What are ports 20 and 21 used for?
Port 21 is the FTP control channel: the client connects to it, signs in and sends commands such as list and retrieve. Port 20 is the data channel the server uses in active mode to send files and directory listings back.
FTP uses two connections, which is what makes it awkward for firewalls. In active mode the server opens the data connection from its port 20 back to a port the client chose, and a firewall in front of the client often blocks it. In passive mode the client opens both connections, the second to a high port the server announces, which is why passive mode is the usual choice today. Either way, user names, passwords and files cross the network unencrypted.
Are ports 20 and 21 TCP or UDP?
TCP. FTP needs reliable, ordered delivery, so the control connection on 21 and the data connection both use TCP. IANA also registers the two numbers for UDP, but FTP does not run over it.
Is FTP on port 21 secure?
No. FTP sends credentials and data in clear text. The replacements are SFTP, which runs inside SSH on port 22, and FTPS, which wraps FTP in TLS. The Network+ objectives list SFTP on port 22.
Port 21 vs port 22: what is the difference?
Port 21 is FTP, unencrypted and with a separate data connection. Port 22 is SSH, and SFTP transfers files inside that single encrypted connection. SFTP is not FTP with encryption added; it is a different protocol. Port 22 explained
Which CompTIA exams list ports 20 and 21?
CompTIA lists ports 20 and 21 by number in both the Network+ and the A+ Core 1 objectives.
- Network+ N10-009: objective 1.4 (Networking Concepts), listed as “File Transfer Protocol (FTP), 20/21”.
- A+ Core 1 220-1201: objective 2.1 (Networking), listed as “20-21, File Transfer Protocol (FTP)”.
The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.
Check yourself: a practice question
Written by CertSprint for this page. It is not taken from any exam.
A firewall allows outbound TCP 21. An FTP client can sign in, but directory listings time out. What is the most likely fix?
- Switch the client to passive mode
- Change the server to UDP
- Open port 23
- Disable DNS
Show the answer
A. Switch the client to passive mode. Sign-in works over the control connection on 21. Listings travel on the data connection, which in active mode comes back from the server and is blocked; in passive mode the client opens it instead.
Sources: IANA Service Name and Transport Protocol Port Number Registry: port 21; RFC 959: File Transfer Protocol (FTP); RFC 4217: Securing FTP with TLS. The port number and how each exam lists it come from CompTIA's exam objectives, linked from the study plans above. The explanation and the question are CertSprint's own, checked against these sources on 12 November 2026.