The installer takes a few minutes. The moment that matters comes later, when WinSCP shows an unfamiliar SSH fingerprint and asks whether you trust it. I know the temptation: click Yes, get the file moved, go home. But that prompt is the security boundary, not an inconvenience.
Let’s install WinSCP from its real source, make an SFTP connection, and handle that first trust decision without guesswork. You will also leave knowing where sessions, logs, updates, and portable configuration can hide—details that become surprisingly important on a shared or managed PC.
Before downloading, decide whether this PC should remember you
Use the installer on your own or an organization-managed PC when you want Start-menu integration, optional shell integration, and normal uninstall support.
Use the portable executable when installation is prohibited or you need a self-contained copy. Portable does not mean no trace: WinSCP can still store configuration in the Windows registry unless you deliberately select INI-file storage.
Avoid portable copies on borrowed PCs for sensitive work. Saved sessions, cached host keys, logs, temporary files, and the private key you brought with you all need an explicit cleanup plan.
Current WinSCP requirements list Windows 7 through Windows 11 and Windows Server 2008 R2 through 2025. Support claims can change, so consult the linked requirements page when working on an older system.
Download from the author, then read Windows’ identity check
Start at the official WinSCP download page. Choose the installation package for a normal setup or the portable executable when that choice is intentional. Do not use an attachment, download portal, or advertisement that happens to carry the same filename.
Before allowing elevation, Windows User Account Control should identify the verified publisher as Martin Prikryl. Cancel if the publisher is missing or different.
For stronger provenance checking, use the current fingerprint or checksum published by WinSCP for that exact release. Do not compare against a hash copied from an old tutorial; installers and hashes change every release.
Keep SmartScreen and antivirus checks enabled. Bypassing a warning because the filename says “WinSCP” defeats the point of obtaining a signed installer.
The setup choices are less dramatic than they look
Choose installation for all users only when the PC is shared, policy allows it, and you have administrator rights. A per-user installation is enough for many personal systems.
Typical installation is appropriate unless you know which shell extensions or extra components you need.
Commander presents local and remote panels side by side; Explorer resembles Windows File Explorer. This is a workflow preference, not a protocol or security setting, and it can be changed later.
Review the final component list before selecting Install. Optional integration changes Windows behavior beyond simply placing an executable on disk.
SFTP is usually the right first word—not FTP
SFTP transfers files inside an SSH connection, normally on TCP port 22. It is the usual choice for Linux servers, cloud virtual machines, and managed hosting with SSH access.
FTP sends credentials and data without transport encryption unless another protection layer is added. Do not select it merely because the names look similar.
FTPS is FTP protected with TLS. It is not SFTP, and its explicit/implicit TLS mode plus separate data connections must match the server and firewall configuration.
SCP also uses SSH, but WinSCP recommends SFTP when the server supports it because SFTP offers richer file-management semantics. Use SCP only for a specific compatibility reason.
Build the first session without saving a secret prematurely
Open WinSCP and choose SFTP as the file protocol.
Enter the server’s DNS hostname rather than a short-lived IP address when the administrator provides one. Leave port 22 only if the service really uses the SSH default.
Enter the assigned username. Leave the password empty until login when you do not want it stored with the session.
For public-key authentication, open Advanced Site Settings → SSH → Authentication and select the private key file your server account expects. Protect that file with a passphrase.
Save the site only on a trusted PC. A saved session is convenient, but saving a password changes the impact of another person gaining access to your Windows profile.
WinSCP can use PuTTY-format .ppk keys and can convert supported OpenSSH private-key formats when you select them. Conversion does not register the public key on the server; the matching public key must already be authorized for your account.
Stop at the fingerprint—the server is introducing itself
On the first SSH connection, WinSCP presents the server host-key fingerprint. Obtain the expected fingerprint through a channel independent of this connection: the cloud console, a known administrator, an existing trusted SSH session, or the hosting provider’s authenticated control panel.
Compare the algorithm and the complete fingerprint, not just the beginning or ending characters.
Accept and cache the key only when it matches. WinSCP will use the cached value to detect a different key on later connections.
If no one can provide the expected value, cancel. Encryption without authenticated identity can still connect you securely to the wrong machine.
When a previously trusted key changes, do not reflexively replace it. Server rebuilds and key rotations are legitimate explanations, but interception and DNS mistakes are also possible. Verify the new fingerprint independently first.
Make one reversible transfer before trusting the routine
Open the intended local folder and remote directory. Confirm the remote path and account before dragging anything.
Upload a small non-sensitive test file, then download or inspect it from the server side. This checks permissions and destination assumptions without risking important data.
Use binary transfer mode for archives, images, executables, databases, and almost everything that must remain byte-for-byte identical. Automatic/text mode can translate line endings for selected text files and should be intentional.
Treat overwrite, synchronization, move, and delete confirmations seriously. A synchronized folder can propagate an accidental deletion farther than a simple copy.
For a critical artifact, compare a cryptographic hash calculated independently at both ends; a successful progress bar is not an end-to-end content proof.
When the connection refuses to cooperate, keep the layers separate
Connection timed out: verify DNS, VPN, firewall, server availability, and the port. Authentication has not started yet.
Connection refused: the host answered but nothing accepted this connection on that port, or a firewall actively rejected it. Confirm the SSH/SFTP service and port server-side.
Authentication failed: recheck username, password, key selection, passphrase, and server-side authorized-key permissions. A valid private key for another account is still the wrong credential.
Host key does not match: stop transferring. Confirm whether the endpoint, DNS record, load balancer, or server key intentionally changed, then verify the new fingerprint out-of-band.
Permission denied after login: SSH authentication succeeded; the account lacks filesystem access to that path. Do not try random credentials or elevated paths—ask which directory the account owns.
Transfers stall or disconnect: inspect network/VPN stability, server quotas, idle-timeout policy, and intermediate inspection devices before repeatedly reinstalling WinSCP.
Logs help most after you remove what should not travel
Enable session logging temporarily when reproducing a connection or protocol failure, and choose the lowest useful verbosity first.
Inspect a log before sharing it. Hostnames, usernames, local paths, remote paths, filenames, IP addresses, command arguments, and session details may be sensitive even when passwords are masked.
Never publish a private key, passphrase, password, or unredacted configuration file. Redact locally; do not upload secrets to an online redaction service.
Disable or rotate verbose logs after diagnosis so a workstation does not accumulate a long operational history.
Updates and removal have a memory of their own
Use WinSCP’s update check or return to its official download page. Verify the publisher on the new installer just as you did the first time.
An installed copy can be removed through Windows Settings → Apps → Installed apps. Uninstalling the executable does not necessarily erase saved sessions, cached host keys, INI files, logs, or private keys stored elsewhere.
Before removing configuration, decide whether cached host keys are evidence you need for future verification and whether saved sessions must be migrated securely.
For portable use, inspect where configuration was stored. Removing the executable alone may leave registry-backed settings; INI mode may leave them beside the program.
On a shared or departing employee’s PC, follow the organization’s key-revocation and credential-rotation process rather than assuming local cleanup invalidates server access.
Comments and corrections