WinSCP

A little bit of history

Mr. Martin Prikryl is still doing it. Twenty-six years. One guy in Prague, one application, same codebase spine, still shipping releases. I do not know how you keep that up. I really do not. I have abandoned three side projects in the last two years and he has been holding WinSCP together since I was using Windows 2000 on an AMD Athlon XP.

I have had WinSCP on my work laptop continuously since around 2007. When I launched DownloadBestSoft it was one of the tools I used to perform updates but this is another personal story.

The origin is almost suspiciously mundane. Martin Prikryl was at the University of Economics in Prague in early 2000. A colleague called Jan Havlicek kept badgering him for a graphical tool to replace the command-line SCP stuff everyone was using. Mr. Martin Prikryl built him one. The name "WinSCP" was supposed to be a placeholder that got replaced later and never was, even after SFTP and FTP and WebDAV and S3 got bolted on.

Version 1.0 in late 2000 only did SCP over SSH-1. Czech and English. Mr. Martin Prikryl realised fairly quickly the initial design was too limited and rewrote it for the 2.x series in October 2001, which is when the Explorer-style interface arrived and WinSCP went from niche utility to the thing your non-technical colleague could actually use. July 2003, moved to SourceForge, relicensed under GPL. A month earlier he had added SFTP.

The architecture is the bit most reviews skip and the bit that matters. WinSCP is not one codebase. It is a synthesis. The SSH and SCP plumbing is PuTTY. The FTP stack is FileZilla's code. WebDAV and S3 are native - Mr. Martin Prikryl wrote those himself. This is why it feels so solid (three mature codebases doing what they are best at) but also why it has certain frustrating limits. SSH is single-threaded because PuTTY is single-threaded.

The SFTP implementation is actually clever. Unlike SCP which tunnels a remote cp command, SFTP is a proper filesystem abstraction sending read and write requests, waiting for responses. Pipelining is what makes it fast - 32 chunks of 32KB in flight simultaneously, a 1MB buffer of data in transit at any time. A lot of SFTP clients in the mid-2000s did not pipeline and the transfers felt like dialup. Mr. Martin Prikryl got this right early and it served me so well back in Germany in 2012 when I had a slow connection - of course I had to change a few settings (more below).

Important: on the Advanced Site Settings, under Connection, there is a checkbox called "Optimize connection buffer size." It is ticked by default. Untick it before you do anything else if you are transferring to any kind of virtualised environment or anything that is not a stock Linux server on normal Ethernet. I have seen this single checkbox take throughput from 300 KB/s to 30 MB/s on a Nutanix cluster one of my clients runs. The optimisation fights the Windows TCP stack's own window scaling on specific network setups and the result is buffer bloat and retransmissions. Untick it. Write it on a post-it.

Cipher choice matters less than it used to. AES-GCM is what you want if the server supports it (hardware acceleration on any modern CPU). ChaCha20-Poly1305 is what you want on older hardware without AES-NI. Blowfish used to be the "fast on slow CPUs" option but nobody should be running anything that old anymore. Version 6.0 added NTRU Prime for post-quantum key exchange which is genuinely overkill for most of us but not a bad default if you transfer anything sensitive that needs to stay confidential for decades. Very few file transfer clients bothered with post-quantum at all.

About security - WinSCP had a nasty one in early 2021. Anything before 5.17.10 was vulnerable. A bloke works out you can stuff "raw settings" parameters into a crafted sftp:// or scp:// URL and trick WinSCP into launching programs. Click a bad link on a web page, you are compromised. That is it. No dialog, no warning. Ugly but it was patched by restricting what URL handlers could do. This is the price of convenient browser integration - a feature that makes your life easier is a feature that makes your life easier for an attacker too.

Much worse than any actual CVE is the malvertising. If you Google "WinSCP download" right now there is a decent chance the top result is a Google Ad pointing at winsccp.net or vvinscp.net or winccp.net. Look carefully at those. One extra c, two v's where there should be a w, slight variants. You land on a near-perfect clone of the official site, you download what looks like a normal ZIP, inside is a genuine WinSCP installer plus a sneaky DLL - python311.dll, innocuous-sounding, the kind of thing that does not set off alarms. The real installer runs in the foreground while the DLL side-loads Cobalt Strike or a BlackCat ransomware dropper.

Your antivirus does not flag the genuine installer because it is genuine. Several of these malicious domains actually Rickroll anyone visiting from a suspicious HTTP referrer - redirect to the Rick Astley music video if they think you are a security researcher or a bot.

Note: I am one of the quiet fighters against this garbage and have been for over a decade. Type the URL by hand or bookmark it. Never click sponsored search results for any developer tool. Also check the file signatures and upload it to VirusTotal. A good idea would be to download it from dAppCDN as you can check a few things related to security.

I have been using WinSCP "portable mode" for so many years. Normal WinSCP dumps settings into the Windows Registry. Portable mode keeps everything in WinSCP.ini sitting next to the executable, which means an encrypted USB stick with WinSCP and the INI on it is my entire sysadmin toolkit and leaves no trace on whatever machine I plug into. Fifteen client sessions, master password set, works on any Windows box I encounter. This is the right workflow for auditors and consultants and anyone who does not want their SFTP history in a registry hive on a client's laptop.

That drag-and-drop thing between WinSCP and Explorer has an interesting mechanism behind it (and a specific failure mode). Windows shell cannot talk to SFTP natively, so drag-and-drop triggers a download to %TEMP% first, then signals the shell to move it. Kill WinSCP while a clipboard copy is pending and the temp file orphans. I found 40GB of old database dumps in my %TEMP% folder in 2019 from exactly this. They had been there about two years. Run Disk Cleanup every so often.

