Linux File Transfer Tools: CLI and Browser-Based Options

On Linux, the best file transfer tool depends on whether you're moving files between your own machines (rsync, scp, sftp) or sending to someone outside your control (browser-based services like HexaTransfer). For server-to-server bulk copies, rsync -avP --partial is the workhorse. For ad-hoc delivery to a non-technical recipient, a URL from a browser-based service beats asking them to install an SSH client. Linux desktop environments (GNOME, KDE) also support SMB, WebDAV, and SFTP browsing natively through the file manager.

The CLI classics

scp — secure copy over SSH. Dead simple:

scp bigfile.tar.gz user@server:/home/user/
scp -r folder/ user@server:/path/

No resume on failure. Fine for reliable networks, annoying on flaky ones. OpenSSH 9.0 (2022) switched the default protocol from SCP-over-SSH to SFTP — behaviour is similar but edge cases differ.

rsync — incremental sync with resume:

rsync -avP --partial source/ user@server:/dest/

Flags: -a archive mode (preserves perms, times, symlinks), -v verbose, -P progress + --partial (keeps partial file on failure). --bwlimit=50000 caps bandwidth at 50 MB/s if you're on a shared link.

For identical source and destination roots, rsync only transfers changed bytes on subsequent runs — huge time saver on repeated transfers.

sftp — interactive SSH-based file transfer. Use it like an old FTP client:

sftp user@server
> put bigfile.tar.gz
> get somefile.txt

rclone — like rsync but for cloud providers. Supports S3, Google Drive, Dropbox, OneDrive, Backblaze B2, and dozens more. Great for scripted uploads to object storage:

rclone copy local/folder remote:bucket/path -P

Browser-based options for non-technical recipients

Not every file recipient has SSH keys. For sending to journalists, clients, or family members, a transfer service URL is what works:

| Service | Max free | Encryption | Linux-friendly | |---|---|---|---| | HexaTransfer | 10 GB | End-to-end AES-256-GCM | Yes (any browser) | | WeTransfer | 2 GB | TLS | Yes | | SwissTransfer | 50 GB | TLS | Yes | | Proton Drive Share | 1 GB | End-to-end | Yes | | Tresorit Send | 5 GB | End-to-end | Yes |

Firefox and Chromium on Linux both handle large uploads competently. Upload performance usually matches the hardware and uplink, not the browser.

Same-network tools from the desktop

GNOME Files (Nautilus): Connect to Server > smb://, sftp://, ftp://, dav://. Mounts the remote as if it were local. Good for occasional browsing.

KDE Dolphin: same capability, slightly different UX. Supports the same protocols.

smbclient — command-line SMB for scripts:

smbclient //server/share -U user

sshfs — mount a remote filesystem over SSH:

sshfs user@server:/remote/path ~/mnt/remote

Useful when an app expects a local path.

Transfer speed tuning on Linux

Linux's default TCP window scaling handles high-bandwidth transfers well, but some distros ship conservative settings. For transfers over long-distance links (high latency, high bandwidth):

sysctl -w net.core.rmem_max=16777216
sysctl -w net.core.wmem_max=16777216
sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"
sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"

Enable BBR congestion control for better throughput on lossy links:

sysctl -w net.ipv4.tcp_congestion_control=bbr

These aren't needed on ordinary home networks — but if you're moving data between datacentres or across continents, the difference between default CUBIC and BBR can be 2-3x.

Archiving: tar variants

tar -czf archive.tar.gz folder/          # gzip, fast, moderate compression
tar -cjf archive.tar.bz2 folder/         # bzip2, slower, better compression
tar -cJf archive.tar.xz folder/          # xz, slowest, best compression
tar --use-compress-program=zstd -cf archive.tar.zst folder/   # zstd, fast and good ratio

For modern Linux, zstd beats gzip in both speed and compression ratio. For distributing to non-Linux recipients, stick with .zip — use zip -r archive.zip folder/.

To split a huge archive into chunks:

tar -czf - folder/ | split -b 2G - archive.tar.gz.part_

Reassemble with cat archive.tar.gz.part_* | tar -xzf -.

Object storage as a transfer medium

For workloads that generate many files or huge files, treating a cloud bucket as the transfer layer is cleaner than a one-shot service:

AWS S3: aws s3 cp file s3://bucket/path then generate a presigned URL with aws s3 presign s3://bucket/path --expires-in 3600. Recipient gets a time-limited direct download.

Cloudflare R2: S3-compatible API, no egress fees. Use the same aws CLI with a custom endpoint.

Backblaze B2: b2 upload-file bucket file key then b2 get-download-url-with-auth bucket key 3600.

MinIO: self-host an S3-compatible server, issue presigned URLs from your own domain.

For developers sending build artefacts, logs, or dumps, these are better than a general-purpose transfer service.

Ad-hoc HTTP servers

For same-LAN quick transfers:

python3 -m http.server 8000

Serves the current directory at http://your-ip:8000/. The recipient hits the URL, downloads. Useful between your laptop and a VM or phone on the same Wi-Fi. Not encrypted — fine for internal, not for external.

For HTTPS with a self-signed cert:

python3 -c "import http.server, ssl; httpd = http.server.HTTPServer(('0.0.0.0', 8443), http.server.SimpleHTTPRequestHandler); httpd.socket = ssl.wrap_socket(httpd.socket, certfile='cert.pem', server_side=True); httpd.serve_forever()"

caddy file-server does this cleanly with automatic HTTPS if you have a real domain.

P2P tools

Magic Wormhole (wormhole):

wormhole send bigfile.tar.gz
# prints a code like 7-crossover-clockwork
# recipient runs: wormhole receive 7-crossover-clockwork

End-to-end encrypted, works across NATs via a rendezvous server. Great for one-shot direct transfers.

croc (from schollz): similar to wormhole, single binary, cross-platform. Popular in the homelab community.

These are peer-to-peer but still route through rendezvous servers for NAT traversal — the encryption is E2E, the path is not direct.

Encryption at rest before upload

For extra paranoid workflows, encrypt the archive before sending it through any service:

gpg --symmetric --cipher-algo AES256 bigfile.tar.gz

Produces bigfile.tar.gz.gpg. Recipient decrypts with gpg --decrypt. Share the passphrase out-of-band.

Or use age, a modern alternative:

age -p -o encrypted.age plaintext.tar.gz

With E2E encrypted transfer services like HexaTransfer, this double-wrap is usually unnecessary — but for nation-state threat models, belt and braces makes sense.

Try it at hexatransfer.com — works from any Linux browser, 10 GB free, end-to-end encrypted, no client to install.