Network ports · 21
21 — FTP control
Port 21 carries FTP commands and responses, including credentials in plain FTP.
Key facts
| Port | 21 |
|---|---|
| Transport | TCP |
| Service | FTP control |
| Encryption | None unless FTPS |
| Credentials | Sent in clear text in plain FTP |
| Range | Well-known (0–1023) |
Commands travel in clear text
The client sends commands such as USER, PASS, LIST and RETR over port 21, and the server replies with three-digit status codes. In plain FTP both the username and password are readable by anyone on the path, which makes FTP unsuitable for the public internet.
The control channel stays open for the whole session. A firewall must keep state for it, and an idle timeout can close a session in the middle of a large transfer.
FTPS is FTP plus TLS
Explicit FTPS starts in clear text on port 21 and upgrades with AUTH TLS. Implicit FTPS uses a separate port, usually 990, and begins with TLS immediately. Both protect the control channel and, when configured, the data channel.
FTPS is not the same as SFTP. SFTP runs over SSH, usually on port 22, and has a different command set. Clients and firewall rules are not interchangeable.
Frequently asked questions
Is FTP secure if the password is strong?
No. The password and the files are still transmitted in clear text and can be captured.
What port does implicit FTPS use?
Usually 990. Explicit FTPS uses the normal control port 21 and upgrades in-band.