Secure SFTP/FTP Handoffs for Clients (Step-by-Step)

Passwords in inboxes = trouble

Server credentials shared by email or chat stick around forever. If one mailbox is compromised later, a “forgotten” message can reopen the door. Use per-user SFTP/FTPS with short-lived credentials and safer delivery.

Choose the right protocol

• SFTP (over SSH) — modern default; supports key-based auth.
• FTPS (FTP over TLS) — better than plain FTP; require TLS-only.
• Avoid plain FTP — credentials travel in cleartext.

Minimal, safe setup

1. Create a per-person account (no shared logins) with a restricted home directory.
2. Prefer SSH keys for SFTP. Share only the public key. How to build a strong key passphrase: How to Create Strong Passphrases You’ll Actually Remember.
3. Deliver secrets safely: use a one-time, expiring link for any passwords or one-off tokens and send the access code by a different channel. Basics: The Safe Way to Share Passwords in 2025 (No Email).
4. Verify the recipient on a quick call before first access. Link checks: Stop Phishing at the Source: Verify Links Like a Pro.

Operational hygiene

• Rotate passwords/keys on handoffs and departures. If anything might be exposed, follow: The Simple Incident Playbook for Leaked Passwords.
• Limit scope: chroot/jail users to project folders; no panel-wide access.
• Avoid long-lived folders for one-off deliveries. Safer approach: Share Sensitive Photos and Documents Safely.

Useful external references

• OpenSSH project 🔗
• Cloudflare: What is SFTP? 🔗

Bottom line

Per-user SFTP/FTPS + one-time delivery + verification. That’s a clean handoff without leaving keys in your inbox.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.