Recent Version History

• Experimental 64-bit version of WinSCP. bug>618
• Optionally not showing error message when connection is lost while idle. bug>2360
• SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.84.
  It brings the following change:
  • Security issue: fixed a remotely triggerable double-free in RSA key exchange. pbug>rsakex-double-free
  • Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. pbug>ecdsa-remotely-triggerable-assertion
  • Bug fix: spurious "Network error: Socket is not connected" when authenticating to some HTTP proxies. pbug>http-proxy-auth-wsaenotconn
• TLS/SSL core upgraded to OpenSSL 3.5.7.
• XML parser upgraded to Expat 2.8.1.
• Restored faster C TLS/SSL AES implementation.
• Configurable warning when opening large file in an internal editor. bug>2437
• Informing that when preserving directory timestamps is enabled, using multiple connections for transfer is not possible. bug>2439
• Warning when pasting a session URL with unsafe settings.
• When opening session in PuTTY to a host for which WinSCP has multiple host keys cached, using the last key or the key that PuTTY has cached. bug>2440
• Always (re)registering drag&drop shell extension during installation, even when the extension is not replaced.
• Allowed Console interface tool to have ''.exe'' extension to avoid false positive detections by some antiviruses. bug>2434
• Using "username" and "hostname" as one word.
• Reading all system settings from 64-bit registry.
• Allow assigning ''null'' to ''Session.SessionLogPath''. bug>2438
• Avoiding using ''SSH_FXF_EXCL'' together with ''SSH_FXF_TRUNC'' SFTP file opening flags. bug>2444
• Optimized file system monitoring when looking for dummy directory during drag&drop downloads. bug>2445
• Bug fix: Failure when trying to connect via HTTP proxy to FTP host with excessively long login details. bug>2435
• Bug fix: Buffer overflow in Console interface tool. bug>2436
• Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. bug>2441
• Bug fix: Message boxes from secondary windows (like the internal editor) caused application to move to the background when when the main window was minimized. bug>2443

• Support for OpenSSH ssh-agent. bug>1682
• Optionally connecting all workspace/folder sessions immediately. bug>1026
• Preserving panel scroll position after rename. bug>2425
• ''Ctrl+C'' works in list views on 'Server and protocol information' dialog.
• Preventing moving or copying a file or folder over ancestor folder with the same name. bug>2427
• WebDAV/HTTP core upgraded to neon 0.37.1.
• XML parser upgraded to Expat 2.7.5.
• Bug fix: Some menus were not working on displays to the left or above the primary display. bug>2423
• Bug fix: Mouse wheel downwards scrolling did not work on toolbar drop down lists.
• Bug fix: Once any control of permissions popup box was focused the popup no longer closed when user clicked outside of it.
• Bug fix: Failure when closing Transfer settings dialog with X button while a permissions popup box control is focused. bug>2420
• Bug fix: Failure when switching to a session that is being reconnected.
• Bug fix: Failure when the first bit of an SFTP response is set. bug>2422
• Bug fix: Copying to clipboard with ''Ctrl+C'' from 'Server and protocol information' was broken.
• Bug fix: Protocol additional information scrolling was broken.
• Bug fix: Master password dialog was missing Help button.
• Bug fix: Checking if edited/opened file was modified externally didn't work for inactive sessions. bug>2426
• Bug fix: Wrapped settings values from Raw Site Settings dialog were not preserved.
• Bug fix: Some files modified by local custom command in SCP session fail to upload back. bug>2428
• Bug fix: Whole Key exchange page was incorrectly hidden when "Handles SSH key re-exchange badly" bug was enabled.
• Bug fix: Some message boxes leak GDI handle. bug>2430
• Bug fix: Login dialog leaks GDI handles. bug>2431

