Apps

The siftp apps are FTP, FTPS and SFTP clients for phones, tablets and computers. They connect to any standard server, not only siftp.

Platform	Download	Needs
Android	siftp-0.4.0-android.apk (31 MB, SHA-256)	Android 8.0 or later; phones and tablets
macOS	siftp-0.4.0-macos.dmg (11 MB, SHA-256)	macOS 15 or later; Apple silicon or Intel
iPhone and iPad	Coming to TestFlight	iOS and iPadOS 18 or later
Windows	Coming once code signing is set up	Windows 10 (1809) or later, x64 or arm64

Every download is signed. Nothing unsigned is published here.

What the apps do

Protocols:
SFTP with a password or an SSH key. The apps can make an Ed25519 key for you.
FTPS: explicit (AUTH TLS) and implicit.
Plain FTP, marked "not encrypted" wherever it appears.
Trust you can see:
First connection: an SFTP server's host key is shown with its fingerprint before you accept it.
Changed key: if the server's key changes later, the connection is refused.
Certificates: a TLS certificate your device does not trust is shown with its fingerprint, subject, issuer and the reason, and you can pin it for that server.
Transfers:
Files and whole folders, both ways.
Pause, resume and cancel.
Automatic retry that continues from where the file stopped.
A choice when a name already exists: replace, resume, keep both, or skip.
Files: browse, sort, make folders, rename, delete.
Log: a transcript of each connection, with passwords left out, for diagnosing a server.
Secrets: passwords and keys stay in the platform's secure storage (Keychain, Android Keystore, Windows credential locker), never in the apps' own files. The apps collect no data and have no analytics.

Check a download

macOS: the disk image is signed with SiteVue AI Inc.'s Developer ID and notarized by Apple, so it opens without warnings. To check it yourself:

shasum -a 256 -c siftp-0.4.0-macos.dmg.sha256
spctl -a -t open --context context:primary-signature -v siftp-0.4.0-macos.dmg

spctl must report source=Notarized Developer ID. After you copy the app to Applications, codesign -dv /Applications/siftp.app shows Authority=Developer ID Application: SiteVue AI Inc. (YL8YY72X95).

Android: the file's checksum, then the signing certificate. apksigner comes with the Android SDK build tools.

shasum -a 256 -c siftp-0.4.0-android.apk.sha256
apksigner verify --print-certs siftp-0.4.0-android.apk

The certificate must read CN=siftp, O=SiteVue, C=US, with this SHA-256 digest:

07:53:75:A8:D7:6F:43:91:13:FD:0E:04:78:2B:EF:C6:41:0F:E8:3C:42:EE:04:59:6E:B1:27:AD:2B:13:59:F8

Every later Android release is signed with the same key, so Android installs an update over the old version only when it comes from us.

To install the APK, allow your browser or file manager to install apps when Android asks, then open the file.

Source

The apps are in the siftp repository under app/: SwiftUI for macOS, iPhone and iPad, Jetpack Compose for Android, WinUI 3 for Windows, over one Rust core (crates/siftp-client). They are under the same licence as the server, MIT or Apache-2.0.