scp Command to Transfer Files
The scp command copies files between machines over SSH: scp app.tar.gz user@server:/var/www/ uploads, and scp user@server:/var/log/app.log . downloads. Add -r for folders, -P for a non-standard port and -i for a private key. It worked when both ends show the same sha256 checksum.
Every scp shape an Indian site owner needs: uploads, downloads, folder copies, ports, keys, and reading the errors.
knowledge
- Read time
- 4 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What does the scp command do?
scp copies files between two machines over an SSH connection, so anywhere you can log in with SSH, you can copy to — no FTP port, no extra daemon, no plain-text password on the wire. It is part of OpenSSH and uses the same key or password authentication as ssh, and the same ~/.ssh/config entries.
- Since OpenSSH 9.0, scp uses the SFTP protocol for transfers by default. Ubuntu 24.04 ships OpenSSH 9.6p1, so it is SFTP-mode out of the box; Ubuntu 22.04 ships 8.9p1, which still speaks the legacy protocol.
- Legacy servers without the sftp subsystem need
scp -Oto force the old protocol. - Every remote path takes the form
user@host:/path— the colon marks the remote side, so a local file with a colon in its name needs./in front of it.
How do you copy a file from your machine to the server?
The upload form is scp source user@host:destination, run from your own machine with the remote folder already existing. For example scp app.tar.gz user@server:/var/www/.
- Check both ends:
ls -lh app.tar.gzlocally, andssh user@server 'ls -ld /var/www'remotely. - Upload:
scp app.tar.gz user@server:/var/www/— the trailing slash means "inside this folder". - Non-standard port: the port flag goes before the source:
scp -P 2222 app.tar.gz user@server:/var/www/. - Specific key:
scp -i ~/.ssh/deploy_ed25519 app.tar.gz user@server:/var/www/when the default key is not the right one. - Preserve timestamps and modes:
scp -p app.tar.gz user@server:/var/www/— lowercase -p, a different flag from capital -P. - Read the output: a finished copy reaches 100% with no error text, then the prompt returns.
If the file lands somewhere unexpected, check the trailing slash: /var/www means "rename the file to www", while /var/www/ means "put it inside www".
How do you copy a file back from the server?
Swap the arguments: scp user@host:/remote/path ./local-path/ pulls a file down to your machine. scp user@server:/var/log/app.log . writes app.log into the directory you are in; naming a destination renames it, e.g. scp user@server:/var/log/app.log ./logs/app-backup.log.
Folders need -r on the download too: scp -r user@server:/var/www/uploads ./uploads. Files you cannot read as that SSH user fail with Permission denied — they are not silently skipped, which is what you want from a backup copy.
Which flags cover folders, keys, ports and two servers?
Six flags cover almost every real scp task: -r for folders, -P for ports, -i for keys, -p to preserve, -l to throttle, -3 and -O for the special cases. The rest of scp is path syntax.
| Task | Command | Note |
|---|---|---|
| Whole folder | scp -r ./site user@server:/var/www/ | -r is required for directories |
| Different SSH port | scp -P 2222 file user@server:/path/ | Capital P; ssh itself uses lowercase -p |
| Specific private key | scp -i ~/.ssh/deploy_ed25519 file user@server:/path/ | Key file must be chmod 600 |
| Limit bandwidth | scp -l 800 big.zip user@server:/path/ | Limit is in Kbit/s, not KB/s |
| Between two remote hosts | scp -3 user@a:/file user@b:/path/ | -3 routes the data through your machine; without it the copy goes directly from host A to host B, so A must be able to reach B |
| Legacy server | scp -O file user@oldserver:/path/ | Forces the old SCP protocol when the sftp subsystem is missing |
For anything above a few hundred megabytes, or any transfer you will repeat, rsync is the better tool because it resumes and skips unchanged files. Generate the key first with the SSH key guide for Ubuntu if you do not have one yet.
How do you verify the copy arrived intact?
Compare a checksum on both ends: run sha256sum on the local file and again on the remote file over ssh, and identical hashes mean an identical file.
# local side
sha256sum app.tar.gz
# remote side
ssh user@server 'sha256sum /var/www/app.tar.gz'Size alone is weak evidence — a truncated copy can report a plausible size. If the hashes differ, the transfer was cut mid-write or the disk filled; check df -h on the server and rerun the copy.
Which scp errors mean what, and how do you fix them?
Almost every scp failure is an SSH problem wearing a file-copy costume — read the first line of the error before changing the command.
| Error | Cause | Fix |
|---|---|---|
| Permission denied (publickey) | Server did not accept your key | Add -i with the right key, or run ssh-copy-id user@server |
| scp: dest open: Permission denied | Remote folder not writable by that user | Copy to a writable path or fix ownership with chown |
| Connection refused | Wrong port, or sshd not running | Confirm the port with ssh -p, check systemctl status ssh |
| subsystem request failed | Old server without the sftp subsystem | Retry with scp -O |
| Transfer stalls at 0% | Network path or MTU problem | Add -v, then test with a small file |
| No space left on device | Remote disk is full | df -h, free space, copy again |
Add -v to any failing command. The verbose output names the key offered, the port reached and the protocol negotiated, which is usually enough to match one of the rows above. Repeated refusals on a VPS may be a firewall or sshd issue — the SSH connection refused on a VPS guide walks that diagnosis.
scp, SFTP or rsync — which one should you use?
Use scp for one file or one folder, once; use SFTP to browse and resume interactively; use rsync for large, repeated, or delta transfers. All three ride the same SSH connection and the same credentials.
- scp: the quickest path from A to B, scriptable in one line.
- SFTP: interactive listing, resume, delete — the port involved is covered in the SFTP port number guide.
- rsync: resumes interrupted copies and skips unchanged files, which matters on Indian broadband links with variable throughput.
On Linux hosting or a VPS, add your public key to ~/.ssh/authorized_keys and test a plain ssh login before copying anything. If ssh works and scp does not, the fault is in the path or the permissions, not the network.
Frequently asked questions
What is the basic scp command to transfer a file?
The form is scp source user@host:destination. To upload, run scp app.tar.gz user@server:/var/www/; to download, scp user@server:/var/log/app.log . from your own machine. The colon after the host name marks the remote side.
How do I copy a whole folder with scp?
Add -r: scp -r ./site user@server:/var/www/. Without it the command refuses the directory. A trailing slash on the destination means copy into that folder; no slash means rename the source to that name.
How do I use scp on a non-standard SSH port?
Use a capital -P before the source: scp -P 2222 file user@server:/path/. Lowercase -p preserves timestamps and file modes, which is a different flag and a common mix-up. The port must match what sshd listens on.
How do I use scp with an SSH key or PEM file?
Add -i with the key path: scp -i ~/.ssh/deploy_ed25519 file user@server:/path/. The key must be readable only by you — chmod 600 — or SSH ignores it. Cloud images each have their own default login user, so confirm yours before blaming the key.
Why does scp say Permission denied?
Either the SSH key was not accepted or the remote folder is not writable by that user. Rerun with -v to see which key was offered. If the login succeeds but the write fails, change the destination path or fix ownership with chown.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.