Best WinSCP Alternatives for Mac in 2026

Pick by workflow

If file transfer is the whole job

Start with Cyberduck if you want a free tool with SFTP, WebDAV, and cloud-storage support. Its official feature list also includes external-editor integration, synchronization, resume, and recursive transfers.

Choose Transmit when file transfer and directory sync are central to the job and you want a dedicated Mac application. Panic lists SFTP, FTP, WebDAV, S3, cloud services, file sync, and a 7-day trial.

Nexus Shell is a narrower fit here. It supports SFTP, but it is designed around SSH-accessible servers rather than general cloud storage. If you need FTP, WebDAV, or S3, Cyberduck or Transmit is the better choice.

If you want the terminal and files together

Termius combines SSH and SFTP and works across desktop and mobile platforms. Its free Starter plan currently includes SSH and SFTP; its Pro plan adds cross-device sync, session logs, and automation.

Nexus Shell keeps each server's terminal, files, monitoring, keys, and Docker operations in one native Mac workspace. Its local-and-remote dual-pane SFTP view supports drag-and-drop and batch transfers, while remote editing opens a temporary copy in your Mac editor and checks for conflicts before uploading a saved version.

Termius is the stronger choice when connections must follow you across operating systems and mobile devices. Nexus Shell fits when a Mac-native server workspace matters more than cross-platform access.

For a broader side-by-side view of terminal, SFTP, monitoring, Docker, pricing, and platform support, see the Mac SSH client comparison.

Working with files on two servers

In Nexus Shell 1.7.8, dual-pane Files means your Mac on the left and one selected server on the right. Multiple SSH session tabs are available, but this is not a two-remote-server file layout or a split-terminal grid.

1. Select the source server in Files. Download the needed file into a new, clearly named folder on your Mac and wait for that transfer to finish.

2. Select the destination server and verify its name and target directory. Upload the local copy into a separate staging directory you own; do not overwrite a live configuration just to test the workflow.

3. Check the destination file's contents and permissions before a separate deployment step. A successful transfer does not restart a service, synchronize directories, or preserve every owner, ACL and extended attribute.

The bytes travel through your Mac and a local copy remains. For data that must stay off the Mac, large ongoing replication, or a required remote-to-remote pane layout, choose a transfer workflow that explicitly supports those requirements.

Enter a remote path without reaching for the pencil

In 1.7.8, click the empty area of the path bar to type a directory. The pencil button now sits just after the path, and right-click → Edit path remains available. Press Return to open the directory or Escape to cancel. Clicking a named ancestor breadcrumb still navigates to that directory. This applies to remote Files, the local pane and the terminal file sidebar.

For 1.7.7 and earlier, use the pencil, right-click → Edit path, or double-click the breadcrumb area. Check the version installed on your Mac before following the new gesture; the website release notes confirm the 1.7.8 change, not availability in every App Store region.

Enter a path for the selected pane: a Mac folder belongs in the local pane, while the remote pane needs a directory visible to the selected server account. A restricted SFTP account may expose a different root. If a directory cannot be opened, check the selected server, path and permissions; changing the path bar gesture does not grant access.

Follow the complete multi-server file checklist (中文操作说明) for staging, verification and version limits. SFTP requires Pro or an eligible trial; validate the task before purchasing.

Mac rz/sz: no file dialog, or a transfer stuck in tmux?

rz and sz use ZMODEM inside a terminal session; they are not SFTP commands. When run on the remote host, sz sends a file toward your Mac and rz receives an upload into that remote shell's current directory. Both the remote program and the Mac terminal need protocol support. Installing a server package alone does not add a file picker to an unsupported terminal.

Confirm hostname, id -un and pwd privately before transferring: an interactive hop may land on a different machine or directory from the saved file connection. Use a disposable file, confirm the Mac save location, then compare the downloaded bytes. A successful upload does not reload the service using that file.

Start with the rz/sz direction, first-transfer and checksum checklist. These Nexus steps were checked against release-tag source and built-in help; this is not a new GUI, App Store or customer-bastion compatibility test. If SFTP is permitted, the existing free file pack and browser-local checker provide a client-independent next step. The checker does not connect to a server.

For a specifically tmux-aware trzsz setup, follow the trzsz project's local/remote/relay instructions as a separate toolchain. Do not assume trz/tsz and traditional ZMODEM are interchangeable or use either to bypass server policy. Evaluate Nexus Shell's integrated files and terminal only if those workflows fit; website Pro pricing and trial terms remain available.

If you prefer built-in tools

macOS already includes OpenSSH. For occasional work, Terminal plus ssh, sftp, scp, or rsync may be all you need. This route is free and scriptable, but it does not provide a visual file browser or integrated server status.

