Recent Version History

• Support SHA-256 fingerprints of TLS/SSL certificates. 1842
• When connecting to new SSH host, its host key can be automatically accepted in scripting and .NET assembly.
• Enabled TLS 1.3 by default.
• Alternative way to provide credentials in scripting/command-line without URL-encoding. 1821
• Suppress errors when opened/edited files are locked. 1832
• Support clearing GID/UID flag on directories with new versions of GNU coreutils. 1850
• Added /nointeractiveinput to usage screen.
• Clarified that WinSCP may crash in the warning message when trying to load too big file into the internal editor. 1847
• Do not prevent WinSCP from working when jump list cannot be updated. 1857
• IPv6 literals with scope or literals that are already escaped in square brackets are formatted standardly in session URL (instead of URL-encoding them).
• Allow turning off GSSAPI key exchange authentication. 1863

• Translations completed: Brazilian Portuguese; and updated: German and Russian.
• Bug fix: Failure when starting fresh installation on high DPI displays. 1862

• TLS/SSL core upgraded to OpenSSL 1.1.1g.
• WebDAV core upgraded to neon 0.31.1.
• Local file panel honors preferred drop action of source application. 1848
• Increased maximal length of proxy and tunnel credentials. 1849
• Truncating too long directory names in session tab title.
• Optionally do not distinguish multiple sessions opened to the same site by current path. 1734
• Bug fix: Failure when fallback SSH channel fails to open. 1845
• Bug fix: Failure when creating shortcut for jumplist fails. 1846
• Bug fix: Window position is not restored, if its left or top edge was aligned to monitor edge. 1852
• Bug fix: Wrong layout of Login dialog on monitors with low vertical resolution. 1463
• Bug fix: FTP file uploads are interrupting with TLS 1.3. 1834
• Bug fix: Empty directories are not uploaded to FTP server when transferring in background. 1859
• Bug fix: Percent sign (%) in PuTTY session settings (such as IPv6 scope syntax) is misinterpreted when importing. 1860
• Bug fix: Failure when starting with automatic workspace opening when none of the workspace sites exist. 1861

• TLS/SSL core upgraded to OpenSSL 1.1.1f.
• WebDAV core upgraded to neon 0.31.0.
• Installer upgraded to Inno Setup 6.0.4.
• Translation updated: French.
• Importing site-specific key files from FileZilla. 1841
• Showing session name in Synchronization checklist and Keep remote directory up to date windows, when the operation was executed in a new window/from a command line. 1838
• Session.ScanFingerprint now works even for Amazon S3 protocol.
• Bug fix: Failure after resuming system from sleep. 1829
• Bug fix: Option to disconnect a session was available even while deleting local files, and caused failure when selected while no session was actually opened. 1836
• Bug fix: Failure when primary SSH channel fails to open. 1837
• Bug fix: SHA-1 fingerprint of TLS/SSL certificate was incorrectly presented as MD5 by Session.ScanFingerprint.
• Bug fix: When dragging file via temporary directory it is deleted too early. 1844

• Disabling TLS 1.3 by default until it is better tested. 1835
• Bug fix: Cannot connect to SSH-1 servers. 1833
• Bug fix: TLS session resumption is not working for FTP transfers with TLS 1.3. 1831

• Bug fix: Confirmation to close WinSCP does not have a help page associated (to explain the workspace). 1825
• Bug fix: Failure when loading extension with filename containing some special characters (like a dash). 1826
• Bug fix: SCP fallback is no longer working. 1827
• Bug fix: Path on Address bar of Explorer interface cannot be submitted. 1828
• Bug fix: Cannot use TLS/SSL client certificate. 1830
• Bug fix: TLS/SSL client certificate could be configured for S3 protocol even though it is not supported.

• Optionally using Ctrl+F4 to close session tab. 1823

• New DigiCert EV code signing certificate valid until February 2023 is used for signing binaries.
• Ignoring incorrect timestamps in MDTM response, while autodetecting timezone difference. 1818
• Storage configuration on Preferences dialog handles INI files specified on a command-line better.
• Added an example for using Win32-OpenSSH ssh.exe as an SSH terminal. 1822
• It is possible to configure TLS 1.3 restrictions.
• Bug fix: Using directory exclude mask while searching caused all non excluded folder to be unintentionally included in the search results.
• Bug fix: It is not possible to recursively search for a folder. 1819

• When creating WinSCP shortcut, make it use the same configuration as the creating instance. 941
• Translation updated: French.

