Simple SFTP Server

A clean, personal SFTP server for Windows: pick a folder, add a user (or hit Quick Start), and hand someone a ready-to-paste connection card. Each user is locked to their own folder, sign-in is by password or key, and you watch connections and transfers live. Secure connections only.

Built by JDE-Projects.

If you enjoyed this project and would like to buy me a coffee, check out my Ko-fi.

Preview

Dark and light themes

Highlights

• Quick Start: one click brings a full-access share live with a fresh random password in a copyable connection card.
• Users with a per-user folder (a real folder picker, or "Make folder"), and a jail so each user only ever sees inside their own folder.
• Three access modes per user: read-only, read & write, or upload-only (a drop box). Deleting and renaming is off unless you allow it.
• Sign-in by password, public key, or both, with a built-in Ed25519 (default) or RSA-4096 key generator for users who have none.
• Connection card: LAN address, on-demand public IP, port, and the host-key fingerprint, all copyable for first-connection verification.
• Live panel: connected clients, in-flight transfers, a recent-activity feed, and locked-out IPs with one-click Unlock.
• Brute-force lockout: five failed logins from an address are blocked for fifteen minutes, with a manual override.
• Default port 2222 (no admin needed), with a plain-language message if a port is already in use, plus a pre-flight port check.
• Built-in check for updates against GitHub Releases.
• Optional debug log, off by default, with credentials redacted.
• Secure transport only: weak or vulnerable algorithms are disabled, so the server runs securely or fails with a clear message (no unsafe fallback).

How it works

• Backend: paramiko over SSH/SFTP, one jailed session per connection.
• Config: server_config.json next to the app (usernames, folders, settings, and one-way bcrypt password hashes; never a plaintext password).
• Host identity: an Ed25519 host key generated on first run and kept next to the app, so its fingerprint stays stable for clients to trust.
• Window: pywebview on the Qt backend, UI in simple_sftp_server-UI.html.

Download and run

Two ways to get it from the Releases page - pick one:

• Installer (recommended): download SimpleSFTPServer-vX.Y.Z-setup.exe and run it. It installs the app, adds a Start menu shortcut, and can be removed later from Add or Remove Programs. Installs just for you by default (no admin needed); you can choose all users during setup.
• Portable .zip: download SimpleSFTPServer-vX.Y.Z.zip, extract it, and run Simple SFTP Server.exe from inside the extracted folder. No install - good for a locked-down PC or a USB stick. Keep the folder together; the exe needs the files next to it.

Either way: Windows only, no Python or setup required. Unsigned, so SmartScreen may warn the first time: More info > Run anyway. On first connection a client also needs your firewall to allow the port, and for access from outside your network, a port-forward to this machine.

Updating

Simple SFTP Server doesn't update itself. The bottom bar has a Check for updates button that tells you when a newer release is out; when it does, get the new version from the Releases page the same way you first installed it.

• Installer: download the new SimpleSFTPServer-vX.Y.Z-setup.exe and run it. It installs over your current copy and keeps your saved users, folders, and theme choice.
• Portable .zip: download and extract the new SimpleSFTPServer-vX.Y.Z.zip. To keep your saved users and settings, copy server_config.json from the old folder into the new one. Also copy host_ed25519, the server's host key, so its fingerprint stays the same for clients who already trust it; otherwise every client will see a fingerprint-changed warning on first reconnect. Copy simple_sftp_server.pref too, for your theme choice.

Saved-user passwords exist only as bcrypt hashes inside server_config.json, so there's nothing else to carry over.

Verify this download (optional)

This release was built on GitHub from this public source, not on a personal machine, and is signed with a build-provenance attestation. To confirm your download is genuine, install the GitHub CLI and run:

gh attestation verify SimpleSFTPServer-vX.Y.Z.zip \
  --repo JDE-Projects/Simple-SFTP-Server \
  --signer-repo JDE-Projects/Build-Tools

A Verification succeeded! line means the file was built by the published pipeline from this repo. You can also check the file against the published .sha256.

