Cyberduck

Description

I switched to a MacBook in 2016 and immediately ran into a problem I hadn’t anticipated: WinSCP does not exist on macOS. This sounds like a minor thing. It was not. I had been using WinSCP for managing files on remote servers for five years. My entire workflow — connecting to staging environments, uploading deployments, editing config files, downloading backups — went through WinSCP’s two-panel interface. On my new Mac, I opened Terminal and typed scp and realized that I could do everything from the command line, but I did not want to do everything from the command line. I wanted to see my files. I wanted to drag things. I wanted to have the comfort of a GUI to see what was on the server without memorizing directory paths. Someone on a forum said “just use Cyberduck” and provided a link to a website with a rubber duck logo wearing sunglasses. I thought it was a joke. It was not a joke. It was the start of a nine year relationship with a piece of software named after a bath toy.

Cyberduck has been developed by David Kocher, a swiss developer, and was first released in 2003. Originally it was a Mac OS only FTP and SFTP client. Over the years it grew to support WebDAV, Amazon S3, Google Cloud Storage, Azure Blob, Backblaze B2, Dropbox, Google Drive, OneDrive, OpenStack Swift and what seems like every cloud storage protocol invented since the mid-2000s. The Windows version came out in 2011 and is functionally the same as the Mac version.

It is open source under the GPL meaning you can read every line of code on GitHub. It is also free to download from the website, though the Mac App Store version is $29.99 and the Windows Microsoft Store version is $9.99 — same software, you are just paying to support the developer and get automatic updates through the store. The donate page suggests $10, which given that I have been using this software almost daily for nine years makes me feel like I have been stealing from David Kocher’s kitchen.

The first thing that distinguishes Cyberduck from WinSCP and FileZilla is the interface philosophy. WinSCP and FileZilla have a two panel layout — local files on one side, remote files on the other. Cyberduck has a single-panel browser, such as Finder or Windows Explorer, that displays only the remote filesystem. You navigate directories, see files, and manage the remote server just like a local drive. Uploading refers to dragging files from your desktop or Finder to the Cyberduck window.

Downloading is dragging files out of Cyberduck onto your desktop. There is no local panel as Cyberduck uses your whole operating system as a local panel. This sounds like a small design choice but it fundamentally changes the way the application feels. WinSCP feels like a tool. Cyberduck is like an extension of your computer. The remote server is just another folder and after a while you cease to be aware that the files you are browsing are on a machine that is located in a data center in Frankfurt.

The bookmark system is where Cyberduck’s design sense is at its most obvious. Every connection you save is a bookmark that will be shown as a card in the main window — hostname, protocol, username, and a small icon. You can organize them, tag them with colors, drag them into folders, and import or export them as files.

That last part is critical. Unlike PuTTY, which hides saved sessions in the Windows Registry where they are invisible and impossible to transfer, Cyberduck saves bookmarks as separate XML files in a standard location. I have been able to copy my bookmarks over the years between three Macs and two Windows by moving a folder. No registry exports. No manual recreation. No losing everything when a system migration went wrong. When I set up a new machine my Cyberduck bookmarks are the first thing I transfer, and the whole process takes less than a minute.

Connection speed and transfer performance are good but not great. On a typical SFTP connection with a decent server, Cyberduck transfers files at about the speed that you would expect — roughly the speed of FileZilla, a little slower than WinSCP on Windows for bulk transfers of lots of small files. Where I have seen a real difference is for large files to cloud storage. Uploading a 2GB video file to S3 using Cyberduck uses multipart upload automatically, which splits the file into chunks and uploads them in parallel.

This is much faster than a single-stream upload and is done transparently — you drag the file, Cyberduck determines the best strategy. But the first connection to S3 buckets containing thousands of objects can be slow. I have a client with S3 bucket that has about 90k files and to load the root directory listing the first time it takes about eight seconds. Subsequent navigation is faster thanks to caching, but that first load always makes me wonder if something has gone wrong before that file list finally appears.

The cloud storage integration is indeed Cyberduck’s biggest selling point and the reason it carved itself a niche that is not occupied by pure FTP/SFTP clients. Most file transfer clients use cloud storage as an afterthought. Cyberduck considers it a first-class citizen. Connecting to an S3 bucket feels the same as connecting to an SFTP server — same interface, same drag and drop, same bookmark system. You can browse Google Cloud Storage buckets, manage Azure containers, traverse Backblaze B2 buckets, and access Dropbox and Google Drive as if they were remote servers.

For someone who works with multiple cloud providers – which in 2026 is almost everyone in tech – having one application that speaks all of these protocols with the same interface eliminates the need for five different vendor-specific tools or web consoles. I manage files in three S3 buckets, one Google Cloud Storage account and two SFTP servers, all from the same Cyberduck window with bookmarks lined up next to each other. Switching between them is clicking on a different bookmark. There is no context switch, no different login page, no different UI paradigm. Just files.

