SCP Command: Securely Copy Files Over SSH (Examples and Cheatsheet)

SCP (secure copy) copies files between machines over an encrypted SSH connection. If you can SSH into a server, you can SCP files to and from it — no FTP client, no extra setup. This guide is a practical, example-driven reference: copying files and folders, using a specific key or port, and the gotchas that trip people up.

The basic syntax

Every scp command follows the same shape — source first, destination second, exactly like cp:

scp [options] SOURCE DESTINATION

A remote location is written as user@host:/path. The colon is what tells scp the path is on another machine. Here is the simplest real example — uploading a local file to your home directory on a server:

scp ./test.txt [email protected]:~/

This copies test.txt from your current directory to the home directory (~/) of the ubuntu user on the server at that IP.

How SCP works (and how it differs from FTP and SFTP)

SCP is not a separate protocol you have to install or configure — it runs on top of SSH. When you run an scp command, it opens an ordinary SSH connection to the remote host, authenticates exactly the way ssh does (with your key or password), and streams the file over that encrypted channel. That’s why the rule of thumb is simple: if you can ssh into a machine, you can scp to and from it, using the same credentials, the same port, and the same ~/.ssh/config entries.

It helps to know the neighbours. Plain FTP sends your files and password in clear text and should be avoided. SFTP also runs over SSH and is interactive — you get a prompt where you can cd, ls, put, and get — which is handy for browsing a remote filesystem. SCP is the one-shot, scriptable option: a single command, no interactive session, ideal for deploy scripts and CI pipelines. For everyday “push this file up” or “pull that log down,” SCP is the quickest tool that’s still fully encrypted.

Upload vs download — just swap the order

Copy a whole folder with -r

To copy a directory and everything inside it, add the recursive flag -r:

scp -r ./dist user@host:/var/www/myapp/

This uploads the local dist folder (a built frontend, for example) into /var/www/myapp/ on the server.

Copy several files at once

You can list multiple sources in one command, and shell wildcards work just like they do with cp. To upload every .sql file in the current directory:

scp ./*.sql user@host:/backups/

# or name them explicitly
scp app.env nginx.conf docker-compose.yml user@host:/srv/app/

When the destination is a directory, every source file is dropped inside it. If you want to preserve each file’s original timestamps and permission bits during the copy, add the lowercase -p flag (don’t confuse it with the uppercase -P used for the port).

Using a specific SSH key

If you log in with a key (you should — see our guide on generating an SSH key), point scp at it with -i:

scp -i ~/.ssh/deploy_key ./test.txt [email protected]:~/

The key from ~/.ssh/deploy_key is used to authenticate. If you’ve set up a ~/.ssh/config entry with an IdentityFile, you don’t even need -i — scp reads the same config as ssh.

Non-standard SSH port

Many hosts run SSH on a port other than 22 (shared hosts often use ports like 2222 or 65002). With scp the port flag is a capital -P (note: ssh uses lowercase -p — a classic source of confusion):

scp -P 2222 ./test.txt user@host:~/

Useful options

A note on scp vs rsync

scp is perfect for one-off transfers. But if you deploy repeatedly, rsync (which also runs over SSH) only transfers the files that changed, making subsequent uploads dramatically faster:

rsync -avz -e "ssh -i ~/.ssh/deploy_key -p 2222" ./dist/ user@host:/var/www/myapp/

For repeatable deployments to a server, reach for rsync; for grabbing a single log file or pushing one config, scp is simpler.

Practical tips and security notes

• Prefer keys over passwords. Using a key (with -i or a config entry) is both more secure and required for unattended transfers in scripts and CI, where there’s no one to type a password.
• Mind absolute vs relative paths. A remote path that starts with / is absolute; otherwise it’s relative to the remote user’s home directory. user@host:logs and user@host:/var/logs are very different places.
• Quote paths with spaces. Remote paths are expanded by the remote shell, so wrap awkward paths in quotes: scp file "user@host:/srv/my app/".
• SCP won’t create parent folders. The destination directory must already exist; otherwise you’ll get a “No such file or directory” error.
• Verify large transfers. For important files, compare a checksum on both ends — for example run sha256sum file locally and on the server — to confirm the copy is byte-for-byte identical.
• Beware overwrites. Like cp, SCP silently overwrites an existing file at the destination with the same name. Double-check the target path before copying.

Troubleshooting

• “Permission denied (publickey).” Your key isn’t installed on the server, or you pointed at the wrong one. Confirm SSH login works first: ssh -i KEY user@host.
• “No such file or directory” on the destination. The target folder doesn’t exist — SCP won’t create parent directories. Create it first, or copy into a path that exists.
• Connection refused / timeout. Wrong port. Add -P <port> for your host.
• Wrong port flag. Remember: scp uses -P (capital), ssh uses -p (lowercase).

Frequently asked questions

How do I copy a file to a remote server with SCP?

Run scp ./file.txt user@host:~/. Source comes first, destination second, and the remote path is written as user@host:/path.

How do I copy an entire directory with SCP?

Add the -r (recursive) flag: scp -r ./folder user@host:/dest/.

How do I use SCP with a different port?

Use a capital -P: scp -P 2222 ./file user@host:~/. Unlike ssh, which uses a lowercase -p, SCP’s port flag is uppercase.

SCP or rsync — which should I use?

Use SCP for one-off transfers. Use rsync for repeated deployments, because it only transfers changed files and is much faster on subsequent runs.