What it's for
Port 21 is the control port for FTP (File Transfer Protocol) — one of the oldest protocols still in active use, predating even TCP/IP as we know it today. When an FTP client connects, it opens port 21 to send commands (login, list directory, request a file) while actual file data flows over a separate connection, historically port 20.
FTP is still common in web hosting (many shared hosting providers offer FTP/SFTP as the way to upload site files), legacy enterprise file exchange, and some embedded/industrial systems where the tooling predates modern alternatives.
Protocol basics
- Protocol: TCP, since reliable ordered delivery matters for both commands and file integrity.
- Two-connection model. Port 21 handles the control channel only (commands and responses); a second connection carries the actual file data — either port 20 (active mode) or a dynamically negotiated port (passive mode).
- Active vs. passive mode. In active mode, the server initiates the data connection back to the client, which frequently gets blocked by client-side firewalls/NAT. Passive mode flips this — the client initiates both connections — which is why passive mode is the default in almost all modern FTP clients.
- Plaintext by default. Standard FTP sends commands, including your username and password, unencrypted. This is the same fundamental issue Telnet had, and it's the reason FTP is being steadily replaced.
Security considerations
- Plain FTP should not be used for anything sensitive. Credentials and file contents are visible to anyone on the network path. If you need FTP-like functionality securely, use FTPS (FTP over TLS, often port 990) or SFTP (a completely different protocol that runs over SSH on port 22).
- Passive mode port ranges need firewall planning. Since passive mode negotiates a random high port for data transfer, server-side firewalls need a defined range opened up for this — a common source of "connects but transfers hang" issues.
- Anonymous FTP (login with
anonymousand any password) is sometimes intentionally exposed for public file distribution — make sure this is a deliberate choice, not an accidental misconfiguration, since it grants unauthenticated read access. - NAT traversal is a recurring pain point — because of the two-connection design, FTP is notoriously difficult to run cleanly through NAT and firewalls compared to single-connection protocols like SFTP.
Troubleshooting
Connects on port 21 but file listing/transfer hangs:
- Classic active/passive mode mismatch — try forcing passive mode in your client, and confirm the server's passive port range is open in the firewall
Connection refused:
- FTP server isn't running, or a firewall is blocking port 21 inbound
"530 Login incorrect":
- Credentials are wrong, or the FTP server requires TLS (FTPS) and your client is connecting in plain mode
Works over LAN, fails over the internet:
- Almost always a NAT/passive-mode configuration issue — the server needs to be configured to report its actual public IP for passive connections, not its internal one
Comparison / FAQ
| Port | Protocol | Key difference from 21 (FTP) |
|---|---|---|
| 22 (SSH/SFTP) | TCP | SFTP is a completely different protocol (runs over SSH), single connection, encrypted by default |
| 20 (FTP-data) | TCP | The paired data channel in active-mode FTP, not a standalone service |
| 990 (FTPS) | TCP | Same FTP commands, wrapped in implicit TLS encryption |
Is FTP the same thing as SFTP?
No — despite the similar name, SFTP (SSH File Transfer Protocol) is a completely different protocol that runs over SSH (port 22), not FTP. FTPS, confusingly, is the actual "FTP + TLS" variant, closer in lineage to the original FTP.
Why does my FTP transfer connect but then freeze?
This is almost always an active/passive mode mismatch combined with a firewall or NAT blocking the data connection. Switching your client to passive mode resolves it in the large majority of cases.
Should I still use FTP in 2026?
For anything beyond legacy compatibility requirements, SFTP or FTPS are strongly preferred — plain FTP sends credentials in cleartext, which is a real, exploitable risk on any network you don't fully control.
Why does FTP use two ports/connections instead of one?
It's a design decision from FTP's original 1971 specification, well before the security and NAT-traversal implications were a consideration. Modern protocols like SFTP deliberately use a single connection to avoid exactly the firewall complexity FTP introduces.