SFTP connection tester for SFTP, FTPS and FTP
Enter a host and port. We resolve it, connect from the internet and show each step with timings: the SSH banner and the algorithms the server offers, or the FTP banner and its TLS certificate. No credentials needed.
Nothing to test yet? Try , a public test server that speaks all four protocols.
What the test checks, and nothing more.
DNS and TCP
Which addresses the name resolves to and whether the port accepts a connection from the internet, with timings.
SSH handshake
The server's SSH banner and its KEXINIT: key exchange, host key, cipher and MAC algorithms, with weak ones flagged.
FTP and FTPS
The 220 banner and FEAT list. For FTPS, AUTH TLS or implicit TLS, the TLS version, cipher and certificate details.
Certificate checks
Whether the chain is trusted, the certificate covers the host name, and how many days are left before it expires.
Questions about the tester.
Is it safe to test my server with this tool?
Yes. The tester never logs in and never asks for or sends credentials. It reads what the server sends before authentication (the SSH banner and algorithm list, or the FTP banner, FEAT and TLS handshake) and then disconnects. Results aren't stored.
What does a weak algorithm warning mean?
The server still offers an algorithm that is considered insecure or deprecated, such as diffie-hellman-group1-sha1, ssh-rsa host key signatures (SHA-1), CBC ciphers or hmac-sha1 and hmac-md5. Modern clients usually pick a strong option anyway, but offering weak ones fails security scans and lets old clients downgrade. Remove them from the server configuration.
What is the Terrapin warning?
Terrapin (CVE-2023-48795) is an attack on the SSH handshake that affects chacha20-poly1305 and CBC ciphers with encrypt-then-MAC. Servers patched since late 2023 advertise strict key exchange ([email protected]), which fixes it. If the warning shows, update the SSH server.
Which port does SFTP use?
Port 22 by default, the same as SSH, because SFTP runs inside an SSH connection. Many hosted services use another port, such as 2222. SFTP isn't FTP over TLS; that's FTPS, which uses port 21 (explicit) or 990 (implicit).
Why can't I test localhost or a private IP address?
The test runs from our servers on the public internet, so it can only reach public addresses. Host names that resolve to private, loopback, link-local or reserved addresses are refused, and only ports 21, 22, 990 and 1024–65535 are allowed. Each visitor can run 10 tests per 10 minutes.
The test passes but my client still can't connect. What next?
A passing test means the server is reachable and speaking the protocol. Login problems are usually the username, password or SSH key, or an IP allowlist on the server. For FTP and FTPS, also check the passive port range: the tester doesn't open data connections, and blocked passive ports are the most common cause of listings that hang.
More in the docs: Quickstart · SFTP users and keys