Could anyone help explain the parameters in the following SFTP command?

sftp://user:[email protected]:22

This was used as part of the LFTP command of the source.

What is the xx after the first :? Is that the directory (couldn't find any such directory on the server of this user)?

2 Answers 2


What you really want to understand is the URI syntax. Note that a URI (You-Are-Eye) is NOT the same as a URL (You-Are-Ell). All URL's are URI's, but not all URI's are URL's.

Please see the Wiki article https://wikipedia.org/wiki/Uniform_Resource_Identifier or the IETF RFC https://datatracker.ietf.org/doc/html/rfc3986 about URI's.

In general, for a sftp URI (in this case, the same as a URL), the format is:

"sftp:" [ "//" [ <user-part> "@" ] <host-part> ] <path-part>

Where the <user-part> can be further sub-divided:

<user-name> [ ":" <user-password> ]

In general, however, using such a URI/URL is strongly discouraged, as both the user name and password are plainly visible to anyone snooping network traffic outside of the secured end points. That "window of opportunity" may be very small in a well-written application, or it may be comparatively large if the application "hands it off" to another application to handle the establishing the actual secure connection between end points.

  • 1
    Worse, if you're particularly careless it might be visible with ps by any other logged-in user. Commented Jul 26, 2021 at 8:24
  • 2
    Strictly speaking, because SFTP never sends the URI over the wire, there is no issue with the password leaking to the network. The problem is it leaking to other users on the same system, because it’s trivial on most systems to see the command-line arguments of each command running on the system, and having it in the command line means it’s persistent in memory (whereas just specifying it interactively will only have it in memory long enough to authenticate). Commented Jul 26, 2021 at 11:50
  • 4
    Yes and no. "Strictly speaking" is correct. I have, however, seen local network setups where navigating a LAN firewall and reverse proxy ends up forwarding (and caching!) the URL. The risk is minimal, since it (should) never be sent out to the rest of the Internet, but a minimal risk is still a risk... And I learned long ago, all the "should (not)" things in life, will happen, no matter what you do.
    – C. M.
    Commented Jul 26, 2021 at 12:53
  • Thanks for the detailed explanation guys. I learnt something new today.
    – Moon
    Commented Jul 27, 2021 at 9:58
  • localhost:80 is a URL, it allows me to locate this resource if i am on the right machine. Is it a URI? Does it uniquely identify the resource?
    – v010dya
    Commented Feb 1 at 18:44

It's where the password for [email protected] gets put in the command, although this is not a recommended approach for sftp.

  • Thanks Dave. That's exactly what I'm after. We are trying to make sense of this and improve the way how this is done. Appreciated.
    – Moon
    Commented Jul 26, 2021 at 1:26
  • usually, passwords and usernames are encrypted when sent over the wire, but you nan override this by making tthe browser think there are plain data. like a google search term is not encrypted, but you google login salmost certainly is.
    – C. M.
    Commented Feb 3 at 14:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .