers the protocol basics underneath them.

Customers ask the question in exactly those terms:

"I use CompleteFTP Professional edition already for a customer. I have another customer which need to have a SFTP server on which we can connect with rsa key. I know CompleteFTP can do it, but I can't see wich version is needed to accomplish this (Standard or Professional)"

a French IT services organization (EnterpriseDT support archive)

What separates one SFTP server from another

Four characteristics account for most of the practical difference between servers in production. They appear below in roughly the order they matter to a typical Windows shop, although that order shifts for organisations working under a specific compliance regime.

Active Directory and Windows integration

If you have a domain, you want AD integration. The alternative is creating and managing SFTP users in a separate database, which is extra maintenance and a security risk, since offboarding there is easy to forget.

What "AD integration" means varies considerably between products. At its most basic it authenticates users against AD with their domain credentials. A more capable implementation maps AD groups to permission sets on the server, and the most complete picks up directory changes automatically, so that a change of group membership revokes access without an administrator doing anything.

Windows's built-in OpenSSH has none of this, while commercial Windows-native servers generally do. Our SFTP server with Active Directory guide works through the available approaches and a step-by-step walkthrough.

Licensing model

Pricing in this category follows a few recognisable patterns:

Free. OpenSSH, and the free tier of some third-party servers. Lowest cost, highest operational burden. Note that many "free" Windows file transfer servers only do FTP and FTPS, not SFTP.
Perpetual license, per server. You pay once and own the version you bought. Support and updates renew annually, but the software keeps running if you stop renewing.
Annual subscription. The usual model for enterprise managed file transfer platforms. You pay every year, and costs typically scale by user count, feature tier, or data volume, often into the tens of thousands per server, per year.

Published pricing is uncommon at the subscription end of the market, and buyers feel it. Comparing options means filling in a form, waiting for a sales call, and negotiating a figure that shifts with how much you reveal about your budget and headcount. It is one of the most common frustrations we hear about the category, and it makes an apples-to-apples comparison almost impossible before you are already deep in a sales process. A perpetual license priced per server, published and the same for everyone, sidesteps that entirely, and across three to five years it produces a very different total cost.

One thing to know before you buy: a perpetual license has to move when the server does, and the order you do it in matters. Our guide to migrating a file transfer server to a new machine covers the config export and the release-then-activate sequence that avoids a locked-out cutover.

Operational maturity

What this means in practice: clustering for high availability, real audit logs you can ship to a SIEM, scripting hooks for custom workflows, and an API you can automate against.

Free options skip most of these. Mid-tier commercial servers include some. Full managed file transfer platforms include all of them, plus partner onboarding portals and EDI translation that you probably don't need unless you're already asking for them. Storage is a separate question from features: a server can keep files on local disk or on S3, Azure or SharePoint behind the same SFTP endpoint.

Scripting hooks deserve particular attention, because they determine whether the server can act on files as they arrive rather than simply storing them. Our guide to SFTP automation covers the two architectures available and the point at which each stops being suitable.

Maintenance burden

Every SFTP server has to be patched, host-hardened, monitored, and backed up. Some make this easier than others.

OpenSSH inherits all the standard SSH hardening guidance, including disabling password authentication, restricting cipher suites and rate-limiting connections, but the work is yours to do. Commercial servers ship hardened defaults and expose the configuration through a GUI, which is worth considerably more to a team with little administrative time to spare than to one already maintaining Linux hosts.

The types of SFTP server for Windows

Almost every Windows deployment falls into one of four broad categories, and settling on the category first makes the subsequent product comparison a much smaller exercise.

Windows's built-in OpenSSH, the free baseline

Microsoft ships OpenSSH as an optional feature on Windows 10 (build 1809+) and Windows Server 2019+. Enable it, start the service, open port 22, and you have SFTP. No license, no GUI, no per-user fees.

It fits a single-server dev environment, a CI/CD artifact drop, or a one-user transfer endpoint. It stops fitting once you have more than a handful of users, want AD integration without manual config, need audit logs for compliance, or want a management GUI rather than config-file edits. OpenSSH does not develop into those capabilities over time, so outgrowing it means migrating to a different product, a move to plan for at the outset.

Lightweight SFTP servers

A range of small commercial and free servers sit just above the OpenSSH baseline. They are easy to install, friendlier than editing sshd_config, and adequate for simple file drops. What they typically lack is real AD integration, audit logging an auditor will accept, and any form of clustering, which makes them a reasonable fit for small teams without compliance obligations and a constraint for anyone who acquires them.

Commercial Windows-native SFTP servers

This is where most production Windows shops land. Servers in this category offer full protocol support, Active Directory integration, audit logging, an administrative GUI, and licensing that does not scale with user count. They are built to run as a hardened production service.

If you have a domain, more than a handful of users, and any compliance pressure, this is the category to shortlist in.

Enterprise managed file transfer platforms

At the top end, enterprise MFT vendors add workflow automation, partner onboarding, EDI translation, and broad analyst coverage, usually on annual subscriptions that run into the tens of thousands per server, per year. That expense pays off where the workflow depth is genuinely required; where the requirement is simply a secure SFTP server, it is hard to justify.

Where CompleteFTP fits

CompleteFTP runs on Windows and Linux and supports SFTP, FTPS, SCP, HTTP, HTTPS, and FTP. SFTP is available from the Standard edition up, with Professional and Enterprise MFT adding more on top. Per-server perpetual licensing. You pay once and own the version you bought. Unlimited users at every tier.

Against the four categories above: the Standard edition is a lightweight SFTP server with a full GUI; Professional and Enterprise MFT are commercial Windows-native servers; and Enterprise MFT reaches into the managed-file-transfer-platform tier, adding automation, active-active clustering, encryption at rest and cloud storage backends on a perpetual license rather than a subscription, though without the partner-onboarding portals and EDI translation of the largest platforms.

As you move up the editions you get directory integration (Active Directory, LDAP, and SAML single sign-on) with group-to-permission mapping, full audit logging suitable for HIPAA and PCI DSS, .NET and JavaScript extensibility, scheduled transfers, encryption at rest (Enterprise MFT), active-active clustering (Enterprise MFT), and cloud storage backends including Azure Blob and Amazon S3 (Enterprise MFT).

Built on 20+ years of active development, with customers including NASA, Boeing, Lockheed Martin, IBM, Siemens, Deutsche Bank, Disney, and Walmart.

One real gap: CompleteFTP does not have the analyst coverage of the large subscription platforms, which affects how often it reaches a shortlist assembled from published research. The practical response is to run it against your own environment and judge it there.

Picks by scenario

Windows shop with Active Directory and 50+ users

You need AD integration with group-to-permission mapping, audit logs, and a UI your other admins can use. Shortlist in the commercial Windows-native category. If pricing matters and you want a perpetual license rather than a subscription, that points to CompleteFTP (Professional or Enterprise MFT edition). If you need the broader workflow feature set, covering partner portals, complex automation and EDI, step up to CompleteFTP Enterprise MFT or an enterprise MFT platform.

Healthcare or finance with HIPAA/PCI compliance

You need audit logs an auditor can read, encryption in transit (SFTP gives you that) and at rest, role-based access, and multi-factor auth. Shortlist commercial servers and MFT platforms that publish HIPAA/PCI support. Products differ mainly in licensing model and in how cleanly their audit reporting maps to the framework your auditors work from. CompleteFTP Enterprise MFT covers all of these on a perpetual license.

In these environments the driving question is less about the protocol than about the audit:

"A question arose that CompleteFTP was not HIPAA compliant. We have done research on our end, and I'm sure others probably asked as well. What is CompleteFTP's response to that? And how do we satisfy our auditors?"

a US healthcare organization (EnterpriseDT support archive)

Dev team that just needs SFTP working today

Use OpenSSH. It's free, it's already on the box, and it takes about ten minutes to enable. Lock each account down to file transfer only, though, because by default an OpenSSH SFTP login can also open a shell and read outside its own folder; our free SFTP server guide covers how. Whatever you land on, your users still have to reach it, which is covered in connecting to an SFTP server with FileZilla and WinSCP. If the use case grows into something production-shaped (multiple users, audit needs, AD integration), move to a commercial Windows-native server such as CompleteFTP, with SFTP from the Standard edition up. It is easier to make that move on your own schedule than under pressure once the requirement appears.

What to avoid

A few anti-patterns that show up regularly in SFTP deployments:

Port 22 exposed to the public internet with password auth enabled. Disable password auth, enable key-only or AD-backed authentication, and rate-limit or geo-IP-restrict connections.
No audit log retention policy. Logs rotated out after 7 days are useless for compliance and post-incident forensics. Ship them to a SIEM or a long-term log store.
Shared service accounts for partner transfers. Each external partner should authenticate as a distinct user, scoped to their drop folder, because shared credentials make it impossible to withdraw one partner's access without affecting the others. Our guide to setting up an SFTP server to receive files from partners covers per-partner isolation, catching files the moment they land, and alerting when one doesn't arrive.
Old SSH versions or weak algorithms. Disable SSH-1 and keep SSH-2 only, and turn off deprecated ciphers, key exchanges and MACs. Most modern servers ship this way, but check. If a vulnerability scan has already flagged yours, our walkthrough on hardening SSH ciphers covers what to disable, what to keep, and why the scanner flags algorithms nobody actually negotiates.
Skipping vendor due diligence. Every product in this space will have a vulnerability eventually. Ask any vendor (including us) about patch cadence and advisory history before you commit.
No backup of the server config. The host can be rebuilt. The user database, key pairs, and trigger configuration cannot, unless you have a backup.