Before you move a saved WinSCP connection

Check the File protocol saved in WinSCP first. SFTP is not FTP over TLS (FTPS), and changing a port number does not convert one protocol into another. Nexus Shell fits an SSH/SFTP server; use a transfer client with the required protocol if your host only offers FTP, FTPS, WebDAV or S3.

If the new client logs in but SFTP closes before files appear, check the SFTP startup stage before changing permissions or assuming a client switch fixes it. EOF, a refused subsystem and unexpected packet bytes are different clues.

If your key is a PuTTY .ppk file

Nexus Shell rejects PuTTY-format private-key imports. On the computer holding the key, open the existing file in PuTTYgen, unlock it if needed, then use Conversions → Export OpenSSH key. Save a separate, passphrase-protected copy; keep the original until you have tested the new connection. Do not use an online key converter or paste the private key into a support form. See WinSCP's PuTTYgen instructions for its export options.

Alternatively, create a separate Mac key and have its public key installed through your approved server-management process. Converting a key's file format keeps the key identity; generating a new key requires server-side authorization. Do not replace another person's authorized keys.

Finish one real file task before migrating everything

1. Add one non-critical SSH connection using the verified address, account and authentication method. Confirm the host fingerprint before accepting it.

2. Open the remote Files view and navigate to the intended directory. A successful terminal connection does not guarantee that SFTP or a particular directory is allowed.

3. Download a harmless file first. If you also need uploads, use a disposable test file in a directory you own, check its contents remotely, and remove only that test file when finished.

4. For one-file changes, follow the external-editor and conflict-check walkthrough. Directory synchronization, WinSCP scripts and project deployment are separate requirements, not implied by upload-on-save.

5. Keep the Windows setup available until authentication, permissions and the actual file task work. A key-format error, rejected key and folder permission error have different causes; changing clients does not grant additional server access.

SFTP requires Pro or an eligible trial in Nexus Shell. The website edition offers an eligible new account a seven-day Pro trial without a card, so you can validate the actual workflow before deciding on website lifetime Pro.

Check a transfer with files you can safely experiment with

Use our free SFTP transfer check ZIP before moving real files. It contains five synthetic payload files: a filename with spaces, a Chinese filename with UTF-8 text, a hidden file, an empty file and binary bytes. The ZIP includes a SHA-256 manifest and English/Chinese instructions; it works with any SFTP client.

1. Extract the ZIP into a fresh Mac folder and keep that original unchanged. Upload the whole extracted folder, including its hidden file, to a new disposable directory your server account owns.
2. Wait for completion, then download the remote folder into a different empty local folder. Do not merge with the original: leftover local files could hide missing downloads.
3. In Mac Terminal, type cd followed by a space, drag the downloaded folder into Terminal and press Return. Run shasum -a 256 -c SHA256SUMS. All five payload files should report OK; use the unchanged manifest retained with the original as the baseline, as explained in README.txt.

No remote shell is needed for this round-trip check. Matching hashes verify the listed bytes, not permissions, ownership, extra files, large-transfer reliability or interruption recovery. This is a small correctness check, not a speed benchmark or a fresh Nexus Shell server test. Remove only your disposable test copies when finished.

Moving from WinSCP: did text mode change the bytes?

A text transfer can change line endings while a byte-preserving copy leaves them unchanged. WinSCP documents Text, Binary and Automatic modes; Automatic chooses by a filename mask, and editor transfers can have separate settings. Do not assume a Mac client imports those rules or automatically converts a Windows script to LF.

1. Keep an unchanged original. If a Linux script reports ^M or a bad interpreter, inspect its line endings and interpreter path separately. A successful transfer does not establish that a script is valid or safe to run.
2. If LF is required, save a separate copy with the intended line endings in your editor and review the change before uploading. Use that prepared copy as the baseline. Do not convert archives, images, signed files or an entire production directory as a repair.
3. Upload into a separate staging location, then download into another empty local folder. Compare the original intended bytes with that retrieved copy. Different hashes mean different bytes; an intentional conversion requires an explicitly chosen new baseline.

Our four-case OpenSSH experiment preserved CRLF in uploads and downloads, retained a UTF-8 BOM, and preserved separately prepared LF bytes. It used a local SFTP subsystem over pipes, not a network, WinSCP, Nexus Shell GUI or App Store test. It does not establish a text-mode setting in Nexus Shell.

Compare your original and downloaded copy locally

This free check works with any transfer client and needs no account. Select two small, non-sensitive local copies, up to 16 MiB each. It shows SHA-256 and whether a difference is explained by CRLF/LF pairs alone. It does not decide which version is correct, detect text encoding, repair files or check the server. For larger files or without JavaScript, run shasum -a 256 on each copy in Mac Terminal.

