What Is the FTP Port Number? Default Ports Explained 🔌

FTP uses TCP port 21 for its control connection. That's the default, and it's the answer most people are looking for. Data transfer is where it gets messier: in active mode the server pushes data from port 20, while in passive mode it hands the client a high-numbered port instead. So no — FTP doesn't "always use port 20." That's the single most repeated half-truth about this protocol.

Whenever you use the file transfer protocol, you must know what elements are involved and how they work for better understanding. One of the most critical elements is the FTP port. A correct port is important, as successful file transfer depends on the open port. Ports establish the connection and initiate the transfer between the client and the server. This guide covers everything you need to know about FTP ports, modes, and configuration.

📋 FTP Port Numbers at a Glance

• Port 21 (TCP) — control/command channel. Logins, directory changes, transfer commands.
• Port 20 (TCP) — data channel in active mode only, initiated by the server.
• High ports (e.g. 49152–65534) — data channel in passive mode, chosen by the server from a configured range.
• Port 990 — implicit FTPS.
• Port 22 — SFTP (which is SSH, not FTP).

📌 What Is an FTP Port? [Definition]

FTP stands for file transfer protocol, allowing users to exchange information between devices over the network. You require FTP software tools to establish the connection and initiate the transfer. Its transfers are done using a specific port only. Default FTP port connection uses port number 21. Also, you can change this default setting and choose your choice of FTP port. But to make this change, you need administrator access.

A port is just a numbered doorway on an IP address. Your server has one IP but thousands of possible ports, and each listening service claims one so the operating system knows which process gets which packet. Port 21 is FTP's assigned doorway, the same way 80 belongs to HTTP. Here's what makes FTP unusual: most protocols open one TCP socket and do everything through it. FTP opens two: a command channel and a separate data channel. That design dates back to RFC 959, written in 1985 — long before NAT routers and stateful firewalls existed. Nearly every FTP headache you'll ever debug traces back to that second connection.

When you start communicating using FTP, you will require two different ports:

• When the user provides their credentials in the FTP client, it will establish an FTP connection and open the FTP control port of the FTP server (by default, this port is 21).
• A second connection is made to the server by the client, which is a response of the FTP server toward the FTP client. This is where the actual transfer of data occurs.

It is helpful for the devices to connect to remote devices. Ports are required so there is no conflict with other transfers within the network, eliminating the condition of network congestion. FTP protocol can handle bulk data transfer with great ease. This protocol works using the TCP channel. If you want the wider background first, read up on how FTP works before you start touching firewall rules.

🔗 Control Channel vs Data Channel

The Control Channel on Port 21

This is the connection your FTP client makes first. Username, password, LIST, RETR, STOR, PWD — all commands and server response codes travel here. It stays open for the whole session and carries zero file content. This connection uses the FTP port number 21. You can only transfer a single line of command at a time. Both the control processes of the client and server use the NVT syntax. The control processes use the Protocol interpreter that translates the local code into NVT syntax and vice versa.

The Data Channel

Every actual file transfer and every directory listing opens a brand-new TCP connection. Which port that connection uses depends entirely on the mode. Unlike the control connection, the data connection opens and closes after each transmission. The data transfer is done based on the control of the sent commands. While transferring the file, you need to specify the type of file you are sending.

While file transfer, one of the below-mentioned things can happen:

• Copying files from the server to the client is known as retrieving the file. For this, the RETR command is used.
• Copying the file from the client to the server is known as storing the file. It uses the STOR command.
• Sending a list of file names from server to client. It uses the LIST command.

Why "FTP Uses Port 20" Is Only Partly True

Port 20 is the traditional source port for server-initiated data connections in active mode. Modern deployments mostly run passive mode, where port 20 never gets touched at all. If you open 20 and 21 on your firewall and call it done, passive clients will log in fine and then hang on the first directory listing.

📦 Features of FTP

FTP is an application layer protocol enabling quick data transfer. It comes with the following features.

Data Representation

It supports data representations — ASCII (7-bit), EBCDIC (8-bit), and 8-binary data. By default, it uses ASCII files for file transfer. For transferring the binary files, the default format is the image file. This file will be sent as a continuous byte of bits without encoding.

