There is zero encryption . Anyone on the network can see the data being transferred. There is also no authentication—if you know the filename, you can usually grab it.
Only run TFTP on a trusted, private management VLAN. Never expose a TFTP server to the public internet. TFTP Server
The client sends a request to the server to either get or put a file. There is zero encryption
Because it is "trivial," the protocol has a very small footprint. It doesn’t support directory listing, user authentication, or file deletion. It simply does two things: and Write Request (WRQ) . How It Works: The Bare Bones of Transfer TFTP Server
The server sends the file in fixed-size blocks (usually 512 bytes).