First verify your actual file task, then consider website lifetime Pro if Nexus Shell fits your workflow. The checker is free; Nexus Shell SFTP requires Pro or an eligible trial. A hash match does not verify permissions, ownership, extra files, service loading or the transfer path.

Two Linux files download as one on the Mac

A case-insensitive destination cannot keep report.txt and Report.txt in the same folder, even if the source can. Depending on the client, a download may stop, skip, ask or overwrite. A completed progress bar or one matching file size does not prove both files survived. Check the actual destination volume before retrying.

1. Keep both source files unchanged. Compare exact filenames and parent folders with the downloaded listing; refreshing a hidden-file or filtered view does not resolve a name collision.
2. Select the actual destination volume in Disk Utility and use Info to check its format. Apple distinguishes APFS from APFS (Case-sensitive). External disks and network mounts may behave differently; do not erase or reformat a disk just to troubleshoot.
3. Retain both copies in separate, distinctly named parent folders, or use an existing verified case-sensitive destination. An approved source-side archive retains its internal entries while stored as one file; extracting it onto an incompatible volume brings the collision back. Avoid renaming production source files or choosing overwrite-all.
4. Verify each copy against its own retained source baseline. The five-file ZIP and browser checker above do not test case collisions or arbitrary trees. Switching clients or buying Pro does not change a destination's naming rules.

Our four-case macOS experiment, source and results found one entry after ordinary writes to these names: still 6 bytes, but with a changed SHA-256. Exclusive creation refused the second name with EEXIST; distinct names or distinctly named parent folders retained both. This tested a fresh local temporary directory, not an SFTP transfer, Nexus Shell GUI, every Mac volume or Unicode normalization.

See Apple's filesystem format definitions and Fetch's same-name download explanation. Validate your destination before using the existing test pack for a separate byte-integrity check.

SFTP resumed successfully, but the file is wrong

A successful resume and matching file size do not prove matching contents. OpenSSH reget and reput continue from the partial copy's length; they assume its existing bytes belong to the same source version. If that prefix differs, the completed file can have the right size and a wrong SHA-256 hash.

1. Pause further retries and keep the unchanged source and partial copy separate. Check the selected server, path, transfer direction and source version; do not let an editor or export job change the source during recovery.
2. If you cannot establish that the partial belongs to that exact source, start a full copy under a new name or in a separate staging directory. Keep any live destination intact. Choosing Resume, Retry and Overwrite can do different things in different clients.
3. Verify the completed bytes against the retained original before a separate deployment step. On a Mac, run shasum -a 256 on each local copy. For an SFTP-only account without a remote checksum command, download the staged upload into a different empty Mac folder and hash that copy. File presence, length and a finished progress bar are weaker checks.

Our six-case OpenSSH experiment, source and recorded hashes used a 16,384-byte synthetic file and 4,096-byte partial copies. In both directions, the matching-prefix resume and fresh copy matched the original. Changing just the partial's first byte left a corrupt result after resume, despite exit status 0 and the expected final length. This ran through a local SFTP subsystem over pipes, with no SSH login, credentials or network interruption.

The OpenSSH resume warning explains the underlying assumption. This experiment does not establish Nexus Shell GUI resume support, automatic recovery or App Store compatibility. The five-file checker above uses its own fixed test hashes; it cannot verify an arbitrary backup, database export or production file. Keep a trusted baseline for your actual task.

Why did .DS_Store appear after a Mac SFTP upload?

.DS_Store is Finder metadata, not proof of a damaged SFTP transfer. Folder browsing can create it before a client uploads the folder. A checksum pass for the five listed test files does not show that a directory has no extra files; our browser checker explicitly leaves other selected files unchecked.

Before publishing a website, inspect the exact staging directory with hidden files visible. Exclude only the metadata you have identified if your chosen transfer client supports that rule. Do not exclude every name beginning with a dot: required files such as .htaccess or .well-known may be needed, while secrets such as .env should not be in a public deployment at all. This is not a claim that Nexus Shell provides a metadata-exclusion feature.

Realmac's hosting team describes why publicly served .DS_Store files can reveal directory metadata. Have your hosting administrator verify access controls for the actual server. A matching payload hash does not verify public access rules, metadata privacy, interruption recovery or application permissions. Do not recursively delete hidden files or change server rules just to make a transfer test pass.

Read the checklist, package checksum and local validation results. The data is free to use; Nexus Shell SFTP requires Pro or an eligible trial. Once your actual task works, review website lifetime Pro.