How to Use scp: Examples, the Options That Matter, and When to Use SFTP or rsync Instead

Sometimes you need to move a file from one machine to another without setting up a new service or learning a complicated tool. That is exactly where scp shines.

Short for secure copy, scp transfers files over SSH. It uses the same hostnames, user accounts, keys, passwords, and host verification as the ssh command. It is on every Linux distribution and macOS, and current versions of Windows include it through the built-in OpenSSH client.

This guide covers the commands you will use most often, the options worth remembering, and the situations where SFTP or rsync is the better choice.

The basic scp command

Every scp command follows the same pattern: scp [options] source destination. A local path looks like any other path on your computer. A remote path includes a user, a host, and a path, with the colon after the hostname separating the server from the path: dana@files.harborline.example:/uploads/.

Copy a local file to a server:

scp report.pdf dana@files.harborline.example:/uploads/

Download a remote file into the current directory (the final period means "here"), or into a specific one:

scp dana@files.harborline.example:/exports/orders.csv .
scp dana@files.harborline.example:/exports/orders.csv ~/Downloads/

Copy an entire directory with -r:

scp -r ./build/ dana@files.harborline.example:/var/www/site/

Copy between two remote servers:

scp dana@old.harborline.example:/data/archive.tgz dana@new.harborline.example:/data/

With current OpenSSH versions in SFTP mode, that data is relayed through your local machine. Older clients and legacy SCP mode can behave differently.

The scp options worth remembering

You do not need to memorize every flag. These cover most day-to-day transfers.

Note the easy-to-miss distinction: scp uses an uppercase -P for the port, and lowercase -p preserves file attributes.

A realistic command that copies a directory with a specific key and port while preserving timestamps and permissions:

scp -r -p -P 2222 -i ~/.ssh/id_ed25519 ./exports/ deploy@sftp.brightway.example:/inbound/exports/

Compression with -C helps for text files, CSV exports, and logs. It offers little for files that are already compressed, such as ZIP archives, JPEGs, and MP4 video, and can make those transfers slower by adding CPU work without reducing the bytes sent.

When a connection fails, add -v. Verbose output shows which configuration files, keys, authentication methods, and host-key algorithms SSH is trying; -vv and -vvv add more.

Use SSH configuration to shorten commands

If you regularly connect to the same server, put its settings in ~/.ssh/config:

Host brightway-sftp
    HostName sftp.brightway.example
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

The transfer command becomes scp -r -p ./exports/ brightway-sftp:/inbound/exports/, and the same configuration works for ssh, sftp, and every other SSH-based tool.

SSH keys and host verification

Because scp runs over SSH, it authenticates exactly the way an interactive SSH connection does.

Generate an Ed25519 key pair with ssh-keygen -t ed25519 and install the public key in the remote account's ~/.ssh/authorized_keys; where the server allows it, ssh-copy-id dana@files.harborline.example does that for you. After that, scp authenticates without asking for the account password. If the private key has a passphrase, ssh-add ~/.ssh/id_ed25519 loads it into ssh-agent so you enter the passphrase once per session. The SSH keys post walks through it.

The first time you connect, SSH shows the server's host-key fingerprint and asks whether you trust it. Do not accept that prompt blindly; compare the fingerprint with one the server's owner supplied through a trusted channel. Once accepted, the key is stored in ~/.ssh/known_hosts, and future connections check the server against it. If the server later presents a different key, scp stops with a warning. That can follow legitimate server maintenance, and it can also mean you are connecting to the wrong machine or someone is intercepting the connection. Investigate before removing the old key.

For unattended jobs, -o BatchMode=yes tells scp to fail instead of waiting for a password or passphrase, and known_hosts has to be populated before the job runs. ssh-keyscan files.harborline.example >> ~/.ssh/known_hosts retrieves the server's public host key, but scanning a key is not the same as verifying it; compare the captured fingerprint with a trusted value before relying on it. Never disable host-key checking to quiet a script. StrictHostKeyChecking=no makes automation quieter by removing the check that matters.

What scp does not do

scp is intentionally narrow: it copies files. That simplicity is its strength and its limit. It has no convenient way to browse remote directories, rename or delete remote files, synchronize only what changed, resume an interrupted transfer, retry automatically, or keep two trees in sync. If a 20 GB transfer fails near the end, you start it again.

