How to log in to SFTP with a private key

In FTP by Zaweba you log in to SFTP with a private key from Site Manager. Set the site's protocol to SFTP, select your private key file, and type the key's passphrase if the key has one. Save the site, press Connect on the toolbar, and the app signs in with the key rather than a password.

That is the whole job in one paragraph. The rest of this page walks through it slowly, explains what the app keeps and where, and covers the few things that trip people up the first time.

Before you start

You need three things from your hosting company or server admin. The first is the host name and port for SFTP, which is often different from the plain FTP details on the same account. The second is your user name. The third is a private key file that matches a public key already placed on the server. Hosts handle that last part in different ways: some let you generate a key pair in their control panel and download the private half, others ask you to upload a public key you made yourself. Either way, the private key file has to be on your PC before you begin, and the server has to know the public key that goes with it.

If the key was made with a passphrase, have that to hand as well. A passphrase is a second lock on the key file itself, so a copied key is useless without it.

Setting up the site

Open Site Manager from the File or Site menu (Manage Sites). Add a new site or pick an existing one. Give it a name you will recognise, then fill in the host, the port and your user name. Set the protocol to SFTP. Only SFTP sites can use a key; plain FTP and explicit FTPS sign in with a password.

Now choose the private key file, and if the key has a passphrase, type it in the passphrase box. Fill in the remote folder (for example /public_html) and the local folder where your copy of the site lives, so the two panes line up once you are connected.

Save the site. Site Manager flags unsaved changes, so you can see at a glance whether anything is still waiting to be kept.

The first connection

Press Connect on the toolbar. The first time you reach a new SFTP server, the app asks you to confirm the server's key. That is the server proving who it is, which is a separate thing from your own key proving who you are. Once you accept it, FTP by Zaweba remembers it as the trusted server key for that site and stops asking.

If that key ever changes and you know why (the host moved you to a new server, say), use Forget next to the trusted server key in Site Manager. You will then be asked to confirm the new key on the next connection. If it changes and you don't know why, stop and ask your host before going further.

Where the passphrase is kept

Key passphrases are stored in the same way as passwords: protected with Windows DPAPI, so they only open for your own Windows account on that PC. Someone who copies the app's settings to another machine gets nothing they can read. If you would rather not keep it at all, use Forget saved in Site Manager and save the site.

When you move to a new PC, Site > Export Site Settings can carry the site across. Passwords and private key files are only included if you tick that option and set an export password, and they are then encrypted with AES-256-GCM. Without that tick, the new PC gets the settings but you choose the key file again.

When the login fails

Most key problems come down to a handful of causes. The public key may not be installed on the server yet, or it may be installed for a different user name. The port may be the FTP port rather than the SFTP one. The passphrase may be mistyped, which is easy to do in a masked box. And some hosts only allow SFTP on certain plans, so a key that is correct still can't get in.

Check those in that order, reading the log in the bottom panel as you go. It shows what happened on each attempt, and you can copy it to the clipboard if you need to send it to your host.

Once you're in, the site behaves exactly like any other in the app. The local and server panes sit side by side, Get Newer and Sync show their lists before anything moves, and the editor and Live Preview work on the files just as they would over FTP.