• .NET assembly functionality to process individual ComparisonDifference instances. 1802
• Convenience method Session.RemoveFile.
• Translations completed: Spanish and Korean.
• RemotePath.TranslateLocalPathToRemote and RemotePath.TranslateRemotePathToLocal can accept a directory source path equal to the source root path with a missing trailing slash.
• Custom commands keyboard shortcuts work on Synchronization checklist dialog.
• Enable queue processing/Once Done queue options should be disabled/triggered once all queued operations are completed, not only after the queue list is empty. 1815
• Added /bin/sh to the list of shells. 1814
• Ctrl+Left/Right/Back work better on Raw Site Settings dialog.
• Logging deletion of local source file.
• Bug fix: ComparisonDifference.IsDirectory was not set to true for directories.
• Bug fix: Cannot list WebDAV directory when any of the files is locked and the <depth> or <timeout> elements contain whitespaces around its contents. 1813
• Bug fix: Colored session icon does not display on high DPI. 1816
• Bug fix: Failure when starting synchronization when application task bar button is not fully working. 1817

• Bug fix: Version check did not work with five digit build number.

• Translations completed: Catalan, Czech, Dutch, Finnish, French, German, Hungarian, Icelandic, Italian, Japanese, Norwegian, Polish, Portuguese, Simplified Chinese, Slovak, Swedish, Traditional Chinese, Turkish and Ukrainian.
• New DigiCert code signing certificate used for signing binaries valid until February 2023.
• Not defaulting to Documents folder on a network drive. 1809
• Improvements to cleaning up application data:
  • Cleanup application data dialog shows only data that exist.
  • Uninstaller does not offer to delete application data, when there are not any.
  • The option to cleanup cached host keys cleans all other caches as well.
  • Bug fix: Cleaning up cached SSH host keys did not work.
  • Bug fix: Cleaning up configuration did not remove jumplist.
  • Bug fix: Running WinSCP for a maintenance task unintentionally creates a random seed file.
  • Bug fix: Failure when cleaning up sites from Login dialog.
• Bug fix: Failure when change in subfolder is detected while keeping remote directory up to date. 1807
• Bug fix: Failure when synchronizing directories after they were previously synchronized while being empty. 1808
• Bug fix: Name of the selected directory in tree is dark on dark background in dark mode. 1810

• Improvements to dark theme:
  • Dark theme for column headers. 1776
  • Toggling between light and dark interface theme is faster.
  • Bug fix: Failure when switching between light and dark interface themes. 1805
  • Bug fix: Disconnected remote panel background color does not reflect theme change.
• Looking for WinSCP.exe also in entry .NET assembly folder.
• Support for IBM z/OS Tape files. 1801
• Bug fix: Occasional hang when loading file icons. 1803
• Bug fix: Failure while closing application and suspending computer after operation completion. 1804

• Sorting find results. 902
• SSH core upgraded to PuTTY 0.73. It brings the following changes:
  • Security fix: On Windows, other applications were able to bind to the same TCP port as a WinSCP local port forwarding. vuln-win-exclusiveaddruse
  • Bug fix (possibly security-related): An SSH-1 server sending a disconnection message could cause an access to freed memory. ssh1-disconnect-use-after-free
• XML parser upgraded to Expat 2.2.9.
• Installer upgraded to Inno Setup 6.0.3:
  • Checkboxes displayed by lists now look better on high DPI systems.
• Allow configuring additional PuTTY settings (e.g. terminal settings) to be used when opening a session in PuTTY. 1798
• NuGet package updated to the latest format with an included icon and framework dependencies.
• Allow empty password authentication with FTP servers that prompt for empty passwords. 1796
• Bug fix: Edited path was hidden behind a browsing button on file/directory path selection boxes. 1791
• Bug fix: Start menu and Task bar icons are too small when installed from Microsoft Store. 1793
• Bug fix: After directory comparison before synchronization finishes, task bar button still shows a progress bar.
• Bug fix: Failure when authentication with keyboard interactive authentication with specified prompt title. 1794
• Bug fix: Stored password is not used for keyboard interactive authentication prompt with specified prompt title. 1795
• Bug fix: Settings with an empty default value were not listed in Add Raw Site Settings dialog.
• Bug fix: State of Allow agent forwarding checkbox was not updated when toggling Attempt authentication using Pageant.
• Bug fix: When starting private key upload from Advanced Site Settings dialog, changed settings were preserved even if the dialog was later canceled.
• Bug fix: SFTP only options were shown for SCP sites on Advanced Site Settings dialog.
• Bug fix: Master password prompt unintentionally appears when selecting site folder with a site with an encrypted password. 1799
• Bug fix: .NET assembly does not have a digital signature. 1800
• Bug fix: Corrected some help links.