File Organization and Data Structures

You can transfer both structured and unstructured files using FTP. An unstructured file is a string of bytes and is end-marked by EOF (End of file). A structured file contains a list of records delimited by EDR (End of Record). Another structured file contains pages having a page number and a page header.

Transmission Modes

FTP uses three different transmission modes to transfer the files:

• Stream mode: By default, FTP uses stream mode as data is transmitted as a stream of bytes. TCP breaks down the data into segments.
• Block mode: It delivers the data into blocks from FTP to TCP, with each block having a 3-byte header.
• Compressed mode: If the files are big, you can transfer them after compressing them using run-length encoding.

Error Control

As FTP uses TCP to transfer the files, there is no additional error recovery mechanism requirement.

Access Control

FTP ensures access control by placing a proper login mechanism via username and password.

🔄 Active vs Passive FTP Mode

Passive wins in almost every real scenario today, because clients sit behind routers that drop unsolicited inbound connections. For the deeper trade-offs, see the breakdown of active vs passive FTP.

How to Establish FTP Active Mode

It starts with establishing a control connection. For this, a temporary port will be created on the client ranging from 1024 to 65535 for both control and data connection. The client will send the request to the server to start the connection. In active mode, the following steps will take place:

1. First, the client will send the request to the server with port 21.
2. The server will respond to the newly created temporary client port.
3. After that, the client confirms the incoming connection.
4. The client will send the FTP PORT command specifying the details, such as which mode (active in this case), IP address, and port number.
5. The server will confirm the incoming command.
6. The client will tell the server to perform the specific task.
7. Then, the server creates a data connection using port number 20.
8. The client will respond to the request from the server.
9. After confirming the connection, the server will allow the data from the client.

How to Establish FTP Passive Mode

This process is entirely different from the active mode operation. Below are the steps that are followed using passive mode:

1. The client sends a request to the server using port number 21 from its temporary port ranging between 1024 – 65535.
2. The server will send a response to a temporary client port.
3. The client then confirms the incoming connection.
4. The client sends a PASV command specifying the usage of the passive FTP mode.
5. The server confirms it and sends its IP address and port number to start a data connection.
6. The client uses the data transfer port to send a request to establish a connection to the port issued by the server.
7. The server then confirms the incoming connection.
8. The client creates a connection.
9. The client tells the server when to transfer the data.

🔐 FTP vs FTPS vs SFTP Port Numbers

One correction worth hammering: SFTP is not "FTP with encryption." It's the SSH File Transfer Protocol — a completely different protocol running as a subsystem of SSH on port 22, with a single connection and no data-channel drama. That's why it just works through firewalls. More detail on SFTP port 22 if you're weighing the two. My recommendation? Use SFTP unless something forces your hand. Use FTPS if you're stuck with FTP-based tooling but need TLS. Use plain FTP only for anonymous public downloads.

⚠️ Is FTP on Port 21 Secure?

No. Credentials cross the wire in plaintext. So does file content. Anyone positioned on the network path — a compromised router, a shared Wi-Fi segment, a hostile ISP hop — can read your username and password with a packet capture and about ten seconds of effort. And moving FTP to port 2121 doesn't fix that. Changing the port reduces noise from automated scanners hammering 21. It does nothing for encryption. Please don't confuse obscurity with security.

👤 What Is Anonymous FTP?

To establish a connection via the FTP client, you must provide an authorized username and password to the remote server. Some sites have files that everyone can access, enabling anonymous FTP. The user does not have to provide the credentials to access such files. Else, the user can log in with an anonymous username and guest as a password.

What Are FTP Servers?

FTP servers are just similar to web servers. The FTP servers handle the distribution of files. Whenever the user clicks on a link to download something from the internet, the links redirect to FTP instead of HTTP. Some files are open to everyone on the FTP servers, while some are available for specific users with authorized access.

• Anonymous Server: In most cases, the FTP sites allow anonymous FTP, and you do not have to provide a password to access the files.
• Non-anonymous server: For a non-anonymous server, you have to log in using the correct password.

What Are FTP Clients?