• Synchronize two local directories. bug>2020
• Compiler upgraded to Clang/bcc32c. bug>618
• Inactive sessions can be automatically reconnected. bug>2232
• Added dark theme support to: bug>1696
  • Login dialog. bug>2345
  • Transfer Options dialog.
  • Message boxes.
  • Queue column headers. bug>2356
  • Progress window.
  • Authentication Progress window. bug>2358
  • Bug fix: Scrollbar colors did not always reflect the color theme
• Using modern directory selection dialog that scales correctly and allows creating new directory. bug>2373 bug>2389
• Optimized GUI when working with large subdirectory selection. bug>2396
• Change: Default to UTF-8 encoding in internal editor. bug>2397
• New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries.
• TLS/SSL core upgraded to OpenSSL 3.5.5.
• WebDAV/HTTP core upgraded to neon 0.36.0.
• XML parser upgraded to Expat 2.7.4.
• Installer upgraded to Inno Setup 6.7.0 with dark mode support enabled.
• Increased WinSCP memory limit to 4 GB. bug>2412
• Defined and implemented interface for the .NET library. By @mjkent. bug>856
• Optimized TLS/SSL AES implementation.
• Restoring ability to restart Explorer to allow upgrade of drag&drop shell extension, when installing for current user, as after-restart replacement is not possible without Administrator privileges. bug>2381
• MSI toolset updated to WiX 5.
• Commands to copy paths to the clipboard on the Synchronization checklist window.
• Cryptography optimization.
• Support long AWS/S3 session tokens. bug>2403
• Prevent hang when new device is attached or removed while some mapped network drive is not available. bug>2382
• Copy and paste improvements:
  • Consistently renaming local files dropped or pasted back to their source directory to avoid collisions.
  • Bug fix: When copying local files to clipboard from system context menu, "cut" state of previously cut files was not cleared.
• Not redundantly verifying WebDAV or S3 certificate in Windows Certificate store if it is already marked as trusted in session settings. bug>2404
• Provide SNI when opening FTP data connection. bug>2410
• Optimized synchronization checklist sorting.
• Support for Beyond Compare 5 in Compare Files extension. bug>2417
• Convert unsupported SSH proxy to SSH tunnel when importing site from PuTTY. bug>2408
• FTP directory listing falls back to the other active/passive mode, consistently with file transfers.
• Consistently calling command to open window with specific directory Explore, instead of sometimes Browse.
• Consistently referring to file last modification timestamp column as Date modified.
• With INI file provided on command-line, using the same INI file when starting a new instance.
• Windows shell local file copy status window is centered on the main window.
• Made taskbar flashing configurable in GUI. bug>2411
• Control labels on transfer settings dialogs do not show keyboard accelerator cue, until ''Alt'' key is pressed.
• Not using drag images even with directory trees. bug>1274
• Allow configuring checksum commands. bug>2394
• Updated to JCL library 2.8.1.
• Updating jump list only when running with GUI.
• Made space on permissions box for longer translations. bug>2398
• Opening Default Apps Settings page directly to open it in the foreground and avoid flashing Control Panel window.
• Improving order in which Windows Narrator reads window controls.
• All edit boxes with history consistently do not auto complete and show 16 entries in the drop down.
• Removed obsolete Preserve remote timestamp session settings.
• Bug fix: Local file with invalid characters replaced could not be explored from the Synchronization checklist window.
• Bug fix: Files modified by local custom command are not always uploaded to the correct remote directory. bug>2370
• Bug fix: List of network drives in drive drop down and directory tree did not always match.
• Bug fix: Host key prompt did not have the default button.
• Bug fix: When the local path specified on Open directory/Location profile dialog is not existing, when browsing for a new path, the trailing part of the nonexisting path was appended to the new path.
• Bug fix: Trying to enter an invalid link in local panel fails silently.
• Bug fix: After FTP data connection fails to open further use of the session is broken.
• Bug fix: Pasting cut files from the clipboard into a local panel copies them instead of moving them. bug>2400
• Bug fix: Some edits did not save their value to history when submitting with ''Enter''.
• Bug fix: Too long edit history dropdown can overflow monitor bounds. bug>2432
• Bug fix: Message box texts and some control labels are not visible to screen readers. bug>2413
• Bug fix: Failure when clicking tab close button while the session is already being closed. bug>2416

• Translations completed: Croatian, Finnish, Georgian, Italian and Serbian.
• TLS/SSL core upgraded to OpenSSL 3.3.7.
• Back-propagated fix from 6.6.2 beta release:
  • Bug fix: Failure setting ''Session.DebugLogPath'' when running in impersonated context. bug>2441
  • Security issue: fixed a remotely triggerable double-free in RSA key exchange. pbug>rsakex-double-free
  • Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. pbug>ecdsa-remotely-triggerable-assertion

• Translations completed: Macedonian, and updated: Lithuanian, and Russian.
• TLS/SSL core upgraded to OpenSSL 3.3.6.
• Back-propagated improvements from 6.6–6.6.1 beta release:
  • New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries.
  • XML parser upgraded to Expat 2.7.5.
  • Support for Beyond Compare 5 in Compare Files extension. bug>2417
  • Bug fix: Checking if edited/opened file was modified externally didn't work for inactive sessions. bug>2426

• Translation updated: Vietnamese.
• Bug fix: Pasting files using local directory tree context menu pastes them to the current directory, instead of the selected one.
• Bug fix: Failure when opening site imported from PuTTY with unsupported SSH proxy. bug>2407
• Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. bug>2409

• Translations updated: Belarusian and Georgian.
• TLS/SSL core upgraded to OpenSSL 3.3.5.
• XML parser upgraded to Expat 2.7.3.
• Added new ''ap-southeast-6'' AWS region.
• Bug fix: When restored after operation completed while minimized the window is disabled. bug>2393
• Bug fix: Command ''md5sums'' is incorrectly used to calculate MD5 checksum instead of ''md5sum''. bug>2392
• Bug fix: Incomplete FTP upload when the source stream/stdin reads less than requested. bug>2395
• Bug fix: ''Shift''-clicking OK button on Synchronization checklist window when synchronization in the background was not possible still closed the window.
• Bug fix: Failure after reloading file panel when number of files decreases. bug>2402
• Bug fix: Failure or silently missing headers when when S3 request headers were too long.

• Translations updated: Belarusian, Brazilian Portuguese bug>2386 and Slovenian.
• TLS/SSL core upgraded to OpenSSL 3.3.4.
• Temporarily not updating drag&drop shell extension for minor changes when installing for current user. bug>2381
• Bug fix: Failure when reading empty certificate authority configuration.
• Bug fix: Failure when running Maximized. bug>2387
• Bug fix: Incorrect scaling of navigation tree on Login and Preferences dialogs. bug>2385
• Bug fix: Incorrect scaling of drag&drop shell extension status display on Preferences dialog.

• Translation updated: Brazilian Portuguese and Polish.
• Added new ''ap-east-2'' AWS region.
• Bug fix: Some translations (notably Japanese) are not loaded. bug>2372
• Bug fix: Directory tree indentation is scaled incorrectly when starting on scaled display on system with scaled primary monitor. bug>2374
• Bug fix: Wrong icon size is used when starting on secondary monitor with different scaling than the primary one.
• Bug fix: Failure when proxy hostname resolution fails with SFTP/SCP protocols. bug>2376
• Bug fix: Avoid replacing ''%2F'' with a slash and ''%2E'' with a dot in special cases on upload to avoid path traversal. bug>2377
• Bug fix: Failure when canceling reconnection on authentication banner, when the connection was already closed by the server. bug>2379
• Bug fix: Local directories sometimes cannot be deleted. bug>2380

• Translation completed: Danish.
• Change: Skipping symlinks in Search for Text extension. bug>2365
• WebDAV/HTTP core upgraded to neon 0.34.2. It brings the following change, among other:
  • Bug fix: Failure when parsing WebDAV ''<status>'' without reason phrase. bug>2368
• Bug fix: Monitor placement and maximization is not remembered on monitors with different scaling than the primary one. bug>2366
• Bug fix: WebDAV authentication is endlessly retried when both SSPI/NTLM/Negotiate and other authentication method fails. bug>2367
• Bug fix: Cannot incrementally search with ''space'' and cannot use ''space'' to toggle selection. bug>2364
• Bug fix: Failure after switching off Thumbnails view. bug>2369
• Bug fix: Failure when system app mode changes to Dark.

• Translation completed: Norwegian.
• XML parser upgraded to Expat 2.7.1.
• Bug fix: Layout problems of by-default hidden columns on high-DPI displays. bug>2361
• Bug fix: Scaling was broken
• Bug fix: Copy key fingerprints to clipboard command link was scaled incorrectly.

• Display and modify S3 file/object tags. bug>2353
• Translations completed: Belarusian, Brazilian Portuguese, Catalan, Czech, Dutch, Finnish, French, German, Hungarian, Italian, Japanese, Korean, Polish, Portuguese, Romanian, Russian, Simplified Chinese, Slovak, Spanish, Swedish, Tamil, Traditional Chinese and Turkish; updated: Norwegian; and started: Georgian.
• SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.83.
  It brings the following change:
  • Bug fix: crash in Pageant if an SSH connection is abandoned while waiting for a deferred decryption passphrase. pbug>pageant-aborted-decrypt-crash
• TLS/SSL core upgraded to OpenSSL 3.3.3.
• Installer upgraded to Inno Setup 6.4.1.
• XML parser upgraded to Expat 2.7.0.
• Allowed S3 connection with IAM roles on instances that require IMDSv2. bug>2351
• Remembering empty session password. bug>2352
• Small GUI improvements.
• Bug fix: Some parts of UI are not localized. bug>2346
• Bug fix: Columns > Reset layout command does not reset width of by-default hidden columns. bug>2347
• Bug fix: Some translation file were duplicitously interpreted as another additional language.
• Bug fix: Unicode contents in web sources was incorrectly decoded.
• Bug fix: Intermediate translation ''.islu'' files were included in MSI installer.
• Bug fix: Monospace font is not remembered if SSH banners are administratively forced.
• Change: Bug fix: In XML log, ''filename'' tag was included in ''stat'' tag, although explicitly documented not to.
• Bug fix: Error when the last page of S3 directory listing is empty. bug>2355

