SSH (Secure Shell) is a network protocol that lets you log in to another computer and run commands over an encrypted connection, by default on TCP port 22. If you are asking what is SSH because a hosting company or a teammate told you to "SSH into the server," this is the tool they mean. People use it to manage Linux servers, VPS plans, NAS boxes and Raspberry Pi boards, to push code to Git hosts, and to move files with SFTP, the file transfer part that runs inside the same SSH connection. To connect, you need the server's IP address or hostname, an account on that server, and an SSH client. Windows 10, Windows 11, macOS and Linux already include one.

How does the SSH protocol work?

The SSH protocol works as a client and a server. Your computer runs an SSH client (the ssh command), and the remote machine runs an SSH server (sshd, most often OpenSSH) that listens on port 22. Each session has three layers: the server proves its identity, you prove yours, then both sides open channels for a shell, file transfers or tunnels.

The secure shell protocol is defined in four IETF documents from January 2006. RFC 4251, by Tatu Ylonen and Chris Lonvick, describes the architecture. The other three map to the layers:

  1. Transport (RFC 4253). Client and server agree on algorithms, run a key exchange, and the server signs it with its host key. Your client checks here that it reached the right machine.
  2. User authentication (RFC 4252). You log in with a password or a public key.
  3. Connection (RFC 4254). One encrypted session carries separate channels: a shell, a single command, an SFTP session or a forwarded port.

Ylonen wrote the first version in spring 1995 at Helsinki University of Technology to replace Telnet, rlogin and FTP, which sent passwords in plain text. That design is now called SSH-1. It has known flaws, and current OpenSSH no longer supports it. Everything here refers to SSH-2.

What is SSH used for?

SSH is used for remote command-line administration and for moving data between machines you control. The common jobs:

  • Managing a Linux server or VPS: updates, logs, restarting a web server.
  • Running a NAS, a Raspberry Pi or a router with open firmware without plugging in a screen.
  • Git over SSH. GitHub and GitLab accept SSH keys, so you don't type a password on every push.
  • Copying files with SFTP or SCP, and running commands from scripts or CI deploy jobs.
  • SSH port forwarding (tunneling): reaching a service that only listens on the server itself, such as a database bound to 127.0.0.1.

SSH port forwarding carries one port through an existing SSH session. Port forwarding on a home router is a different thing: it opens a port on your public IP for outside traffic. SSH is also the wrong tool for web browsing or hiding your IP address.

What is SFTP? SSH vs SFTP vs SCP vs FTPS

What is SFTP? It is a file transfer protocol that runs inside an SSH connection, so it uses the same login, the same encryption and the same port (22 by default). If a host or a partner asks you to "send it over SFTP," your SSH account details are all you need.

The SFTP meaning gets muddled because two names are in use. The IETF draft that defines it, written by Tatu Ylonen and Sami Lehtinen in October 2001, is titled "SSH File Transfer Protocol". Many hosting guides say SFTP stands for "Secure File Transfer Protocol." The IETF work stopped at the Internet-Draft stage, so SFTP was never published as an RFC.

SFTP is not plain FTP sent through SSH, and it is different from FTPS, which is FTP wrapped in TLS. The table compares the five names you will see on hosting dashboards.

Protocol What it does Encryption Default port Typical client
SSH Remote shell, commands, tunnels Yes (SSH) 22 ssh, PuTTY
SFTP Upload, download, browse, rename, delete Yes (inside SSH) 22 sftp, FileZilla, WinSCP
SCP Copy files only Yes (SSH) 22 scp
FTP File transfer No 21 FTP clients
FTPS FTP over TLS Yes (TLS) 21, or 990 for implicit TLS FTP clients with TLS support

IANA registers port 990 as "ftp protocol, control, over TLS/SSL." SCP and SFTP have also merged under the hood. Since OpenSSH 9.0, released on April 8, 2022, the scp command uses the SFTP protocol by default instead of the legacy scp/rcp protocol. A minimal SFTP session from a terminal:

sftp [email protected]
put report.pdf

FileZilla and WinSCP are free graphical clients. Pick SFTP as the protocol, then enter the server address, your SSH username and port 22.

What port does SSH use?

SSH uses TCP port 22. On July 10, 1995, Tatu Ylonen emailed IANA asking for a port and said he was already using 22 in his beta test, and IANA assigned 22 to ssh. It sits between FTP on 21 and Telnet on 23, the two programs SSH was built to replace, according to the SSH port history from SSH Communications Security.

To move SSH to another port, edit the Port 22 line in /etc/ssh/sshd_config, allow the new port in the firewall, then restart the SSH service. The client adds -p: ssh -p 2222 [email protected]. A new port cuts log noise from bots that only knock on 22. It does nothing for a weak password.

The SSH protocol port is the same for SSH, SFTP and SCP, so one open port covers all three. For the basics, see what a port number is. To confirm sshd is running on the server, check which ports are listening. To see whether SSH answers from outside, test port 22 from the internet against your own public IP. Scan only addresses you own or may test.