• Improvements to sessions and workspace management, so that WinSCP can now easily restore tabs that were open when it was last closed:
  • Login dialog can be configured not to automatically pop up, when starting WinSCP and when closing the last session. 1771
  • When Login dialog is configured not to pop up automatically on start and workspace was saved in the previous run, the workspace is automatically restored when WinSCP starts.
  • A session can be disconnected, without closing its tab, and later reconnected.
  • Tabs of sessions opened with a workspace or a folder that fails to connect and tabs of all sessions that fail to reconnect are not closed.
  • Option “Keep main window open when the last session is closed” is enabled by default.
  • User is offered to save a workspace, even when only one session is opened.
• SSH core upgraded to PuTTY 0.72. It brings the following changes:
  • Major rewrite of the crypto code to remove cache and timing side channels.
  • Hardware-accelerated AES. 1769 cpu-crypto-accel
  • Support for GSSAPI key exchange. gss-key-exchange
  • Server and protocol information dialog now shows a more detailed information about the cipher in use.
• Extension Archive and Download to archive remote files and download the archive. 1773
• Improvements to Synchronization checklist window:
  • Estimating time to finish directory comparison before synchronization based on previous comparisons of the same folders.
  • Allowed opening the local or remote file from synchronization checklist in Windows Explorer or WinSCP, respectively. 1784
  • Hints for synchronization action icons on synchronization checklist window. 1786
• Command-line switch /browse to either force opening the main window when a file URL is specified or to explicitly select a specified file in both file panels.
• Convenience methods Session.PutFileToDirectory, Session.PutFilesToDirectory, Session.GetFileToDirectory and Session.GetFilesToDirectory.
• Selection of network interface for SSH and IPv4 using raw session setting SourceAddress. 416
• TLS/SSL core upgraded to OpenSSL 1.1.1d. It brings TLS 1.3 support among other changes.
• Installer upgraded to Inno Setup 6.0.2:
  • User can choose between installation for all users and the current user only.
  • Change: Silent installation needs additional /ALLUSERS or /CURRENTUSER switches.
  • Automatically creating appropriate type of desktop icon for respective install mode.
  • Modern style of the installer wizard.
  • Change: Installer does not support Windows XP/2003 anymore.
• Raw site settings editor.
• Copy (to clipboard) command in file context menu. 1758
• Automatically reconnecting when FTP data connection cannot be opened, if it previously worked. 1767
• Host key and certificate fingerprint verification improvements:
  • When verifying a host key using an expected fingerprint, it is possible to use an expected fingerprint with a checksum only (with both key type and bit count omitted).
  • When verifying a host key or a certificate using an expected fingerprint, the comparison is case-insensitive (with an exception of SHA-256 checksum).
  • When verifying a host key using an expected fingerprint, a padding (=) in SHA-256 checksum is not required.
  • Change: TLS/SSL certificate fingerprints in generated URL use dashes (-) instead of colons (:), while colons are still accepted.
  • Change: SHA-256 fingerprints in generated URL use dashes (-) and underscores (_) instead of pluses (+) and slashes (/), while pluses and slashes are still accepted.
• Support S3 servers with Path URI style (like MinIO). 1632
• S3 Default region can be configured on Advanced Site Settings dialog.
• Support for non standard ports with S3 protocol. 1780
• Not showing remote custom commands and local custom commands working with remote files in local file context menu.
• Custom command pattern !E preserves session name.
• Added SessionOptions.Name and SessionOptions.ToString (returning the .Name).
• Change: Removed option to create Quick Launch icons (Windows Vista and older only).
• Change: Consider size of linked file when transferring/synchronizing symbolic link. 1747
• Individual configuration storage sections can be set read-only.
• Switch /defaults accepts an optional delay in seconds to start the operation.
• Resolving local environment variables in initial session local path. 150
• Keep trying to save configuration for up to 2 seconds when INI file is locked by another process. 1775
• Change: RemoteFileInfo.FileType now consistently returns L for symlinks as was always documented. RemoteFileInfo.FileType now consistently returns uppercase value as was always documented.
• Configurable S3 root path/bucket in .NET assembly. 1778
• Indicating in an Internal editor that the file is new and preventing actions that does not make sense for non-existing files. 1752
• Persisting custom command toolbar buttons visibility. 1788
• Fallback to default ANSI encoding, when known_hosts file is not in UTF-8. 1789
• /passphrase command-line switch is now documented.
• When uploading file to a symbolic link with enabled remote recycle bin, the symbolic link is not moved to the recycle bin. 1759
• Speed box in Progress window responds to mouse wheel.
• Updates page of Preferences dialog replaced with simpler Statistics page for Store installations.
• Configurable console/terminal font. 1774
• Better error message when writing INI file fails. 1787
• Session.DisableVersionCheck will not be obsoleted. 1777
• When using a scripting console interactively, not warning about opening a session from a command-line or using a stored site.
• Allow turning off asynchronous loading of icons. 1783
• Using only extension/custom command name without any qualifiers in some contexts.
• Improved formatting of some messages.
• Small improvements of layout for longer translations.
• Bug fix: Failure when starting (local) custom command with no session opened.
• Bug fix: Errors while mass-modifying sites were displayed in message box instead of console window.
• Bug fix: When only encrypted session setting (like passwords) were changed during mass-modification, changes were not saved.
• Bug fix: It was not possible to mass-modify stored sites, when a master password was set.
• Bug fix: Directory changes cache is not case sensitive when resolving symbolic links. 1739
• Bug fix: Some cached SSH and TLS/SSL fingerprints were not preserved when exporting/importing the configuration.
• Bug fix: Validation of input boxes prevented cancelling dialogs using Cancel button. 1763
• Bug fix: It was not possible to overwrite remote file, when moving of overwritten files to remote recycle bin was configured, but the file could not be moved. 1766
• Bug fix: Files larger than 0.5 GB are never uploaded in ascii/text mode with SCP protocol as it would fail anyway due to memory issues. 1770
• Bug fix: Lower-than (<) and greater-than (>) symbols are not escaped in an output of RemotePath.EscapeFileMask .NET method and in a script generated by the GUI. 1781
• Bug fix: Error when reopening a remote file whose local temporary copy has been deleted. 1790