• Synchronization actions can be pushed to background queue. bug>2318
• Ongoing local delete operation can be moved to a background queue (only on a remote tab, as local tabs do not have a queue).
• Switching to Segoe UI font with slightly larger size (9) as recommended for Windows Vista and newer. All windows are now slightly larger accordingly and their layout was unified.
• SSH core upgraded to pre-release snapshot of PuTTY 0.83 (2025-01-03.1e45199). It brings the following change:
  • Implement the post-quantum ML-KEM key encapsulation method. pbug>ml-kem
• SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.82.
• Command-line interface for installing public key into server. bug>2342
• Installer upgraded to Inno Setup 6.4.0.
• Thumbnails for WebP images. bug>2336
• Change: Finding ''WinSCP.exe'' in a process path if a .NET assembly assembly path is unknown (before looking into an installation folder). bug>2339
• WebDAV/HTTP core upgraded to neon 0.34.0.
• Better error message when trying to open an inaccessible local drive (such as locked BitLocker drive).
• ''https://'' URL to S3 API at ''oraclecloud.com'' is interpreted as S3 protocol, instead of WebDAV.
• AWS metadata service connection timeout is by default one second and ''AWS_METADATA_SERVICE_TIMEOUT'' is respected.
• Added new ''ap-southeast-7'' and ''mx-central-1'' AWS regions.
• Bug fix: Hang when trying to open an inaccessible drive from drive drop down menu.
• Bug fix: On Windows 11, Windows 10 version was logged.
• Bug fix: Hang when opening path with duplicated backslash. bug>2330
• Bug fix: When moving an ongoing delete operation to background queue, it might attempt to delete the current file again, failing the operation.
• Bug fix: After system theme change panel context menus stop working. bug>2331
• Bug fix: It was possible to start synchronization in new window despite incompatible Selected files only option selected by ''Shift''-clicking the OK button. bug>1870
• Bug fix: Failure when opening two SSH sessions at the same time. bug>2334
• Bug fix: Tunneled session password is not remembered. bug>2335
• Bug fix: Failure when trying to use a file not containing a private key as a client certificate file with WebDAV.
• Bug fix: ''Session.DebugLogPath'' cannot be set in single-file bundles. bug>2338
• Bug fix: Stray ''set'' command in source code package build script. bug>2340
• Bug fix: Duplicate shortcut key in local Open directory window for shared bookmarks. bug>710
• Bug fix: Source code package build script exits parent ''cmd'' console on error. bug>2341
• Bug fix: Command to "Install public key into server" was enabled, even when no hostname was specified

• IDE upgraded to Embarcadero C++Builder 11. bug>618
• Change: Dropped support for Windows XP and Windows Vista. Minimal supported version is Windows 7.
• Improvements to Synchronization checklist window:
  • Command to find Move candidate.
  • Move command can be used with a set of orphaned files and new folder in source directory to create that directory on the target side and move the orphaned files there.
  • Added Calculate All command.
  • Added a keyboard shortcut to Calculate command.
  • Move command can be used with long local paths.
• Compatibility with new OneDrive WebDAV interface. bug>2321
• Optimized loading of file panels when switching between tabs with different filters. bug>2315
• Optimized browsing deep local directory trees.
• XML parser upgraded to Expat 2.6.3.
• Including PuTTY and OpenSSL versions in ''/info''.
• Added new ''ap-southeast-5'' AWS region.
• Gracefully handling invalid Unicode characters FFFF and FFFE in filenames in .NET assembly. bug>2325
• Bug fix: Failure when system theme change is broadcasted in short order.
• Bug fix: Browsing long paths was broken.
• Bug fix: After leaving subdirectory, it is not scrolled into view in the parent directory.
• Bug fix: Long local panel location was lost after some file operations.
• Bug fix: Editor font was scaled twice on monitors with different DPI than the primary one.
• Bug fix: Option to switch to Location profiles was shown on Open directory dialog even when not possible, while session was disconnected.
• Bug fix: After delete operation is moved to background, some operations (notably editing) do not work anymore. bug>2319
• Bug fix: ''Shift+Ctrl+P'' keyboard shortcut on Login dialog to open site in PuTTY without closing the dialog does not work. bug>2320
• Bug fix: Failure when opening TLS connection with invalid OpenSSL configuration file. bug>2327
• Bug fix: Rare incorrect conversion of line endings when downloading. bug>2324
• Bug fix: Hang when creating temporary files with temporary folder on locked drive. bug>2328

