Open-source SFTP server in 2026: SFTPGo

The short version

• SFTPGo is the modern open-source SFTP server: one Go binary that speaks SFTP, SCP, FTP, FTPS, WebDAV, and HTTPS at once, with a web admin, a web file client, and a full REST API.
• It is genuinely free under AGPL-3.0, actively maintained since 2019 by a member of the Go team, and sits at 12.7k GitHub stars with sponsors like WP Engine and Jump Trading.
• It stores files on local disk or directly in S3-compatible, Azure Blob, and Google Cloud Storage buckets, manages users in a database instead of config files, and runs comfortably on 1 vCPU and 512 MB of RAM.
• If you want it running without becoming a sysadmin, managed SFTPGo hosting deploys it in 21 regions for a 7-day trial without a card.

What an open-source SFTP server is

An SFTP server is the piece of software a partner, a customer, or an automation logs into when it needs to move files reliably over SSH. SFTP has been the boring, trusted standard for this for two decades: it encrypts everything, it works through firewalls, and every operating system and ERP on earth ships a client for it.

An open-source SFTP server is simply one whose source code is public and whose license lets you run it, inspect it, and modify it without paying anyone. The traditional options are OpenSSH, which includes a basic SFTP subsystem, and the FTP-era daemons vsftpd and ProFTPD. They are solid software, but they were designed in a world without object storage, web interfaces, or API-driven infrastructure, and it shows in daily operation.

SFTPGo is the newest significant entry in the category and, in 2026, the one with the most momentum. The rest of this page is a complete, honest tour of what it does, how it compares, and who it fits.

Who is behind SFTPGo

SFTPGo has been developed since 2019 by Nicola Murino, an Italian engineer who is a member of the Go team and the maintainer of the golang.org/x/crypto/ssh package, the SSH library that most of the Go ecosystem builds on. That detail matters more than it might appear: the person writing the server is also the person maintaining the cryptographic foundation beneath it.

The project lives on GitHub at drakkan/sftpgo, holds 12.7k stars and 982 forks as of late October 2026, and lists sponsors including WP Engine, Jump Trading, Aledade, and IP Paris. The current community release line is 2.7, with 2.7.6 shipping in September 2026. Release cadence is steady, security fixes land promptly, and the issue tracker is actively worked. This is not an abandoned GitHub experiment; it is infrastructure software with a professional behind it.

What it does: the feature tour

One process serves five transfer protocols. SFTP and SCP over SSH for automation and partners. FTP and explicit FTPS for the legacy ERPs that still require them. WebDAV and HTTPS for the tools that speak web instead of shell. You enable what you need and turn the rest off, per instance.

Files can live almost anywhere. Local disk, encrypted local disk, any S3-compatible endpoint (AWS S3, Backblaze B2, Wasabi, Cloudflare R2, or your own MinIO), Azure Blob Storage, Google Cloud Storage, and even another SFTP server used as storage. Backends can be mixed per user and per folder, which is a capability the classic daemons simply do not have.

Users live in a database, not in a config file. SQLite is built in, and PostgreSQL or MySQL serve as data providers for heavier deployments. That single design decision is what unlocks everything else: per-user quotas enforced at upload time, bandwidth throttles, expiration dates, per-user protocol restrictions, and virtual folders that map any directory or bucket into any user's view with read-only or read-write permission.

Two web interfaces ship in the box. The WebAdmin is where admins manage users, folders, event rules, and settings; the WebClient is a browser file manager for end users, including secure share links with passwords, expiry dates, and download limits. Both are behind the same authentication, with optional two-factor authentication and single sign-on.

Everything the UI can do, the REST API can too, which makes SFTPGo pleasant to automate: provision a partner account from your own provisioning script, rotate credentials on a schedule, or export the user list for audit. Event rules react to uploads and downloads with webhooks, filesystem actions, and scheduled jobs, so an arriving file can trigger the next step in your pipeline.

SFTPGo versus the classic SFTP servers

The honest way to see what SFTPGo changes is to line it up against what came before it:

None of the classic tools is bad. OpenSSH is everywhere and trustworthy; vsftpd and ProFTPD have moved files for decades. The difference is fit for the modern workload: partners who expect a browser option, data that belongs in buckets, and platforms that want to drive user management from an API rather than a vim session.

Security posture

SFTPGo is designed to face the internet. The built-in defender counts failed logins and abusive connections per client address and blocks offenders automatically across every protocol at once. Rate limiting, per-IP and per-account, is built in. Two-factor authentication covers the web interfaces, SSH public keys cover protocol logins, and OpenID Connect single sign-on is supported natively, with LDAP and GeoIP filtering available through the official plugins.

