SCP on Windows: The Built-In scp Command, PSCP, WinSCP, and Keys

For years, using SCP on Windows meant installing PuTTY, downloading a separate executable, or reaching for a graphical file transfer client.

That is no longer necessary. Windows 10 version 1809 and later include Microsoft's OpenSSH client, which provides scp.exe alongside ssh, sftp, and ssh-keygen. In most cases you open PowerShell and start transferring files immediately.

This guide covers the built-in Windows SCP client, SSH keys, Windows-specific path problems, PuTTY's pscp, WinSCP, and the better options for transfers that have to run unattended.

First, check whether scp is installed

Open PowerShell and run:

Get-Command scp

If OpenSSH is installed, Windows returns a path like C:\Windows\System32\OpenSSH\scp.exe, and running scp by itself prints the command's usage.

If Windows says the command is not recognized, install the OpenSSH Client optional feature. Search for Optional features in Windows Settings, select Add a feature, and install OpenSSH Client. From an elevated PowerShell window the same thing is:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

The same optional feature exists on Windows Server 2019 and later. Once installed, scp, sftp, ssh, and ssh-keygen work from PowerShell, Command Prompt, and any other shell.

Basic scp commands on Windows

Every scp command has the shape scp [options] source destination. One side is a local path; the other is a remote location written as user@hostname:/remote/path/.

Upload a file:

scp C:\exports\orders.csv deploy@sftp.harborline.example:/inbound/

Download a file:

scp deploy@sftp.harborline.example:/outbound/invoices.zip C:\imports\

Copy an entire folder with -r:

scp -r C:\exports\ deploy@sftp.harborline.example:/inbound/exports/

Connect on a nonstandard port with an uppercase -P. That letter matters: ssh uses lowercase -p for the port, and scp reserves lowercase -p for preserving file attributes.

scp -P 2222 C:\exports\orders.csv deploy@sftp.harborline.example:/inbound/

Pass a specific private key with -i. PowerShell's backtick continues a command on the next line, and the options combine:

scp -r -P 2222 -i C:\Users\dana\.ssh\id_ed25519 `
    C:\exports\ `
    deploy@sftp.harborline.example:/inbound/exports/

Windows path rules that cause trouble

SCP mixes Windows paths, Unix-style remote paths, and SSH's host:path syntax, which sets three traps.

Quote any local path with spaces: scp "C:\Monthly Exports\orders.csv" deploy@example.com:/inbound/.

Keep forward slashes on the remote side. The remote path belongs to a Linux or Unix server even when you type it on Windows, so do not convert it to backslashes.

Watch the drive letter. The built-in Windows OpenSSH client understands C:\exports\orders.csv, but scp builds launched from Git Bash, Cygwin, or WSL can read the colon after C as the separator in host:path and treat the drive letter as a hostname. When that happens, change into the directory and use a relative path:

Set-Location C:\exports
scp .\orders.csv deploy@example.com:/inbound/

If you have several scp installations, Get-Command scp | Select-Object -ExpandProperty Source shows which one the shell is using.

Use SSH keys instead of passwords

Passwords are inconvenient for interactive transfers and unsuitable for unattended jobs. Generate an Ed25519 key pair:

ssh-keygen -t ed25519

Windows writes C:\Users\<you>\.ssh\id_ed25519 (the private key, which stays on your computer) and id_ed25519.pub (the public key). Send the public key to the server administrator or append its contents to the remote account's ~/.ssh/authorized_keys. After that, OpenSSH finds the private key in its default location on its own; if you stored it elsewhere, name it with -i. The SSH keys post covers the key setup end to end.

A passphrase protects the private key if the file is stolen, and Windows includes an OpenSSH Authentication Agent service that remembers the unlocked key for your session. From an elevated PowerShell window:

Set-Service ssh-agent -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

Enter the passphrase once, and later SSH and SCP commands use the cached key.

Verify the server's host key

The first time you connect to a server, SSH shows its host-key fingerprint and asks whether you trust it. Do not type yes automatically. Compare the fingerprint with one the server's administrator gave you through a trusted channel.

After you accept it, SSH records the key in C:\Users\<you>\.ssh\known_hosts and checks every later connection against it. If the key changes, SSH warns you and automated transfers fail until the change is investigated. That behavior is intentional: it is what stops a machine in the middle from silently intercepting your files or credentials. The SSH guide explains the mechanism.

Configure repeat connections with an SSH config file

If you regularly connect to the same server, put its settings in C:\Users\<you>\.ssh\config:

Host harborline
    HostName sftp.harborline.example
    User deploy
    Port 2222
    IdentityFile C:\Users\dana\.ssh\id_ed25519

The scp command then becomes scp C:\exports\orders.csv harborline:/inbound/, and the hostnames, ports, usernames, and key paths stay out of your scripts.

