What is WebDAV? How to use it, and how it differs from SFTP

Zotero’s sync settings, an Obsidian sync plugin, Nextcloud, a Synology NAS: sooner or later one of them asks for a “WebDAV” address, user name and password. Here is what WebDAV is, how to use it, and how it differs from SFTP.

What WebDAV is

In one sentence: WebDAV lets a web server work like a network drive or a shared folder.

HTTP, which your browser uses to open web pages, can on its own fetch, store and delete a file, but it can’t list a folder, create one or rename anything. WebDAV adds those, along with locks, so two people editing the same file don’t overwrite each other’s work. It is an open standard, first published in 1999; the current version, RFC 4918, dates from 2007.

Being just HTTP has practical advantages:

• The address is an ordinary https:// web address, on the same port as websites (443). Office firewalls and proxies usually let it through.
• Any software that can send an HTTP request can be a client, so many apps have WebDAV sync built in.

Where you’ll run into it

• Nextcloud: the address is https://your-server/remote.php/dav/files/USERNAME/. With two-factor authentication on, use an app password.
• NAS boxes: on Synology, install the WebDAV Server package; it uses port 5005 for HTTP and 5006 for HTTPS by default. On QNAP, turn it on under Network & File Services in the Control Panel.
• Hosted storage such as Fastmail Files and InfiniCLOUD. Joplin keeps a list of services known to work.
• Apps that sync over it: Zotero (attachment files only; library data still goes through Zotero’s servers), the Remotely Save plugin for Obsidian, Joplin, and KeePass 2.x, which can open and synchronize a database from a URL.

Mounting it as a drive

You can also mount WebDAV on your computer and drag files in and out, like a USB stick. Below, https://dav.example.com/docs/ stands for your address.

macOS: In Finder, choose Go > Connect to Server (⌘K), enter the address in Server Address, click Connect, then give your user name and password. The share appears under Locations in the sidebar; its Eject button disconnects it.

Windows: In File Explorer, select This PC, click the “…” button at the top and choose Map network drive (on Windows 10 it’s on the Computer tab), then enter the address in the Folder box. Microsoft deprecated this built-in client in November 2023. It still works, with limits:

• By default it sends a password only to https:// addresses, so a server with only http:// usually won’t connect.
• A single file is capped at about 50 MB.
• Folders with around a thousand files or more may not list completely.
• If it won’t connect at all, check that the WebClient service is running.

If those get in the way, mount it with rclone or a similar tool instead (on Windows, rclone needs WinFsp).

Linux: In GNOME Files, click Other Locations, enter davs://dav.example.com/docs/ in Connect to Server (https becomes davs, http becomes dav) and click Connect.

Things to watch out for

• Use HTTPS. The Basic authentication WebDAV logins commonly use only rewrites your user name and password in Base64, an encoding, not encryption. Over http://, any machine along the way can read your password.
• Use an app password where you can. It works for one app only, so if it leaks you can revoke it without changing your account password.
• Many small files are slow. Each file takes at least one round trip, so thousands of them mostly mean waiting, and services that limit requests will throttle you. Zip them up first if you can.

WebDAV vs SFTP

SFTP also moves files, but over SSH: if you can log in to a server with SSH, you can usually manage its files with SFTP. Side by side:

In short: for cloud storage, a NAS, an app that only speaks WebDAV, or a network that only lets web traffic out, use WebDAV. If you can SSH into the machine that holds the files, use SFTP. With nothing but a terminal, not even SFTP, there’s still ZMODEM (rz/sz).

Reaching a NAS on a private network

A common situation: your NAS is on a home or office network at nas.internal:5005, not open to the internet, but you can SSH into another machine there (a jump host). An SSH local port forward brings the NAS to your computer:

ssh -N -L 8080:nas.internal:5005 alice@jump.example.com

While that runs, http://127.0.0.1:8080/ on your computer is the NAS’s WebDAV: mount it or enter it in an app as usual.

SSH encrypts only the hop to the jump host; from there to the NAS it’s plain HTTP on the internal network. And Windows’s built-in client still won’t send a password to this http:// address, so on Windows rclone is easier.

In ShellRS

ShellRS is a free, open-source SSH client. It doesn’t support WebDAV, but it helps with two things above:

• Managing files with SFTP: for a server you can SSH into, open its SFTP tab. The two panes show your computer’s files and the server’s; drag between them to upload or download, and interrupted transfers can resume.
• Saving the port forward as a rule, instead of retyping ssh -L. Click the port forwarding icon in the title bar, then “+” at the top of the list, choose the Local card, pick the jump host as “Via host”, listen on 127.0.0.1:8080, and set the destination to nas.internal:5005. “Create” only saves the rule; start it with the button at the end of its row, or check “Start when ShellRS opens”. Each rule has its own SSH connection, so closing terminal tabs doesn’t affect it, and it reconnects by itself after a drop.

With the forward running, you still open the WebDAV share in Finder, File Explorer or rclone.

See “Port forwarding” and “SFTP” in the ShellRS user manual; ShellRS is available from the download page.