scp on Mac: Only 1 of 5 Quoting Recipes Works in Both Modes

I put a file named semi;touch PWNED.txt on a test SSH server on my Mac mini and copied it with scp -O. The copy failed with No such file or directory. A new empty file, PWNED.txt, appeared in the server account's home folder at 19:36:48. The old scp protocol hands the remote path to the server's shell, the shell read the semicolon as the end of one command, and it ran the second one. Without -O, the same command copied the file and ran nothing.

That switch is the main thing to know about scp on a Mac today. Since OpenSSH 9.0, scp moves files over SFTP by default, and the quoting tricks in most scp answers were written for the old protocol. Below: the commands that work, a matrix of 13 path cases and 5 quoting recipes run in both modes on macOS 26.4.1, the two errors that point at the server rather than your command, what scp drops when it copies from a Mac, and a count of 3,418 Stack Exchange questions about scp.

The short answer

# upload a file, download a file
scp report.pdf user@server:/home/user/
scp user@server:/var/log/app.log ~/Downloads/

# a folder needs -r; a non-standard port is capital -P
scp -r ./site user@server:/srv/
scp -P 2222 notes.txt user@server:

# a space in a remote path: one backslash survives both protocols
scp "user@server:/data/dir\ with\ spaces/file.txt" .

# a server with no SFTP (old NAS, router, embedded box): force the old protocol
scp -O firmware.bin [email protected]:/tmp/

macOS ships scp with the OS. Mine reports OpenSSH_10.2p1, LibreSSL 3.3.6 from ssh -V, so there is nothing to install. Turning on Remote Login in System Settings is only needed when the Mac is the machine other people copy to.

Why the old answers broke

The OpenSSH 9.0 release notes (April 8, 2022) are direct about it. Legacy scp expands remote wildcards "through the remote shell", which means "requiring double quoting of shell meta-characters in file names". In SFTP mode that quoting is no longer needed, and "attempts to use it may cause transfers to fail". The project says it will not add bug-compatibility. The scp manual keeps -O for servers without SFTP and for "particular filename wildcard patterns".

I ran each case against a throwaway sshd on 127.0.0.1, once in the default mode and once with -O:

Remote path	Default (SFTP)	-O (legacy)
'host:/src/a b.txt', space quoted once	copied	exit 1, looked for a and b.txt
host:/src/*.txt, quoted	copied 5 files	copied 5 files
host:/src/{f1,f2}.txt	exit 1, no such file	copied 2 files
host:~/work/f1.txt and host:~user/…	copied	copied
file literally named $x.txt	copied	exit 1, looked for .txt
file named semi;touch PWNED.txt	copied	exit 1, ran touch on the server
three files, middle one missing	exit 1, other two copied	exit 1, other two copied
a directory without -r	exit 1, "not a regular file"	exit 1, same

Brace expansion is a shell feature, so it went away with the shell. The wildcard still works in SFTP mode because the client expands it itself over the SFTP connection. The semicolon row isn't a privilege problem, since the command runs as your own account, but it shows how much the old protocol trusted file names. If you type the wildcard unquoted in zsh, the copy never starts: zsh:1: no matches found: lab:/…/src/*.txt, exit 1. That's the local shell, covered in zsh no matches found.

Five quoting recipes, both modes

The Stack Overflow question How do I escape spaces in path for scp copy has 335,202 views. I took the recipes from its six top-voted answers and ran each against dir with spaces/file.txt:

The two quotes-inside-quotes forms fail in each mode for a different reason. SFTP mode looks for a file whose name really starts with an apostrophe. Legacy mode does find the file, then refuses it with protocol error: filename does not match request, a client-side check added in OpenSSH 8.0 for CVE-2019-6111, so a server can't send back a file you didn't ask for. Adding -T turns that check off, which is why the last recipe works with -O. The top-voted answer was edited in June 2023 to say the double-quote form "only works with older versions of OpenSSH". The answers below it weren't. If a script has to run against both kinds of server, backslash-escape the spaces.

Two errors that are about the server

subsystem request failed on channel 0 then scp: Connection closed, exit 255. I got this from a second test sshd with the Subsystem sftp line removed. Plain ssh to it worked. scp -O copied the file with exit 0. The server has no SFTP, which is common on old NAS firmware, routers and Git servers. Add -O, or enable SFTP on the server. There's no ssh_config option for the protocol, so scripts need the flag. An Ask Different question from November 2022 reports this error appearing on a Mac right after the Ventura upgrade, and the Stack Overflow version has 88,881 views.

scp: Received message too long 1751477356, exit 255, followed by Ensure the remote shell produces no output for non-interactive sessions. I caused it with one line, echo hello-from-zshenv, in the server account's .zshenv. The number decodes: 1751477356 is 0x68656C6C, the bytes h e l l. The client read the start of "hello" as the length of an SFTP packet. With -O the same setup failed with exit 1 and printed hello-from-zshenv as the whole error. Sending the echo to stderr instead fixed both modes, though legacy mode still printed the line on every copy. Move anything that prints out of .zshenv or .bashrc, or only print when the shell is interactive.