PSCP, the PuTTY alternative

Before Windows included OpenSSH, Windows SCP meant pscp.exe from the PuTTY suite. It remains useful when your organization already uses PuTTY, PuTTYgen, and Pageant. Its syntax mirrors OpenSSH's:

pscp -P 2222 -i C:\Keys\deploy.ppk C:\exports\orders.csv deploy@example.com:/inbound/

PSCP uses PuTTY's .ppk key format and authenticates through Pageant, so it fits when your keys and saved sessions already live there. It was built for Windows and handles drive-letter paths without confusing them with host:path.

WinSCP, SCP with a graphical interface

If you would rather drag and drop than type commands, WinSCP is the familiar Windows option. It speaks both SCP and SFTP, with a graphical browser, saved connection profiles, directory synchronization, transfer queues, and a command line and .NET assembly for automation. Use SFTP mode whenever the server supports it, and SCP mode for an older server configured for legacy SCP access.

For a server you work in every day, a transfer window is the wrong shape altogether. ExpanDrive mounts the same SSH server as a Windows drive letter, so Explorer and every application open the remote files directly, and it authenticates with the same Pageant keys.

SCP versus SFTP

SCP and SFTP both run over SSH, usually on TCP port 22, and they do different jobs.

SCP is the right tool when the job is "copy this file from here to there." When the workflow needs to inspect directories, rename or delete files, or resume an interrupted transfer, use SFTP. The scp command post goes deeper on the options and on rsync, and the how SFTP works post covers the protocol underneath.

One protocol detail: beginning with OpenSSH 9.0, the scp command uses the SFTP protocol underneath by default. The familiar syntax remains; the original SCP protocol is no longer what carries the transfer. For an older server that supports only legacy SCP, recent clients accept -O to force it, depending on the OpenSSH version installed on Windows.

Before putting scp in Task Scheduler

It is easy to place an scp command in a batch file and run it from Windows Task Scheduler. It is also easy to build a fragile integration.

The task runs as a different Windows account and cannot find the key, or it has a different known_hosts file. A changed host key stops the job. A network interruption leaves an incomplete transfer, and there is no automatic retry. Files arrive before they finish being written. Password or key rotation means editing several machines. And nobody is alerted when an expected file does not arrive.

If you do schedule scp directly, use absolute paths, run the task under a dedicated service account, capture the command's output and exit code, and transfer to a temporary remote filename before renaming it:

scp C:\exports\orders.csv partner:/inbound/orders.csv.part

if ($LASTEXITCODE -eq 0) {
    ssh partner "mv /inbound/orders.csv.part /inbound/orders.csv"
}

The rename keeps the receiving system from picking up a partially uploaded file.

When scheduled scp becomes infrastructure

Once a transfer needs retries, monitoring, credential management, routing, or multiple trading partners, it is no longer a command. It is an integration.

Files.com moves the partner connection off the Windows machine. A Remote Server Mount connects the partner's SFTP server to a folder on your Files.com site. Files.com holds the credentials, can generate the SSH key pair itself so the private key never leaves Files.com, pins the partner's host key and disables the connection if it changes, and passes every read and write through in real time.

The Windows side then uploads over HTTPS with the Files.com CLI, which runs on Windows with resumable, parallel transfers:

files-cli upload C:\exports\orders.csv /partners/harborline/inbound/

The Windows computer no longer holds every partner's SSH configuration, only one API key. For fully managed workflows, a scheduled Sync moves the files and an Automation routes what arrives, with no job on the Windows machine at all. And Files.com accepts inbound SCP and SFTP on the same ports, so an existing scp command keeps working with one hostname and one credential while the partner-specific configuration lives on Files.com. The SFTP automation post covers the same pattern for the OpenSSH sftp client.

Frequently asked questions

Does Windows have scp built in?

Yes. Windows 10 version 1809 and later, and Windows Server 2019 and later, include Microsoft's OpenSSH client with scp.exe, sftp.exe, ssh.exe, and ssh-keygen.exe in C:\Windows\System32\OpenSSH\. If scp is not recognized, install the OpenSSH Client optional feature.

How do I copy a folder with scp on Windows?

Add the recursive -r option: scp -r C:\exports\ user@example.com:/inbound/exports/. Quote the local path if it contains spaces.

Why does scp treat my local path as a hostname?

SCP uses a colon to separate a remote hostname from its path, so some scp builds mistake the colon in C:\ for that separator. Change to the local directory and use a relative path, and check whether you are running Windows OpenSSH or an scp supplied by Git, Cygwin, or WSL.

How do I use an SSH key with scp on Windows?

Generate a key pair with ssh-keygen -t ed25519, install the public key on the server, then either leave the private key in its default location or pass its path with -i.

What is the difference between SCP and SFTP?

Both normally use SSH on port 22. SCP is a copy command. SFTP is a file-management protocol that lists directories, renames and deletes files, and resumes interrupted transfers. Modern OpenSSH uses the SFTP protocol underneath the scp command by default.

Can I use scp with Files.com?

Yes. Files.com accepts SCP and SFTP connections on the same ports with the same credentials, keys, and ciphers. SCP activity appears in the Files.com logs as SFTP activity.