How to Set Up and Use Cyberduck FTP Client
Learn how to set up Cyberduck on Windows or macOS for FTP, FTPS, or SFTP. Enter cPanel credentials, upload and download files, save bookmarks, set permissions, and fix common connection problems.
Cyberduck
Cyberduck is a free client for Windows and macOS. It supports FTP, FTPS (explicit AUTH TLS), SFTP, WebDAV, and several cloud backends. Download it only from cyberduck.io.
Protocols
Prefer SFTP or FTP-SSL. Avoid plain FTP. FTP vs SFTP vs FTPS
Bookmarks
Save the site so you do not retype the host and user.
Install
- Download the macOS or Windows build from the official site.
- macOS: open the DMG and drag Cyberduck to Applications.
- Windows: run the installer and launch from the Start menu.
Open a connection
- Click Open Connection (⌘O / Ctrl+O).
- Protocol: FTP, FTP-SSL (Explicit AUTH TLS), or SFTP.
- Server: hostname or IP. Port 21 (FTP/FTPS) or 22 (SFTP) unless the host specifies another.
- Username: complete FTP user such as
user@yourdomain.com, or the SSH user for SFTP. - Password. Optional path such as
/public_html. Passive mode for FTP/FTPS. - Connect. Accept a certificate or host key only for a server you trust.
- Bookmark → New Bookmark to save it.
cPanel → FTP Accounts → Configure FTP Client can download a .duck file that opens Cyberduck already filled in. Extra FTP accounts still use FTP/FTPS, not SFTP. Create an FTP Account
Transfer files
SFTP needs SSH access and the SSH username. An extra cPanel FTP account does not automatically work on port 22. Using SFTP with cPanel
Troubleshooting
| Issue | What to try |
|---|---|
| Connection failures | Host, port, protocol, complete username. Passive mode. Connection troubleshooting |
| Certificate / host key prompt | Continue only if the server is yours. |
| SFTP login fails | Use the SSH account, not an extra FTP user. |
Frequently Asked Questions
Does Cyberduck work on both Windows and macOS?
Yes. Cyberduck is a free client for Windows and macOS with the same bookmark-style browser on both. It is not a Linux desktop app. If you also need Linux, use FileZilla. Download Cyberduck only from cyberduck.io or the official store listing so you avoid third-party installers. A wider client comparison is in choosing an FTP client.
How do I save a cPanel site as a Cyberduck bookmark?
Open Connection, choose FTP-SSL (Explicit AUTH TLS) for an extra FTP account or SFTP when SSH is enabled. Enter the hostname, complete username such as user@yourdomain.com, password, and port. Set the path to public_html if you want that folder first. Then use Bookmark → New Bookmark so the next launch skips the form. Create the login with an FTP account in cPanel.
What is the Cyberduck file from Configure FTP Client?
cPanel can offer a .duck configuration file for that FTP user. Download it from Files → FTP Accounts → Configure FTP Client, then open the file. Cyberduck should fill in the host, username, and protocol. Still check that the protocol is FTPS or SFTP rather than plain FTP, and that the remote path is the document root you expect. Test a small upload before you move the whole site.
Can an extra cPanel FTP account use SFTP in Cyberduck?
Usually no. Extra accounts are for FTP or explicit FTPS on port 21. SFTP needs SSH and typically the primary cPanel username on port 22. If SFTP fails with the extra login, edit the bookmark to FTP-SSL (Explicit AUTH TLS). Details are in FTP vs SFTP vs FTPS and using SFTP with cPanel.
Why does Cyberduck look different from FileZilla?
Cyberduck uses a single-pane browser and bookmarks instead of a permanent dual-pane queue window. That is handy if you also open Amazon S3, Google Drive, or Dropbox in the same app. FileZilla is better when you want local files on the left and the server on the right all the time. For a two-pane Windows workflow you may prefer FileZilla or WinSCP. See FileZilla setup.
Should I store Cyberduck passwords in Keychain?
Yes on a computer only you use. On a Mac, Add to Keychain keeps the FTP or SFTP password out of a sticky note. On Windows, save the password only on a private profile. Do not store credentials on a shared PC. Prefer an SSH key for SFTP when the host allows it, and delete the bookmark if you give the machine away. Related reading is on the blog index.
Should I accept Cyberduck’s unknown certificate warning?
Continue only when the hostname matches the server your host listed. FTPS certificates are often issued for the server name, not your domain, which can trigger the prompt. Read the certificate details first. If the warning appears later on a bookmark you already trust, stop and confirm the address. Use the hostname from cPanel rather than guessing ftp.yourdomain.com. Encryption terms are in encryption basics.
Can I use Cyberduck for both website files and cloud storage?
Yes. Bookmarks can point at cPanel over FTPS or SFTP and at services such as Amazon S3 or Google Drive. Keep website files and cloud backups as separate bookmarks so you do not drop a theme into the wrong place. For the hosting side, upload into public_html or the addon domain’s document root. A short primer is what FTP is used for.
FTP Tutorials and How-To Guides
Tweet Share Pin Email
Add Comment
This policy contains information about your privacy. By posting, you are declaring that you understand this policy:
- Your name, rating, website address, town, country, state and comment will be publicly displayed if entered.
- Aside from the data entered into these form fields, other stored data about your comment will include:
- Your IP address (not displayed)
- The time/date of your submission (displayed)
- Your email address will not be shared. It is collected for only two reasons:
- Administrative purposes, should a need to contact you arise.
- To inform you of new comments, should you subscribe to receive notifications.
- A cookie may be set on your computer. This is used to remember your inputs. It will expire by itself.
This policy is subject to change at any time and without notice.
These terms and conditions contain rules about posting comments. By submitting a comment, you agree with these rules:
- Although the administrator will attempt to moderate comments, not all comments can be moderated at all times.
- You acknowledge that all comments express the opinions of the original author and not those of the administrator.
- You will not post material which is knowingly false, obscene, hateful, threatening, harassing or invasive of privacy.
- The administrator has the right to edit, move or remove any comment for any reason and without notice.
Failure to comply with these rules may result in being banned from submitting further comments.
These terms and conditions are subject to change at any time and without notice.
What is Phishing and How To Protect Yourself
Ultimate Guide for The Best Ruby on Rails Resources
SEO or SMO - Which is Best for Marketing
What Is SSL - What Is SSH
Comments