Passwords are never stored in plaintext: credentials are kept as salted hashes. Transfers are encrypted by the protocol itself (SSH or TLS), and the encrypted-local storage backend adds at-rest encryption when files live on the instance disk. Behind a reverse proxy, the proxy's client address is honored so bans land on real attackers, not on your proxy.

Resource needs and deployment

SFTPGo is a single static Go binary with no runtime dependencies, plus official Docker images for every common architecture. The documentation's own sizing guidance is comfortable operation on 1 vCPU and 512 MB of RAM for 50 to 300 active users, with a gigabit link saturable on adequate hardware. It runs on Linux, in containers, on a Raspberry Pi for labs, and on any cloud VM; PostgreSQL or MySQL as the data provider is the choice for production, as the built-in SQLite can lock under heavy concurrent access, a known limitation the project documents.

Deployment options in practice: the Docker image on any VM, a distribution package, the raw binary behind systemd, or letting somebody else run it. If you choose the last one, managed SFTPGo hosting on DANIAN runs the current community release on PostgreSQL in your choice of 21 datacenter regions, with backups, updates, monitoring, and human support included at a flat monthly price. The full cost comparison across every way of running it is a separate piece worth reading before you decide.

The community and Enterprise editions

The free community edition carries the complete protocol set, every storage backend, both web interfaces, the REST API, event rules, the defender, quotas, virtual folders, SSO, and the plugin system. It is maintained with fixes and updates to core features, and it is what most deployments run.

The same developers sell an Enterprise edition that adds capabilities aimed at larger operations: an in-memory cloud streaming engine the vendor reports is up to 70 percent faster, advanced automation with conditions and loops, IMAP email ingestion, automated PGP encryption, antivirus and DLP scanning through ICAP, and browser document editing. Major new features ship in the Enterprise edition first. If your requirements map to that list, the commercial product from the authors is the right buy, and our cost piece prices both lanes honestly.

The AGPL license in plain words

SFTPGo is licensed under AGPL-3.0, with additional terms covering a few embedded admin-interface assets. What that means for a business, without the lawyer voice:

• Running unmodified SFTPGo, for yourself or for customers, triggers no source-sharing obligation. Use it freely.
• If you modify the source and offer that modified version as a network service, AGPL requires you to offer your modifications' source to those users. This is the clause that makes AGPL stricter than the GPL.
• Embedding the server inside a product you distribute has further implications; that is the one case where asking a lawyer is genuinely worth it.

The overwhelming majority of companies run SFTPGo unmodified, provision users through its API, and never touch these obligations.

Who SFTPGo fits

It fits a team exchanging files with partners, customers, or machines that needs proper accounts, a browser option, and modern storage, without buying a per-gigabyte SaaS. It fits platform engineers who want an SFTP endpoint their automation can drive end to end. It fits the migration away from fragile FTP scripts toward something with an audit trail. It does not fit someone who needs AS2 or a full managed-file-transfer suite with partner choreography; those are different product categories.

For one-off browser sends rather than standing exchange, our piece on open-source WeTransfer alternatives covers the lighter tools. For hands-on operational answers, the SFTPGo knowledge base holds step-by-step guides for users, folders, storage backends, FTPS, and migration, written against the same edition DANIAN runs.

Frequently asked questions

What is an open-source SFTP server?
Server software that speaks the SFTP file transfer protocol over SSH, with source code published under a license that allows free use, inspection, and modification. Instead of buying a commercial product, you run the software yourself or have a provider run it for you. SFTPGo is the leading modern example.

Is SFTPGo really free and open source?
Yes. The community edition is licensed under AGPL-3.0 and costs nothing to download, run, or put into production. There are no user limits, protocol limits, or crippled features in the free edition; the authors' paid products are a separate Enterprise edition and a hosted service, the free edition is not feature-locked.

Who is behind SFTPGo's development?
Nicola Murino, trading as Software Engineering S.r.l. in Italy. He is a member of the Go team and maintains the golang.org/x/crypto/ssh package that SFTPGo is built on. The project has been developed since 2019 and lists sponsors including WP Engine and Jump Trading.

Which file transfer protocols does SFTPGo support?
SFTP and SCP over SSH, FTP and explicit FTPS, WebDAV, and HTTPS including the web client. All protocols can be served by one process, and each can be enabled or disabled per instance so you expose only what your partners use.