How to connect with SSH on Windows, Mac and Linux

Open a terminal and type ssh, your username, the @ sign and the server address. The command is identical on Windows 10, Windows 11, macOS and Linux, because all of them ship the OpenSSH client:

ssh [email protected]
ssh [email protected]

On Windows, use PowerShell or Windows Terminal. Microsoft Learn lists Windows 10 build 1809 or Windows Server 2019 as the minimum, and Windows Server 2025 installs OpenSSH by default. If PowerShell says "ssh" is not recognized, open Start, type Optional features, choose to add a feature, then find and install OpenSSH Client. PuTTY, an older free client, still works but is optional. On macOS and Linux, open Terminal; nothing needs installing.

The first connection to a server shows a message like this:

The authenticity of host '203.0.113.10 (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

That fingerprint is the server's host key. Compare it with the one your VPS provider or admin gave you, then type yes. It is saved in ~/.ssh/known_hosts and checked on every later login. When you type the password, nothing appears on screen. That is normal.

For a machine at home, use its LAN address (for example 192.168.1.20) on the same Wi-Fi. From outside, you need your public IP and a rule to forward a port on your router to that machine; behind carrier-grade NAT, no router rule will help. Connect only to machines you own or have an account on.

SSH keys vs passwords

SSH keys are safer than passwords because there is nothing to guess. A key is a pair of files: a private key that never leaves your computer, and a public key you place on the server in ~/.ssh/authorized_keys. The server checks a signature made with your private key, so bots trying common passwords get nowhere.

  1. Create the pair: ssh-keygen -t ed25519, and set a passphrase when asked. It runs in PowerShell, macOS and Linux.
  2. Copy the public key. On macOS and Linux: ssh-copy-id [email protected]. Windows has no ssh-copy-id, so in PowerShell run type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys".
  3. Log in again with the key. Only after that works, turn off password login.

A key plus a passphrase is two factors: a file you have and a phrase you know. The OpenSSH manual page for ssh-keygen lists ed25519 as the default type. If a system needs RSA, current ssh-keygen defaults to 3072 bits; don't go below that. Never send the private key file (the one without .pub) to anyone, support staff included.

"Remote host identification has changed": what the warning means

SSH stops with "REMOTE HOST IDENTIFICATION HAS CHANGED!" and "Host key verification failed" when the server's host key no longer matches the one in your known_hosts file. The client cannot tell whether you reached the same machine as last time, so it refuses to log in.

Usually the cause is harmless: the server was reinstalled, your VPS provider gave the old IP to a new machine, or a LAN device took a 192.168.1.x address another box used to have. The dangerous cause is someone between you and the server presenting their own key, which is how a man-in-the-middle attack works.

  1. Check whether the server was rebuilt or the IP moved.
  2. Get the new fingerprint from the provider's dashboard or the admin and compare it with the warning.
  3. If they match, remove the old entry with ssh-keygen -R 203.0.113.10 and connect again.

If nobody can explain the change, stop, especially on hotel or cafe Wi-Fi. Never set StrictHostKeyChecking no on a network you don't trust.

How to secure an SSH server

To secure an SSH server, allow key login only, keep root out, limit who can connect and from where, and keep OpenSSH updated. Most items are directives in /etc/ssh/sshd_config. Test the file with sudo sshd -t before restarting, and keep your current session open until a new login works.

  • Turn off password logins once your key works: PasswordAuthentication no.
  • Stop direct root logins: PermitRootLogin no, or prohibit-password if a tool needs root with a key.
  • Allow only the accounts that need SSH: AllowUsers alice deploy.
  • Let only trusted IP addresses reach port 22 in the server or cloud firewall. For a home server, a VPN into your network with SSH over it is safer than an open SSH port.
  • Block addresses that fail to log in many times, for example with Fail2Ban, and read the auth log.
  • Install OpenSSH updates as your operating system ships them.

After a change, scan your own public IP again to confirm only the expected ports are open.

Frequently asked questions

Is SSH the same as SSL/TLS?

No. Both encrypt traffic with public keys, but they are separate protocols. SSH gives you a remote login and command line, usually on port 22. TLS protects HTTPS websites, email and app connections, usually on port 443. Our page on SSL/TLS protocols covers TLS versions and the handshake.

Is SSH a VPN?

No. An SSH tunnel carries one port, or a few chosen ports, for specific apps through an SSH session. A VPN carries all traffic from your device and gives you an address on the remote network. An SSH tunnel suits one admin task, such as reaching a database. A VPN suits a whole device.

Is SSH secure?

SSH-2 is secure with current software and key-based login. Real break-ins usually come from weak or reused passwords, private keys left unprotected on a laptop or shared drive, or servers nobody has updated in years. The encryption itself is rarely the weak point.

Does SSH use TCP or UDP?

SSH uses TCP. RFC 4253 runs the transport layer over TCP/IP because the protocol needs packets to arrive in order, and IANA lists ssh as 22/tcp. A firewall rule for SSH needs only TCP port 22, or the port you moved it to.

What is the difference between SSH and Telnet?

Telnet sends your username, password and every command as readable text on port 23, so anyone on the path can capture them. SSH encrypts the whole session on port 22 and checks the server's identity with a host key. Admins still use Telnet for one thing: testing whether a TCP port answers.