Port 21: What's Using It and Is It Safe to Close?
Port 21 is FTP, a legacy file-transfer protocol. Here's why it might be open on a Mac, whether it's safe to close, and the secure alternative.
Port 21 is the control port for FTP, the File Transfer Protocol. It’s a legacy protocol, and modern macOS doesn’t run an FTP server by default. A listener on 21 means FTP software you installed.
What typically listens on port 21
- Third-party FTP servers: Tools you installed to serve files over FTP.
- Legacy setups: Older workflows that still use FTP for uploads.
Apple removed the built-in FTP server (ftpd) in macOS High Sierra (10.13), so stock macOS has nothing listening here. FTP uses 21 for commands and a separate data connection for the transfers themselves.
Is it safe to close?
Yes. macOS doesn’t rely on FTP for anything. If you didn’t deliberately run an FTP server, closing port 21 is both safe and a good idea. Stop the FTP software you installed, or remove it.
Is it suspicious?
FTP is uncommon enough today that an unexpected listener on 21 is worth checking. Because FTP transmits credentials and files in plain text, an exposed FTP server is a genuine security concern. If you see 21 open and never set up FTP, identify the process and investigate.
For secure file transfer, use SFTP, which runs over SSH on port 22 and encrypts everything.
How to find what’s on port 21 on macOS
sudo lsof -i :21
To stop the owning process by PID:
kill $(lsof -ti :21)
Portie shows port 21 with its owning process in its live view, so you can confirm whether an FTP server is running and shut it down from the list.