Which cloud storage services work as SFTPGo backends?
Yes, in the free community edition. Any S3-compatible endpoint (AWS, Backblaze B2, Wasabi, Cloudflare R2, MinIO), Azure Blob Storage, and Google Cloud Storage are first-class storage backends, mixable per user and per virtual folder alongside local and encrypted local storage.

Does SFTPGo have a web interface?
Two. The WebAdmin manages users, folders, rules, and settings. The WebClient is a browser file manager for users, with uploads, downloads, and secure share links that can carry a password, an expiry date, and a download limit.

Does SFTPGo work with LDAP, Active Directory, or single sign-on?
Yes. OpenID Connect single sign-on is built in for the web interfaces, and LDAP plus Active Directory integration and GeoIP filtering come through the official plugin system. Authentication can combine passwords, SSH keys, and two-factor codes.

How is SFTPGo different from OpenSSH's built-in SFTP?
OpenSSH gives you SFTP as the shell's file subsystem: OS user accounts, per-user permissions assembled from match blocks and chroot configuration, no web interface, no API, and local disk only. SFTPGo keeps the protocol and replaces the operational model: database-managed users with quotas and expiry, virtual folders, cloud storage backends, web UIs, and a REST API.

Why choose SFTPGo over vsftpd or ProFTPD?
The classic daemons are FTP-first tools from an era before object storage. If you need SFTP with cloud backends, a browser client, database-backed users, per-user quotas, or an API to drive provisioning, they require substantial add-on engineering that SFTPGo includes out of the box. If you serve plain FTP from local disk and nothing else, they remain perfectly good at it.

What hardware does SFTPGo need?
Little. The documentation's sizing guidance is 1 vCPU and 512 MB of RAM for 50 to 300 active users, and a gigabit link is saturable on adequate hardware. It is a single static binary with no runtime dependencies, so the smallest cloud VM or a home lab box is enough to start.

Does SFTPGo run on Docker?
Yes. Official images are published for every common architecture, with Docker Compose and Kubernetes guidance in the documentation. It also runs as a bare binary under systemd or as a distribution package, on Linux servers, NAS devices, and Raspberry Pi for testing.

Is SFTPGo safe to expose to the internet?
It is designed for exactly that. The built-in defender automatically blocks addresses that hammer it with failed logins across all protocols, rate limiting is built in, web logins support two-factor and single sign-on, and passwords are stored only as salted hashes, never in plaintext. As with any public endpoint, keep it updated and put TLS and a firewall in front.

What license is SFTPGo under, and can my business use it?
AGPL-3.0 with additional terms for a few embedded admin-interface assets. Running the unmodified server, including for paying customers, carries no source-sharing obligation. The obligation applies if you modify the source and offer the modified version as a network service. Most businesses run it unmodified and are unaffected.

Which SFTPGo features require the Enterprise edition?
An in-memory cloud streaming engine the vendor reports is up to 70 percent faster, advanced automation with conditions and loops, IMAP email ingestion, automated PGP encryption, antivirus and DLP scanning through ICAP, and browser document editing via Collabora. Protocols, storage backends, web UIs, the API, SSO, quotas, and the defender are all in the free edition.

Can SFTPGo replace a managed file transfer product?
For SFTP-centric exchange, yes: accounts, quotas, audit events, cloud storage, sharing links, and automation hooks cover what most small and mid-size MFT deployments actually use. It does not speak AS2 or provide partner-relationship choreography; if your compliance regime requires those, you need a different product class.

How do I get support for the SFTPGo software?
The project's GitHub repository is the community channel: issues, discussions, and documentation at docs.sftpgo.com. For production deployments where an engineer answers, the authors sell the Enterprise edition, or a managed hosting provider such as DANIAN includes support with the running of it.

Where do I start with running SFTPGo without operating a server?
Managed hosting exists for exactly that. DANIAN runs the current community release on PostgreSQL in your choice of 21 datacenter regions, with daily backups, automatic updates, monitoring, and support included. A 7-day trial needs no credit card, and you can export everything and leave at any time.

Sources

1. Project, license, sponsors, and feature set: github.com/drakkan/sftpgo (viewed October 2026)
2. Community versus Enterprise capability split: github.com/drakkan/sftpgo README (viewed October 2026)
3. Resource sizing guidance and data providers: docs.sftpgo.com (viewed October 2026)
4. Edition policy and release line: project README, community release 2.7.6, September 2026
5. Managed hosting details: danian.co/sftpgo

Try managed SFTPGo hosting for 7 days