What scp doesn't carry from a Mac

I uploaded a file carrying a custom extended attribute and a com.apple.quarantine flag, with mode 640 and a 2020 timestamp. In both modes:

• Extended attributes: both dropped. The copy came out with only com.apple.provenance, which macOS adds itself. Finder tags and the quarantine flag don't survive. ditto on Mac compares tools that keep them.
• Timestamp: set to the copy time unless you pass -p. With -p it stayed at January 1, 2020.
• Mode: a new file got the source's 640 or 755 even without -p. An existing target kept its own 600 after being overwritten.
• Symlinks: -r followed both a file link and a directory link and wrote real copies, so a linked folder is copied twice.
• Read-only target: exit 1, Permission denied, old content kept. scp never asks before it overwrites a writable file.

There's no resume either. For large or repeated copies, rsync is the better tool, with the caveat in the macOS rsync version that Apple now ships openrsync.

Is SFTP mode slower?

Over loopback, three runs each:

Transfer	Default (SFTP)	-O (legacy)
one 1 GiB file	2.60–2.70 s	2.60–2.61 s
2,000 files of 4 KiB, -r	0.80–0.92 s	0.64–0.77 s

Large files were a tie. Many small files were about a quarter slower in SFTP mode (0.87 s against 0.68 s on average). My guess is the extra request-and-reply steps SFTP makes per file. Loopback has no latency, so on a real network that per-file cost would grow. I didn't measure that. If thousands of small files are slow, a single tar stream over ssh avoids the per-file overhead in either mode.

What 3,418 questions ask about

I pulled every question with "scp" in the title from six Stack Exchange sites through the API: Stack Overflow 1,743, Unix & Linux 565, Super User 542, Server Fault 347, Ask Ubuntu 204 and Ask Different 17. They span August 2008 to July 2026 and have 52.3 million views. Sorted by title keywords:

Topic in the title	Questions	Share of views
Folders, recursive copies	267	21.4%
Passwords, keys, scripts	539	12.9%
Permission denied	121	6.6%
Windows	121	6.1%
Speed, progress, resume	115	4.0%
Spaces, special characters	62	1.5%
Wildcards	33	1.0%
Shell output, protocol errors	34	0.9%
Everything else	2,108	44.7%

The quoting and wildcard questions are small in count but old and heavily viewed. Those are the answers that the SFTP switch made partly wrong. Of the 331 questions asked since OpenSSH 9.0 came out, 63 mention SFTP, the subsystem, "Connection closed", -O, "legacy" or a protocol error in the title or body. For password prompts and key setup, see ssh-keygen on Mac and known_hosts vs authorized_keys.

FAQ

How do I use scp on Mac?

Open Terminal and run scp source destination, where a remote side is written user@host:path. For example, scp file.txt user@server:/home/user/ uploads a file and scp user@server:/var/log/app.log ~/Downloads/ downloads one. Add -r for folders and capital -P for a non-standard port. scp is built into macOS, so nothing needs installing.

Why does scp say "subsystem request failed on channel 0" and "Connection closed"?

The server doesn't offer SFTP. Since OpenSSH 9.0, scp transfers files over SFTP by default, so it fails against servers that only support the old scp protocol, even though ssh logins work. Add -O to use the legacy protocol, for example scp -O file.txt [email protected]:/tmp/, or enable the SFTP subsystem on the server.

How do I scp a file with spaces in the name on Mac?

Put the whole remote argument in double quotes and backslash-escape each space, for example scp "user@server:/data/my\ file.txt" . That form worked with both the default SFTP mode and scp -O. Quotes inside quotes, such as "user@server:'/data/my file.txt'", fail with current scp in both modes.

How this was tested: Mac mini (Mac16,10), macOS 26.4.1 (25E253), the system scp from OpenSSH_10.2p1 with LibreSSL 3.3.6, on October 13, 2026. The server was a non-root /usr/sbin/sshd on 127.0.0.1 with its own host key and authorized_keys file, plus a second copy with the SFTP subsystem line removed. The .zshenv tests used a separate ZDOTDIR set through the server's SetEnv, so my real shell files were never edited. "Remote" here means the same Mac over loopback, so the speed table says nothing about network latency, and I didn't test Windows servers, scp -3 between two hosts, or Apple's Remote Login service itself. The test files, including the PWNED.txt the legacy run created, were deleted afterwards. The question counts come from the Stack Exchange API's title search for "scp" on six sites, sorted by the first matching keyword group in the title only, so a question titled "scp not working" lands in "Everything else" whatever its body says.