It uses TCP for handling all communications and sharing data. FTP works on the client/server model, where one device is the client and the other acts as the server. You must use FTP client software on your system and establish a connection to the server device. To connect to the FTP server, you must provide a username and password for the FTP client software. This will open a command link between both devices, allowing you to send commands, messages, and other data.

🔧 How to Change the Default FTP Port

Sometimes it's justified: you're running multiple FTP instances, your ISP blocks 21, or you want less log spam. The workflow is the same regardless of platform:

1. Edit the server config — listen_port=2121 in /etc/vsftpd.conf, Port 2121 in proftpd.conf, or the binding in IIS Manager.
2. Restart the service (systemctl restart vsftpd).
3. Open the new port in the OS firewall and close the old one.
4. Update NAT/port forwarding on the router.
5. Tell your clients — they won't auto-discover it.

Setting up from scratch instead? There are walkthroughs for installing an FTP server on vps, configuring vsftpd on Ubuntu, and IIS FTP setup on Windows.

🛡 How to Open FTP Ports in a Firewall

For active mode: allow inbound TCP 21 on the server, and allow inbound connections from server port 20 on the client side. That second part is why active mode fails so often.

For passive mode, do three things — all of them:

• Define a passive range in the server config, e.g. pasv_min_port=40000 and pasv_max_port=40100.
• Allow TCP 21 and 40000–40100 inbound through the firewall.
• Advertise the public IP with pasv_address (vsftpd) or the External IP field in IIS FTP Firewall Support — otherwise the server hands out a private 10.x address the client can't reach.

Due to the dynamic nature of the FTP data port, you might face difficulties while configuring the firewall. In the case of the active mode, the actual problems occur at the client's end. If the firewall settings are to drop the connection that is not internally initiated, the server cannot establish the data connection. So, it is essential that you correctly specify the client ports and create an allowable rule for the firewall to work correctly.

But in the case of the passive mode, the problem lies on the server side. Also, you can specify the range in the passive FTP port range within the server settings and create a rule for it. You can follow the below steps to get this done.

Open the IIS Manager, click the Server name under Start Page, double-click FTP Firewall Support, and provide the range 1025-65535 to the Data Channel Port Range, as shown below.

Go to the FTP site → select FTP Firewall Support, and provide your external IP address. Make sure to make a Network Address Translation (NAT) of these port ranges while configuring the firewall.

🔍 How to Check If FTP Port 21 Is Open

telnet ftp.example.com 21
nc -vz ftp.example.com 21
Test-NetConnection ftp.example.com -Port 21

A working server answers with a 220 banner. On the server itself, confirm it's actually listening with ss -tlnp | grep :21. Then connect with FileZilla and read the message log — it names the exact port the server offered for passive data, which is usually where the problem hides.

⚠️ Common FTP Port Errors and Fixes

• Connection timed out — firewall silently dropping port 21, or missing NAT forwarding.
• Connection refused / ECONNREFUSED — nothing listening on that port. Service down or bound to the wrong interface.
• 425 Can't open data connection — the data channel failed. Passive range not open, or active mode blocked at the client.
• Login succeeds, listing hangs — the classic passive misconfiguration: wrong advertised IP or an unopened port range.

🎯 Conclusion

FTP ports are essential to establish a connection between the client and the server. Ensure that your FTP listens to the correct port, or else you might find it challenging to connect to the server. FTP establishes two connections, one for transferring the command and the other for transferring the actual data. The data connection uses the FTP port 20 in active mode. FTP default port number is 21 to specify the control connection. You can change the standard FTP port to ensure the security or avoid network congestion on ports 20 and 21.

Remember the shape of it: port 21 for commands, port 20 for active-mode data, high ports for passive-mode data, 990 for implicit FTPS, 22 for SFTP. Get that straight and most FTP troubleshooting becomes mechanical. FTP is a necessary protocol that smoothly transfers any data across the network. For a better experience and knowledge, we recommend you buy Linux VPS and practice changing the default FTP port.

📚 People Also Read

• How to Install FTP Server on Windows
• How to Connect to SFTP on CentOS without Shell Access
• Install and Configure FTP Server on Ubuntu
• Connect to SFTP on Ubuntu Without Shell Access
• What Is FTP?
• What Is the SFTP Port and Number?