What the scp command does
The scp command copies files between machines over SSH: scp app.tar.gz user@server:/var/www/ uploads, and scp user@server:/var/log/app.log . downloads. Add -r for folders, -P for a non-standard port and -i for a private key. It worked when the destination file has the same size and checksum.
Every remote path takes the form user@host:/path. A colon marks the remote side, so a local file with a colon in its name needs ./ in front. The command is part of OpenSSH, which means anything that accepts an SSH login already accepts scp: no FTP port, no extra daemon, no plain-text password on the wire.
- OpenSSH 9.x, the version on Ubuntu 22.04 and 24.04, runs scp over the SFTP protocol by default.
- Older servers without the sftp subsystem still work with the legacy protocol flag, scp -O.
- Authentication is the same key or password you use for ssh, and the same ~/.ssh/config entries apply.
Copy a file from your machine to the server
The upload form is scp source user@host:destination. Run it from your own machine, and make sure the remote folder exists before you start.
- Check the file and the target: ls -lh app.tar.gz and ssh user@server 'ls -ld /var/www'.
- Upload it: scp app.tar.gz user@server:/var/www/. The trailing slash means "inside this folder".
- Add a non-standard port before the source: scp -P 2222 app.tar.gz user@server:/var/www/.
- Add a key file when the default key is not the right one: scp -i ~/.ssh/deploy_ed25519 app.tar.gz user@server:/var/www/.
- Keep timestamps and permissions with -p: scp -p app.tar.gz user@server:/var/www/. The lowercase flag is separate from -P for port.
- Read the progress line. A completed copy ends at 100% with no error text, and the shell returns to the prompt.
If the file lands in the wrong place, the usual cause is a missing trailing slash: /var/www means "rename the file to www", while /var/www/ means "put it inside www".
Copy a file back from the server
Swap the arguments. scp user@server:/var/log/app.log . writes app.log into the current directory on your machine. Name the destination when you want a different filename: scp user@server:/var/log/app.log ./logs/app-2026-10-30.log.
Folders need -r on the download too: scp -r user@server:/var/www/uploads ./uploads. The copy follows the remote permissions where it can, and files you cannot read as that user fail with Permission denied rather than being skipped.
Copy folders, use keys and move between two servers
Most real transfers need one flag beyond the basic form. This table covers the ones that matter day to day.
| Task | Command | Note |
|---|---|---|
| Whole folder | scp -r ./site user@server:/var/www/ | -r is required for directories |
| Different SSH port | scp -P 2222 file user@server:/path/ | Capital P; ssh uses lowercase -p |
| Specific private key | scp -i ~/.ssh/deploy_ed25519 file user@server:/path/ | Key must be chmod 600 |
| Limit bandwidth | scp -l 800 big.zip user@server:/path/ | Limit is in Kbit/s, not KB/s |
| Two remote hosts | scp -3 user@a:/path/file user@b:/path/ | -3 routes traffic through your machine |
| Legacy server | scp -O file user@oldserver:/path/ | Use when sftp-server is missing |
Without -3, a copy between two remote hosts still passes through your local machine, which doubles the traffic on your connection. For anything above a few hundred megabytes, rsync is the better tool; see rsync files to a server.
Verify the copy arrived intact
Size alone is weak evidence. Compare a checksum on both ends: run sha256sum app.tar.gz locally, then ssh user@server 'sha256sum /var/www/app.tar.gz'. Identical hashes mean an identical file.
You know it worked when the two hashes match and ls -lh shows the same byte count. If the hash differs, the transfer was truncated or the disk filled mid-write; rerun the copy after checking df -h on the server.
scp errors and how to fix them
Almost every scp failure is an SSH problem wearing a file-copy costume. Read the first line of the error before you change the command.
| Error | Cause | Fix |
|---|---|---|
| Permission denied (publickey) | The server did not accept your key | Add -i with the right key, or run ssh-copy-id user@server |
| scp: dest open ... Permission denied | The remote folder is not writable by that user | Choose a writable path or fix ownership with chown |
| Connection refused | Wrong port or sshd not running | Confirm the port with ssh -p, check systemctl status ssh |
| subsystem request failed | Old server without the sftp subsystem | Retry with scp -O for the legacy protocol |
| Transfer stalls at 0% | Network path or MTU problem | Add -v to see where it stops, then test with a small file |
| No space left on device | Remote disk is full | Check df -h, free space, then copy again |
Add -v to any failing command. The verbose output names the key offered, the port reached and the protocol negotiated, which is usually enough to see which of the rows above applies.
scp, SFTP or rsync: which to use
Use scp for one file or one folder, once. Use SFTP when you want to browse, resume or delete interactively; the default port is covered in the SFTP port number guide. Use rsync when the transfer is large, repeatable, or needs to skip unchanged files.
All three need SSH access. On a Linux hosting plan or a VPS, create the SSH key first, add it to ~/.ssh/authorized_keys, and test with a plain ssh login before you copy anything. If ssh works and scp does not, the fault is in the path or the permissions, not the network.
Frequently Asked Questions
What is the basic scp command to transfer a file?
The form is scp source user@host:destination. To upload, run scp app.tar.gz user@server:/var/www/. To download, run scp user@server:/var/log/app.log . from your own machine. The colon after the host name marks the remote side.
How do I copy a whole folder with scp?
Add -r: scp -r ./site user@server:/var/www/. Without -r the command refuses the directory. A trailing slash on the destination means copy into that folder, not rename to it.
How do I use scp on a non-standard SSH port?
Use a capital -P: scp -P 2222 file user@server:/path/. The lowercase -p means preserve timestamps, which is a different flag and a common mistake. The port must match the one sshd listens on.
How do I use scp with an SSH key or PEM file?
Add -i with the path to the key: scp -i ~/.ssh/deploy_ed25519 file user@server:/path/. The key must be readable only by you, so run chmod 600 on it. On AWS, the default user for an Ubuntu AMI is ubuntu, not root.
Why does scp say Permission denied?
Either the SSH key was not accepted or the remote folder is not writable by that user. Run the same command with -v to see which key was offered. If the login succeeds but the write fails, change the destination or fix ownership with chown.
Is scp faster than FTP or rsync?
scp is usually faster than plain FTP because it skips a second login and uses SSH compression when you add -C. rsync beats both on repeat transfers because it sends only changed blocks. For a single file, the difference is small.