• TLS/SSL core upgraded to OpenSSL 1.0.2u.

• Temporarily using old DigiCert code signing certificate that does not trigger “Windows Defender SmartScreen prevented an unrecognized app from starting” warning. 1812
• Bug fix: Version check did not work with five digit build number (skipping 5.15.8 as a workaround).

• Translation completed: Russian.
• New DigiCert code signing certificate used for signing binaries valid until February 2023.
• Back-propagated fixes and changes from 5.16.1–5.16.2 releases:
  • Toggling between light and dark interface theme is faster.
  • Bug fix: .NET assembly does not have a digital signature. 1800
  • Bug fix: Corrected some help links.
  • Bug fix: Occasional hang when loading file icons. 1803
  • Bug fix: Failure while closing application and suspending computer after operation completion. 1804
  • Bug fix: Failure when switching between light and dark interface themes. 1805

• This is Microsoft Store-only release with the following fix:
  • Bug fix: Start menu and Task bar icons are too small when installed from Microsoft Store. 1793

• Back-propagated fixes and changes from 5.16–5.16.1 releases:
  • Security fix from PuTTY 0.73: On Windows, other applications were able to bind to the same TCP port as a WinSCP local port forwarding. vuln-win-exclusiveaddruse
  • XML parser upgraded to Expat 2.2.9.
  • Bug fix: Error when reopening a remote file whose local temporary copy has been deleted. 1790
  • Bug fix: Edited path was hidden behind a browsing button on file/directory path selection boxes. 1791
• SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.73.
• Installer translations updated: Czech, Dutch, German, Italian, Polish, Slovak and Turkish.