Cryptomator integration is something I didn’t think I would care about, and now can’t imagine living without. Cryptomator is an open-source encryption tool for the creation of encrypted vaults in cloud storage. Cyberduck has built-in Cryptomator support, which means that you can create an encrypted vault on Dropbox, Google Drive, S3 or any other supported backend, and Cyberduck will transparently encrypt files on upload and encrypt/decrypt files transparently on download. The files on the cloud provider’s servers are encrypted. The filenames are encrypted. The directory structure is encrypted.

The cloud provider can’t read your data, and neither can anyone who gets access to your account. I have set this up for a client who needed to store sensitive documents on Google Drive but did not trust Google with unencrypted access to client records. The set-up took fifteen minutes. The client drags files into Cyberduck and they appear encrypted on Drive and to retrieve them you need Cyberduck plus a passphrase. It is not a substitute for a dedicated encryption solution in a regulated industry, but for a small business wanting some encryption without a PhD in cryptography, it is elegant and practical.

The editor integration is similar to how WinSCP does it but with improved Mac OS integration. You can set any text editor as Cyberduck’s external editor — Sublime Text, VS Code, BBEdit, whatever you like. Double-clicking on a remote file downloads it to a temporary location, opens it in your editor and Cyberduck listens for changes. When you save in your editor, Cyberduck automatically uploads the changed file back to the server.

I use this with VS Code for quick edits to configuration files and the workflow is seamless. Edit, save, done — no re-uploading required. Where it occasionally hiccups is with editors that use “safe write” — writing to a temporary file first, then renaming — Cyberduck sometimes does not detect the change. VS Code has this behavior by default and I had to add an exception in the settings for Cyberduck’s temporary directory. A minor annoyance, but one which took me half an hour of confused Googling to figure out the first time it happened.

Now, the things that irritate me.

Cyberduck is slow to start. On my M2 MacBook Air, it takes around four seconds for the application to fully load and show me my bookmarks. On an older Intel Mac I still use occasionally it takes eight. Four seconds is not the end of the world, but when I need to grab a file from a server quickly, those four seconds are a personal insult after years and years of WinSCP taking under a second to open on Windows. The application is written in Java — well, technically it was rewritten using native frameworks for macOS and uses a combination of Java and C# on Windows — and the startup overhead reflects that. After it is running, performance is fine. But that first launch always reminds me that this is not a light weight tool despite the light weight look.

There is no two-panel mode. This is a deliberate design decision, not an oversight, and it is the single biggest reason some people try Cyberduck and go right back to FileZilla or WinSCP. If you want to see your local files and remote files side by side — if your mental model of file transfer requires you to see both endpoints simultaneously — Cyberduck will frustrate you. I adapted to the one panel approach within a week, but I know people who have used two-panel file managers for decades and physically cannot work without both panels visible. Cyberduck’s stance is that the other panel is the file manager of the operating system. This is philosophically consistent and practically divisive.

Bandwidth throttling and advanced transfer options are limited in comparison to dedicated FTP clients. FileZilla allows you to set speed limits, simultaneous transfer counts, transfer rules based on file types and to queue transfers with granular control. Cyberduck’s transfer queue is also present, but simpler — you can change the number of concurrent connections, but fine-grained throttling isn’t available via the GUI. For most users this is not important. For someone uploading to a server that has bandwidth limitations and needs to limit upload speed to 500 KB/s so that other services are not disrupted, Cyberduck does not provide that functionality natively.

The Windows version, although functionally the same as the Mac version, is a little less at home. The interface uses some custom rendering that is not quite native Windows conventions. Buttons are slightly different in appearance. The file browser does not feel like Explorer the way the Mac version does like Finder. It works perfectly well — I have a colleague who uses Cyberduck on Windows daily without complaint — but if you are coming from WinSCP, which despite its dated appearance feels deeply native to Windows, Cyberduck on Windows feels like a tourist. Comfortable, capable, but not of here.

Despite all these complaints, Cyberduck is the file transfer client I open the most. Not because it is the fastest. Not because it has the most features. Because it honors the way I think about files. A server is a place. Files live in that place. I want to go to that place, see what is there and move things between there and here. Cyberduck makes that interaction feel natural in a way that two-panel managers never did for me, no matter how efficient they were. It is the difference between surfing and operating. FileZilla and WinSCP are like working with machinery. Cyberduck is similar to browsing a folder.

David Kocher has been developing such software for more than twenty years. One developer. Open-source. Free to download. Named after a rubber duck. And somehow, against a field that includes enterprise-backed tools with entire teams behind them, Cyberduck is the most pleasant file transfer experience I have ever used. It is not the most powerful. It is not the fastest. But it is the one that I actually like to open, and in a category of software that most people consider a chore, is the only metric that matters.