• Thumbnail view in file panels. bug>912
• Three selectable sizes of toolbar icons, showing slightly larger size by default. bug>2147
• Optimized working with large local directories: bug>2264
  • Loading large directory trees in the background.
  • Hidden directory trees are loaded only in the background.
  • Optimizing directory loading by checking existence of subfolders in the background.
  • Optimized reading directories for file panel.
  • Optimized browsing within directory tree with lots of subfolders.
• Dark theme for session tabs. bug>1806
• Improvements to AWS/S3 authentication and configuration handling:
  • Allowed assuming IAM role. bug>2249
  • Credential profiles in ''.aws/config'' file are also recognized.
  • Preferring configuration file defined using an environment variable over the default one.
  • Only profiles that contain both ''aws_access_key_id'' and ''aws_secret_access_key'' are listed on the Login dialog
  • Bug fix: The ''.aws/credentials'' file path was resolved using ''AWS_CONFIG_FILE'' environment variable instead of correct ''AWS_SHARED_CREDENTIALS_FILE''.
• Incremental search improvements:
  • Search panel pops up on ''Ctrl+F'' to make the function easier to find. bug>2281
  • Layout of search panel on Login dialog improved.
  • Search options context menu added to the search panel on Login dialog.
• Remembering panel scroll position when switching tabs or refreshing. bug>1057
• Search for Preferences options.
• TLS/SSL core upgraded to OpenSSL 3.3.2.
• Site import from an INI file. bug>2290
• Preserve timestamp when duplicating remote file using SFTP extension ''copy-data'' (OpenSSH). bug>2307
• Changing caret position on the first click on an inactive editor window. bug>2304
• Change: Limiting SFTP version to 3 with non-well-known SFTP servers as a workaround for interoperability issues. bug>2247
• Installer upgraded to Inno Setup 6.3.1.
• In icons view, files are rearranged automatically when the panel is resized.
• Explorer interface view style toolbar button now shows icon for the current style, instead of the next style.
• Fallback to nonresumable transfer when temporary target file cannot be created. bug>2277
• Optionally disabled smooth scrolling in an internal editor. bug>128
• Prevented redrawing scrollbars when loading remote directory tree. bug>2313
• Open window maximized when closed while minimized from maximized state. bug>2305
• Compatibility with FTP servers that return an empty path in root. bug>2300
• Ignoring WebDAV ''PROPFIND'' result entries that do not belong to the requested directory. bug>2312
• Optionally following ''NoViewOnDrive'' policy. bug>2310
• Recognizing matching Azure certificate files. bug>2311
• Logging can be enabled for installer subtasks.
• Limited SFTP upload queue length to avoid networking congestion.
• Updated to JCL library 2.8 commit 6380ce72.
• Columns menu in Explorer interface is enabled only in Details view.
• With ''/rawconfig'', session is never opened in an existing instance.
• Not including useless OpenSSL states in error reporting.
• Bug fix: Possibility that files in root folder were incorrectly used.
• Bug fix: Failure when system theme is changed at the same time directory change is detected. bug>2286
• Bug fix: Tree indentation does not scale correctly. bug>2288
• Bug fix: It was possible to start renaming a site by double-clicking its node while editing the site.
• Bug fix: Cannot download from WebDAV server when the request is redirected to the same path on another server. bug>2293
• Bug fix: Overlay images were not drawn in icons view when Name column in Details view was too narrow.
• Bug fix: Some Unicode texts, notably custom command names, were saved incorrectly in an INI file. bug>2301
• Bug fix: Caption of permissions group labels disappears when hovered over on Windows 11.

• TLS/SSL core upgraded to OpenSSL 3.2.6.
• Back-propagated fixes from 6.4.3–6.5.6 releases:
  • New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries.
  • Change: Skipping symlinks in Search for Text extension. bug>2365
  • XML parser upgraded to Expat 2.7.5.
  • Bug fix: Local directories sometimes cannot be deleted. bug>2380
  • Bug fix: Failure or silently missing headers when when S3 request headers were too long.
  • Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. bug>2409

Older versions 1-1 waitfor delay ‘0:0:15’ –