• TLS/SSL core upgraded to OpenSSL 1.0.2t.
• XML parser upgraded to Expat 2.2.8.
• Official extension Batch rename prints more information about its progress.
• Small improvements of layout for longer translations.
• Translation updated: Italian.
• Bug fix: Cannot switch back to English after changing language on non-US English system. 1779
• Bug fix: Deleting temporary local copy of remote file caused errors and invalid attempts to upload the nonexisting file. 1782

• Back-propagated SSH security fixes from PuTTY 0.72:
  • Integer underflow parsing SSH-1 packet length. vuln-ssh1-buffer-length-underflow
  • Buffer overflow in SSH-1 if server sends two tiny RSA keys. vuln-ssh1-short-rsa-keys
  • Windows Pageant client code does not check response length field. vuln-win-pageant-client-missing-length-check
• SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.72.
• Using recommended sizes of icons when installed from Microsoft Store. 1754
• XML parser upgraded to Expat 2.2.7.
• Translations updated: Hungarian, Simplified Chinese and Spanish.
• File panel incremental search can be disabled using raw configuration setting. 1742
• Retrying deleting fake temporary folder created when pasting remote files to Windows File Explorer. 1765
• Bug fix: With every start on a monitor with different DPI than the primary monitor, dimensions of the window and some of its components change slightly. 1750
• Bug fix: Speed limit does not work with S3 protocol. 1755
• Bug fix: Site folder loses names of its sites. 1756
• Bug fix: Compare Files extension cannot handle paths with spaces. 1760
• Bug fix: Local recycle bin is unintentionally scanned, slowing down browsing. 1761
• Bug fix: .NET assembly debug log file timestamps shows as GMT, while they are actually local times. 1762
• Bug fix: Cannot upload files over 50 GB to S3. 1764
• Bug fix: When using a local custom command from Synchronization checklist window, opened from a command-line, the connection was closed.
• Bug fix: When saving an edited site or default settings, WinSCP prompted for the master password, even when the site does not have any password to protect.
• Bug fix: When opening a connection from a command-line, which does not have a local directory set yet, local panel is opened empty.

• TLS/SSL core upgraded to OpenSSL 1.0.2s.
• SSH private key tools (PuTTYgen and Pageant) upgraded to latest development snapshot of PuTTY (2019-05-13.45be166). It brings the following change:
  • Bug fix: Crash when adding an ECDSA key to Pageant. pageant-ecdsa-assert-fail
  • Bug fix: RSA keys generated by PuTTYgen could be one bit too short. puttygen-keys-one-bit-short
• Translations updated: Dutch and Polish.
• Not scanning unvisited network folders to speed up start up and browsing. 1737
• Starting main window with the last user local folder instead of always starting in Documents folder. 1740
• When renaming an ad-hoc site, using a generated friendly name as a start.
• Bug fix: Some numerical folders are duplicated in remote directory tree. 1736
• Bug fix: Ad hoc site opened from a workspace showed its internal number a name instead of a friendly generated name.
• Bug fix: Failure in .NET assembly when ProgramFiles(x86) environment variable is not set and WinSCP executable cannot be found anywhere. 1741
• Bug fix: Keyboard accelerator for Octal box on Properties dialog does not work. 1743
• Bug fix: Failure when .NET assembly times out waiting for WinSCP to start. 1744
• Bug fix: Failure when shutting down Windows. 1746
• Bug fix: Two consecutive different file mask delimiters are processed incorrectly. 1745
• Bug fix: Failure when undocking toolbar on a system with multiple monitors with different DPI. 1748
• Bug fix: Failure after a session lost while in Console dialog is reconnected. 1749

Older versions