Custom Commands. This is what I use daily and I suspect 90% of WinSCP users do not know it exists. You define shell commands that run on the remote server, bind them to keyboard shortcuts, and pass variables like !/ for the current remote path or !K for the host key. That is how the famous "two-way sync with delete" workflow works - it is a custom command script that papers over the stateless nature of WinSCP's built-in sync. With ten minutes of setup you can build a proper automation framework inside what looks like a file manager.

WinSCP Alternatives

I usually list the alternatives but I think there are only two you actually need (apologies to any other worthy alternative I missed - upfront). If you know one just let me know.

So, FileZilla is what everyone compares WinSCP against. FileZilla has genuine advantages - cross-platform, multi-threaded transfer queue, parallel downloads. On Linux and macOS it is basically the only serious option. But FileZilla stored passwords in plaintext XML for years. Literally plaintext. Open it in Notepad. That is not hyperbole, that is what they shipped. The security community screamed for ages before it got fixed properly.

WinSCP has had AES-encrypted Master Password for over a decade. FileZilla installers also bundle offers (adware), WinSCP installers never have. On Windows specifically I cannot justify using FileZilla.

To be honest, the FileZilla installers made me stop using it many years ago and I ALWAYS listed the portable - clean version when I was running FossHub. Not even once I considered listing the bundled version.

On Mac I recommend Cyberduck because the cloud integration is better - MFA-Delete on S3, Glacier archiving, AWS STS for temporary credentials - Cyberduck got there first and does it properly. WinSCP added S3 in version 5.13 but it is basic compared to Cyberduck.

Borland C++ Builder IDE. Well, as far as I know, Mr Martin Prikryl built the whole thing in it and has said publicly he regrets it. In 2000 it was sensible. In 2026 it is a millstone around his neck. New contributors cannot easily get a build environment going and Mr Martin Prikryl himself maintains several third-party libraries that got abandoned by their original authors. He keeps orphan code alive because his application still depends on it. We feel his pain as we had to do this for a few years before moving FossHub to a new infrastructure.

The automation story splits into two things depending on how old your scripts are. winscp.com is the console executable (separate binary, not the GUI with flags) and it runs a custom scripting language with synchronize and put and get and keepuptodate as commands. Exit codes are 0 or 1 so any CMD batch file from 2008 still works. XML logs via /xmllog get you per-file success and failure which is what you actually want for overnight backup scripts. I had a PowerShell job running this many years ago.

winscpnet.dll is the newer path. PowerShell, C#, whatever you want. It is a wrapper that manages a background winscp.exe process through a pipe rather than a standalone protocol implementation, which is a design choice I have opinions about but it works fine in practice. Targets .NET Framework 4.0 and .NET Standard 2.0 which means it runs under PowerShell Core on Linux too.

Note: the .NET assembly does not read stored sites from your WinSCP GUI. At all. This is called "configuration isolation" and it is deliberate - the point is your production script cannot accidentally depend on something a colleague changed in the GUI six months ago. You define SessionOptions in code, including SshHostKeyFingerprint, and that is your entire session definition. Skip the fingerprint and MITM protection goes with it. TransferOperationResult.Check() is the method that throws an exception if anything in a batch failed. The object you get back without calling Check() is a result object you have to iterate through manually, which nobody does, which is how silent backup failures happen.

Pageant is the PuTTY SSH agent. Holds your decrypted private key in memory after you unlock it once. WinSCP asks Pageant to sign auth requests so you never type a passphrase during the day. Agent Forwarding takes the concept further - SSH into Server A, then from A into Server B, with no key stored on A. Your local Pageant signs remotely. The obvious problem is that a malicious admin on Server A can hijack the forwarded socket and authenticate as you to anywhere else your key works.

This has happened in real-world compromises. I only enable agent forwarding for about three servers I would trust with my house keys.

Master Password uses AES with a key derived from whatever passphrase you set. Encrypts the stored site passwords in the registry or INI. No recovery if you forget the master password, which is correct - a recovery mechanism would be a backdoor - but I have seen experienced admins lose years of stored sessions this way. I keep the master password in KeePass which lives in its own encrypted database. Turtles all the way down.

Web development workflow: "Keep remote directory up to date" hooks the Windows ReadDirectoryChangesW API to watch your local filesystem and pushes changes to the server within milliseconds of you hitting save. Before Node watchers and hot reload frameworks this was how you did live web development, and it still works fine for old-school PHP projects where the entire build pipeline is "upload the file."

HPC workflow: the Connection & Tunnel settings let you chain SSH through a bastion host to reach a supercomputing cluster. Set "Maximal number of transfers at the same time" to 1 when using tunnels or the GUI opens separate tunnel instances for directory browsing and transfer and you get hit with authentication prompts every few seconds.

My actual setup: portable WinSCP on an encrypted USB stick alongside PuTTY and KeePass. About fifteen sessions stored. Master password set. "Optimize connection buffer size" unticked because one client runs a Nutanix cluster and I got burned by it in 2022. XML logs parsed by a PowerShell script after every overnight backup.

Agent Forwarding enabled only for two specific servers where I would trust the admin with my actual physical house keys. Sessions in the INI file for three different SSH keys depending on which client I am connecting to.

Finally

WinSCP has been in my toolkit for almost two decades. It will be there when I retire.

Many thanks to Martin Prikryl. Twenty-six years of holding this together in Prague (while I am writing this), keeping dead libraries alive so the thing still compiles, fighting off malvertising campaigns that abuse his brand, and shipping releases steadily through all of it. Donations through winscp.net - the official website.

No release notes available