What is SFTP?

SFTP is an abbreviation of SSH File Transfer Protocol, and is exactly that: a protocol for transferring files over an SSH connection.

SFTP is not standard FTP running over SSH. Although it has similar capabilities and even similar commands to standard FTP, those similarities are superficial. The protocol is completely different and incompatible with FTP and its secure extension, FTPS. (For that distinction, see FTPS vs SFTP.)

SCP is also a file transfer protocol that runs over SSH connections. It's a precursor to SFTP and allows copying files and directories over SSH, but provides no other file operations: no listing, deleting, renaming, or directory navigation.

A quick word on SSH

SSH is a standard for logging in and executing commands on a remote computer over an encrypted network connection. To accept SSH connections, a computer must run an SSH server (such as sshd) on a publicly accessible port, usually port 22.

Authentication works two ways. In password authentication, the client supplies a password the server verifies. In public key authentication, the client signs data with its private key and the server verifies the signature with the client's public key. Clients validate the server in turn via a known-hosts file that pairs each host with its public key. For the full picture, see how SSH works.

Frequently asked questions

Does Windows have a built-in SFTP server?

Yes. Windows 10 (build 1809+) and Windows Server 2019+ include OpenSSH server as an optional feature. It's free and functional, but it has no GUI, no Active Directory wizard, and no built-in audit log viewer. Fine for one or two users, painful at scale.

What is the best free SFTP server for Windows?

For a genuinely free SFTP server on Windows, OpenSSH (built into Windows 10 and Server 2019+) is the main option. Many file transfer servers advertised as free only support FTP and FTPS, not SFTP, so check the protocol list. If you need SFTP plus a GUI, Active Directory integration, or audit logging, you're into paid commercial-server territory. Our guide to what is actually free in a Windows SFTP server covers where those limits fall.

Is SFTP more secure than FTPS?

Both can be configured to be equally secure. SFTP uses a single port and SSH-based encryption, which is friendlier to firewalls. FTPS uses TLS and typically requires multiple ports, which is where most FTPS firewall trouble starts. SFTP and FTPS ports explained covers 22, 21, 990 and the passive range. Most modern Windows deployments default to SFTP because firewall configuration is simpler, but FTPS remains common in B2B contexts where SSL/TLS infrastructure already exists. See our SFTP vs FTPS comparison for the deeper protocol difference.

Can an SFTP server integrate with Active Directory?

Yes, but only if the server supports it. OpenSSH on Windows has no GUI for Active Directory integration. You can map AD users manually, but there's no wizard. Commercial Windows-native SFTP servers, including CompleteFTP, offer AD and LDAP integration as a configurable feature. If you have a domain and 10 or more users, AD support saves a lot of administrative work. See our SFTP server with Active Directory guide for the step-by-step setup.

How do I set up an SFTP server on Windows Server?

Our step-by-step guide to setting up an SFTP server on Windows covers this in full. In short, three common approaches: (1) Enable OpenSSH via Optional Features, open port 22 in Windows Defender Firewall, and start the OpenSSH SSH Server service. (2) Install a commercial SFTP server such as CompleteFTP and use its setup wizard. (3) Use the IIS FTP server with FTPS enabled. Note this is FTPS, not SFTP. Approach 2 is the standard production path for shops past the dev or test stage.

Do SFTP servers support HIPAA and PCI DSS compliance?

The protocol itself doesn't make you compliant; your configuration does. For HIPAA or PCI DSS you need encryption in transit (SFTP gives you that), audit logging of every transfer, access controls per user, and typically encryption at rest for stored files. Commercial SFTP servers expose these as built-in features. With OpenSSH you'd build the audit and access layers yourself, which auditors generally don't like.

Try CompleteFTP as your Windows SFTP server

CompleteFTP supports SFTP, SCP and SSH alongside FTPS, HTTPS and FTP. It's compact, simple to install, and you can be running in a couple of minutes. SFTP is supported from the Standard edition up.

Compare editions: Standard, Professional, and Enterprise MFT. Per-server perpetual licensing.
Download the 30-day trial: full feature set, no credit card, no sales call.
MFT vs SFTP guide: if you're still deciding whether you need a full managed file transfer platform or just an SFTP server.