How to Connect to SFTP on macOS With a Private Key: OpenSSH vs Cyberduck for Secure File Transfers

OpenSSH is usually the best choice for repeat SFTP work on macOS, while Cyberduck is better for people who want a visual file browser. macOS includes an SSH client that can connect to SFTP servers from Terminal, and Apple documents Secure Shell access in Terminal for remote connections [source: Apple]. Private key login is safer than typing a password each time, especially when servers disable password access. The real choice is simple: speed and scripting with OpenSSH, or drag and drop with Cyberduck.

TLDR: OpenSSH is faster for admins, developers, and anyone moving files often, because one saved config can reduce a full connection command to something like sftp production. Cyberduck is easier for non technical users who need to upload a folder once a week and prefer bookmarks. In a small team of 10 people, OpenSSH may save 30 to 60 seconds per connection after setup, while Cyberduck can cut onboarding time by half for users who dislike Terminal. For example, a designer sending a 500 MB image folder to a server may finish sooner in Cyberduck, while a developer syncing logs from three hosts will likely prefer OpenSSH.

What SFTP With a Private Key Means

SFTP means SSH File Transfer Protocol. It runs over SSH and encrypts the session. It is not the same as old FTP. That old protocol sends data in ways that can be unsafe unless extra protections are added.

A private key is a local file, often named id_ed25519 or id_rsa. The matching public key sits on the server in ~/.ssh/authorized_keys. During login, the server checks that the user owns the private key. If the key has a passphrase, macOS can store it in the keychain or ask for it when needed.

Method 1: Connect With OpenSSH in Terminal

OpenSSH is already available on modern macOS systems. No extra app is needed. It works well for automation, backups, scripted uploads, and technical users who do not mind commands.

Step 1: Place the Private Key in the SSH Folder

The user should store the private key in the hidden SSH directory:

mkdir -p ~/.ssh
mv ~/Downloads/server_key ~/.ssh/server_key
chmod 700 ~/.ssh
chmod 600 ~/.ssh/server_key

The chmod 600 step matters. OpenSSH may reject keys that are too open. Honestly, it feels like a tiny thing until it wastes 12 minutes with a vague “bad permissions” error.

Step 2: Connect With the SFTP Command

The basic command is:

sftp -i ~/.ssh/server_key username@example.com

If the server uses a custom port, the command changes slightly:

sftp -i ~/.ssh/server_key -P 2222 username@example.com

After login, common commands include:

• ls to list remote files
• lls to list local files
• cd folder to change the remote folder
• lcd folder to change the local folder
• put file.zip to upload a file
• get backup.sql to download a file
• bye to close the session

Step 3: Save the Connection in SSH Config

For repeated use, the cleaner option is an SSH config entry:

nano ~/.ssh/config

Then add:

Host production
  HostName example.com
  User username
  Port 2222
  IdentityFile ~/.ssh/server_key
  IdentitiesOnly yes

Now the user can connect with:

sftp production

This is where OpenSSH wins. It turns a messy command into one short alias. It also works with scripts, cron jobs, deployment tools, and rsync over SSH.

Method 2: Connect With Cyberduck

Cyberduck is a popular graphical file transfer client for macOS. It supports SFTP and private key authentication. It is better for users who want bookmarks, folder views, upload queues, and fewer command line surprises.

Image not found in postmeta

Cyberduck Setup Steps

1. Open Cyberduck.
2. Click Open Connection.
3. Select SFTP SSH File Transfer Protocol.
4. Enter the server name, such as example.com.
5. Enter the port, often 22 or a custom value like 2222.
6. Enter the username.
7. Choose the private key in the SSH Private Key field.
8. Click Connect.

Cyberduck may ask for the key passphrase. It can also save the connection as a bookmark. That helps non technical users avoid typing hostnames and ports again.

The annoying part is key selection. If a user has five keys with similar names, the file picker can slow the process down. Expect to waste time on this if key names are vague, such as key1 or newkeyfinal.

OpenSSH vs Cyberduck: Which Is Better?

Feature	OpenSSH	Cyberduck
Best for	Developers, admins, automation	Designers, editors, less technical users
Setup speed	Fast for command line users	Fast for visual users
Private key support	Excellent	Excellent
Automation	Strong	Limited
File browsing	Text based	Visual

OpenSSH is the better pick when work happens daily. It is also better when transfers need to be repeated, logged, scripted, or combined with other shell tools. The OpenSSH manual also documents identity files and client options for SSH based connections [source: OpenBSD].

Cyberduck is better when a person needs to see files and folders. It reduces fear for users who are not comfortable in Terminal. It also makes upload progress clearer. That matters when a folder has hundreds of files and someone wants visual proof that work is still moving.

Security Tips for Private Key Transfers

Private keys need care. A leaked key can grant access to a server if it has no passphrase or if other protections are weak.

• Use a passphrase on private keys when possible.
• Prefer Ed25519 keys for modern setups, unless the server requires RSA.
• Keep permissions strict with chmod 600.
• Do not share private keys through email or chat.
• Use separate keys for work, personal servers, and contractors.
• Remove old public keys when users leave a team.

Common Errors and Fixes

Permission denied publickey usually means the wrong key, wrong username, or missing public key on the server. The user should confirm the username first. Then the server admin should check authorized_keys.

Unprotected private key file means file permissions are too open. The fix is:

chmod 600 ~/.ssh/server_key

Connection timed out often points to a firewall, wrong hostname, or wrong port. A server may use port 2222 instead of 22.

Host key verification failed can happen after a server rebuild. The user should not blindly delete the old host key. The server fingerprint should be checked first. After confirmation, the old entry can be removed from ~/.ssh/known_hosts.

When Each Option Makes Sense

A developer who connects to staging, production, and backup servers should use OpenSSH. It is faster, cleaner, and easier to reuse. A content manager who uploads images once a week may be happier with Cyberduck. The interface feels familiar, and bookmarks remove repeated setup.

Some teams use both. That is normal. Admins create the keys and config. Designers use Cyberduck bookmarks. Developers use Terminal. The secure part is not the tool alone. It is the key policy, server setup, and access cleanup.

FAQ

Can Cyberduck use the same private key as OpenSSH?

Yes. Cyberduck can use the same private key file stored in ~/.ssh, as long as the key format is supported and permissions allow access.

Is SFTP the same as FTP?

No. SFTP runs over SSH and encrypts the session. FTP is older and should not be used for sensitive transfers without added protection.

What private key format works best on macOS?

Ed25519 is a strong modern choice for many servers. Some older servers may still require RSA.

Why does OpenSSH reject a private key?

The most common reason is loose file permissions. Running chmod 600 ~/.ssh/keyname often fixes it.

Which tool is more secure, OpenSSH or Cyberduck?

Both can be secure. OpenSSH gives more control. Cyberduck gives a friendlier interface. Security depends on key handling, passphrases, server rules, and account cleanup.