Automating file transfers

open sftp://[email protected]/ -hostkey="ssh-ed25519 255 SHA256:verified-fingerprint"
lcd C:\Projects\site
cd /var/www/html
put index.html
exit

The situation

The same upload or comparison happens often enough that clicking is the risky part. You want a command that stops when something is wrong.

Prerequisites

• A working window session The remote path is already correct.
• A verified fingerprint Host key, or TLS certificate. Copy it after you trust it, not as a way to skip the check.
• UTF-8 Or UTF-16 with a byte order mark. That is what the console expects.

People already writing .NET code can use the documented assembly. Session.SynchronizeDirectories maps to synchronize. This page stays with the script file.

Write and test a script

1. One file first open, lcd, cd, put or get, exit.
2. Console winscp.com /ini=nul /script=transfer.txt /log=transfer.log from an existing window so errors stay on screen.
3. Read the log Check the path and the size before you add more files.
4. Preview a sync synchronize remote -preview does not transfer. Add -delete only to remove remote files that are absent locally. It is ignored for both.
5. Schedule later The task’s account and starting directory are a common reason a desktop script fails at night.

/script and /command imply batch mode, so overwrite questions are off. A failed command stops the script.

Example script

The console above is the example. Replace the host, the user, the fingerprint, and the paths. The URL syntax has a place for a password. Leave it empty. A script that contains one will leak it to anyone who can read the file or the scheduled task.

Expected result

The console exits without an error. The log shows open, the directory change, and the transfer. index.html on the server matches the local size. A preview run changes nothing. Use winscp.com from Command Prompt or PowerShell. winscp.exe can open a console that closes before you read it.

Common mistakes

• Putting the password in the file, then pasting the file into a ticket.
• Accepting any host key so the script can run unattended.
• Scheduling synchronize remote -delete against the wrong path.
• Saving the script in an encoding the console misreads.

Security

The durable pattern is a private key plus -hostkey set to the fingerprint you verified. A key with no passphrase can be used by anyone who copies the file. The documentation allows that only as a special case. For FTPS, -certificate pins the certificate you expect. Do not drop to plain FTP to avoid that line.

Troubleshooting

If no log appears, the program failed before the session. Read the console. Relative paths in a scheduled task resolve against the task’s starting directory. /loglevel=* can record the password. Leave it off if the log might be shared. A normal /log is enough.

Related resources

• Directory synchronizationDirection and preview, before they go in a file.
• SSH authentication and keysA key the script can use without a password in the file.
• Common connection problemsHow to read a log without publishing secrets.
• Product documentation (opens winscp.net in a new tab)winscp.netLabels follow the public documentation reviewed on October 21, 2026. Use Help on a dialog if a name differs.

Winsaip is an independent educational resource and is not affiliated with or endorsed by the developers of WinSCP.