Why Chromium Retired Its Built-In FTP Protocol Support

The Chromium project officially retired its built-in File Transfer Protocol (FTP) implementation in early 2021, ending decades of legacy web support. This decision was driven by three primary factors: the inherent security vulnerabilities of the aging protocol, vanishingly low usage metrics among everyday internet users, and the high maintenance burden required to keep legacy code secure. By removing FTP, Chromium reduced its browser attack surface, pushed the web further toward universal encryption, and offloaded specialized file transfers to dedicated third-party applications.

Severe Security Vulnerabilities

The primary reason for retiring FTP in the browser is that the protocol is fundamentally insecure by design. Created in the 1970s, standard FTP does not support encryption.

When a user connects to an FTP server through a browser, all data—including usernames, passwords, and the files themselves—is transmitted in cleartext. This makes the connection highly susceptible to man-in-the-middle (MitM) attacks, allowing anyone on the same network to intercept, read, or modify the transferred files. As the modern web transitioned toward an "HTTPS everywhere" standard, maintaining a completely unencrypted protocol inside a web browser contradicted core security principles.

Lack of Encrypted FTP Support

While secure versions of the protocol exist, such as FTPS (FTP Secure) and SFTP (SSH File Transfer Protocol), the Chromium team chose not to implement them. Instead of investing significant engineering resources to build support for FTPS or SFTP into the browser, the team recognized that HTTPS already solved the problem of secure file distribution on the web. Implementing new, complex protocol handlers for a shrinking user base was deemed unnecessary.

Abysmally Low Usage

Before deprecating a feature, the Chromium team relies heavily on telemetry data to measure how many people actually use it. Prior to the removal of FTP, Google reported that usage had dropped to an infinitesimal fraction of overall web traffic—less than 0.002% of users accessed FTP links. Because virtually the entire consumer internet had already migrated to HTTP and HTTPS for file downloads, removing FTP impacted almost no regular browser users.

Reducing the Browser Attack Surface

Every line of code in a web browser is a potential target for malicious hackers. Chromium’s FTP implementation consisted of very old legacy code that was rarely updated. Maintaining this code required ongoing security audits and bug fixes to ensure that a maliciously configured FTP server could not exploit the browser and compromise the user's operating system. By deleting the FTP codebase entirely, Chromium engineers permanently eliminated a potential vector for zero-day exploits and freed up resources to focus on modern web standards.

Superior Dedicated Alternatives

Web browsers were only ever capable of basic FTP directory listing and file downloading; they were never robust FTP clients. When Chromium removed built-in support, it transitioned to passing ftp:// links directly to the host operating system. Users who still rely on FTP for server management or legacy archival access are now prompted to open these links in dedicated third-party applications like FileZilla, Cyberduck, or WinSCP. These specialized programs are actively maintained, offer vastly superior interfaces for file transfers, and fully support secure protocols like SFTP and FTPS.