Build from source (optional)

• Python 3 on PATH.
• pip install -r requirements.txt (pinned versions: PySide6, pywebview, paramiko, cryptography, bcrypt, and PyInstaller)
• Keep simple_sftp_server.py, simple_sftp_server-UI.html, the fonts/ folder, the .ico, .png, and -splash.png together.
• Run from source: python simple_sftp_server.py
• Build the .exe: Build_Simple_SFTP_Server.bat -> dist\Simple SFTP Server\Simple SFTP Server.exe

Using it

1. Quick Start for an instant share: click it, reveal the password, and send the connection card. The share folder is QuickStart-Share next to the app, with full access (read, write, delete, rename).
2. For anything narrower, add a user instead: set a username, a folder, an access mode, and a password or public key. That user is locked to that folder.
3. Press Start (or Quick Start) and give the other person the address, port, and their sign-in details from the connection card. Have them verify the host-key fingerprint on first connection.
4. Watch the Live panel for who is connected and what is transferring. Unlock an address if it gets locked out after failed logins.
5. Generate an Ed25519 or RSA key pair for a user who needs one, hand them the private key, and the public key is added to their account automatically.

Firewall and network access

The first time the server starts listening, Windows shows its own one-time "Windows Security Alert" popup asking whether to allow the app through Windows Defender Firewall. Clicking Allow needs administrator rights. If you are not an administrator, or you dismiss or deny the popup, no allow rule is created (and Windows may even add a block rule), so inbound connections stay blocked with no further prompt on later launches.

If that happens, an administrator can add an allow rule after the fact in Windows Defender Firewall (Control Panel > Windows Defender Firewall > Advanced settings > Inbound Rules), allowing the app or the chosen port for the profile you use (Private, Public, or Domain).

The app also runs a quick, read-only check of the Windows Firewall state after it starts, and shows an amber warning in Connection Details if it looks like the firewall may be blocking the chosen port. That check only sees Windows Defender Firewall, so it cannot detect a third-party firewall (common in some antivirus suites) or a router blocking the connection; no warning does not guarantee a client on another network can reach you.

For access from outside your local network, forward the chosen port on your router to this machine's LAN address, in addition to allowing it locally. Third-party firewalls, if you run one, may also need the port opened separately from Windows Defender Firewall.

Security and privacy

• Saved-user passwords are stored only as a one-way bcrypt hash and are never shown again after you save them. Public-key users store only their public key text. No plaintext password is ever written to disk.
• The Quick Start password lives in memory only, is revealable as often as you like while it runs, and is wiped when you stop it; every launch makes a new one.
• Generated passwords use a cryptographic random source: 20 characters, no look-alikes, with letters, digits, and symbols guaranteed.
• Each user is jailed to their folder; paths that try to escape it are refused.
• Failed logins are rate-limited per address (five strikes, fifteen-minute lockout) with a manual unlock.
• Only modern, secure key-exchange, ciphers, and MACs are offered; known-weak algorithms are disabled. There is no "compatibility" downgrade.
• The host key persists next to the app so its fingerprint is stable; treat that file as private and do not commit it.
• The optional debug log is off by default; when on it writes Debug_Log_MMDDYYYY_HHMMSS.txt next to the app with credentials redacted.

A note on how this was built

This project was built with AI assistance. The design decisions, feature direction, and real-world testing were directed by me. The code was written and revised with an AI assistant against that direction. Treat it like any community tool: review and test it before relying on it.

License

Released under the PolyForm Noncommercial License 1.0.0 (see LICENSE). Personal and any noncommercial use, modification, and noncommercial redistribution are permitted; commercial use is not. Keep the copyright notice; no warranty. This tool bundles third-party code; see THIRD-PARTY-LICENSES.txt.

For commercial licensing, open a GitHub issue with the title "Commercial License Inquiry".