Does SFTP send username and password securely?

Question

If you log in to an sftp server, Are the username and password sent securely?

Or do you have to have certificate-based authentication to ensure that the entire transmission is encrypted?

If this is client-dependent, then do you know if Tumbleweed and WinSCP can be configured to send username and password securely?

Answer 1

SFTP goes over SSH, which establishes a secure tunnel by exchanging keys (recall how when you first connect you are prompted to accept and store a key?). Once the secure tunnel is established, all communication through it is encrypted. The username and password are sent via the tunnel, hence they are sent securely.