Modern OpenSSH uses the SFTP protocol underneath scp by default, but the command's interface still only copies. Using SFTP internally does not make scp a file-management tool.

scp vs SFTP vs rsync

All three ride SSH, and they solve different problems.

Choose scp for simple, one-off copies where you know the source and destination and want the shortest command: scp invoice.pdf user@example.com:/incoming/. It fits occasional files, small trees, and scripts where restarting a failed copy is acceptable.

Choose SFTP when you need to inspect or manage files on the server. An sftp user@example.com session supports ls, cd, get, put, reget for resuming, rename, and rm, and it takes batch files for scripted sequences. The SFTP automation post covers running it from cron, and the how SFTP works post covers the protocol.

Choose rsync when you repeatedly copy the same directory tree and want to move only what changed: rsync -av ./exports/ user@example.com:/exports/. On unreliable connections --partial keeps incomplete files for a later retry. rsync is the better tool for deployments, backups, large datasets, and recurring synchronization.

Running scp from cron

An scp command runs from cron, but unattended transfers need more care than interactive ones: key-based authentication, a preverified known_hosts entry, BatchMode=yes so nothing waits on a hidden prompt, logging, exit-code checking, retries or alerting, and a plan for incomplete files.

#!/usr/bin/env bash
set -euo pipefail

scp -o BatchMode=yes -i /home/exporter/.ssh/id_ed25519 \
  /srv/exports/orders.csv partner-sftp:/inbound/orders.csv

Make sure cron runs the job as the expected user. Cron has a limited environment, so use absolute paths and do not assume your shell configuration or ssh-agent is available:

0 2 * * * /usr/local/bin/send-orders >> /var/log/send-orders.log 2>&1

Even with those precautions, plain scp has no retry or resume. A brief network interruption leaves an incomplete transfer and the whole file has to be sent again.

Replacing fragile scheduled transfers with Files.com

When file exchanges become operational workflows rather than occasional copies, a collection of cron jobs, private keys, host settings, and retry scripts becomes hard to manage. Files.com centralizes those connections.

A Remote Server Mount connects a partner's server to a folder on your Files.com site. Files.com stores the connection settings, can generate the key pair itself so the private key never leaves Files.com, and pins the partner server's host key, disabling the connection if it ever changes. Operations against the mounted folder pass through to the remote server in real time.

Instead of connecting each job to a partner's SSH server, the job uploads over HTTPS with the Files.com CLI, with resumable, parallel transfers:

files-cli upload ./exports/orders.csv /partners/brightway/inbound/

For workflows that need no custom code, a Sync and an Automation replace the cron job altogether. Existing scp and sftp scripts keep working too: Files.com accepts inbound SCP and SFTP, so scripts point at one hostname with one set of credentials while the partner-specific details stay on Files.com. The Python, PowerShell, and Windows scp posts show the same pattern from their side.

Frequently asked questions

How do I copy a file to a server with scp?

scp localfile user@host:/remote/path/. For a nonstandard port and a specific private key: scp -P 2222 -i ~/.ssh/id_ed25519 localfile user@host:/remote/path/.

How do I download a file with scp?

scp user@host:/remote/path/file.csv . saves it in the current directory. Replace the period with another local path to save it elsewhere.

How do I copy a directory?

Add -r: scp -r ./folder/ user@host:/remote/path/. Add -p to preserve timestamps and file modes as well.

Can scp resume an interrupted transfer?

No. A failed scp transfer starts again from the beginning. Use SFTP's reget or rsync with --partial when transfers are large or connections are unreliable.

What is the difference between scp and SFTP?

Both run over SSH with the same accounts and keys. scp is a copy command. SFTP is a broader remote file-management interface with commands for listing, uploading, downloading, renaming, deleting, and resuming. Current OpenSSH uses SFTP as the protocol underneath scp by default, and the two interfaces still serve different purposes.

How do I use scp without a password prompt?

Install an SSH public key in the remote account's authorized_keys, and load the private key into ssh-agent or name it with -i. For unattended scripts, add -o BatchMode=yes so the command fails instead of stopping to ask.

Does scp work with Files.com?

Yes. Files.com accepts SCP connections through its SFTP service using the same SSH keys, ports, and cipher settings. SCP transfers appear in the Files.com logs as SFTP activity.