Use SSH keys in PuTTY with Pageant

SSH keys are safer than passwords and, once set up, faster too. PuTTY can use a key in two ways: you point each saved session at a .ppk file, or you load your keys into Pageant, PuTTY's key agent, and every session uses them automatically. This guide covers both, plus how to start Pageant with Windows so you type your passphrase once per day.

Before you start

• PuTTY installed on Windows, which includes Pageant and PuTTYgen. See Connect to a Linux VPS with PuTTY.
• A private key in .ppk format. If yours is an OpenSSH key, convert it first with PuTTYgen.
• The matching public key in ~/.ssh/authorized_keys for the user you log in as on the server.

If the public key is not on the server yet, log in with your password and add it:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA...your-public-key... deploy@laptop" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Replace the quoted text with the public key from PuTTYgen's Public key for pasting into OpenSSH authorized_keys file box.

Option 1: point a session at the key

This is the simplest setup for one or two servers.

1. Open PuTTY. Select your saved session and click Load, or type the IP address and port.
2. In the left tree, go to Connection → Data and enter your username in Auto-login username.
3. Go to Connection → SSH → Auth → Credentials. On older PuTTY versions the page is Connection → SSH → Auth.
4. Next to Private key file for authentication, click Browse and pick your .ppk file.
5. Return to Session and click Save.

When you connect, PuTTY asks for the key's passphrase instead of the server password:

Authenticating with public key "deploy@laptop"
Passphrase for key "deploy@laptop":

Option 2: use Pageant

Pageant holds your decrypted keys in memory while you are logged in to Windows. PuTTY, PSCP, PSFTP, WinSCP and FileZilla can all ask Pageant for a key, so you type the passphrase once and every connection afterwards logs in straight away.

1. Start Pageant from the Start menu. Nothing opens; a small icon of a computer wearing a hat appears in the system tray.
2. Right-click the tray icon and choose Add Key.
3. Select your .ppk file and enter its passphrase.
4. Right-click the icon and choose View Keys to confirm the key is listed.

Now connect with PuTTY as usual. You do not need to set a key file in the session; PuTTY asks Pageant automatically.

When you log out of Windows or quit Pageant, the keys are forgotten and must be added again.

Start Pageant automatically

Make Pageant start at login and load your keys:

1. Press Win + R, type shell:startup and press Enter. The Startup folder opens.
2. Right-click inside it and choose New → Shortcut.
3. For the location, enter the path to Pageant followed by your key files, each in quotes. With a default 64-bit install:

   "C:\Program Files\PuTTY\pageant.exe" "C:\Users\you\keys\deploy.ppk"

1. Name the shortcut Pageant and click Finish.

At your next Windows login, Pageant starts and asks for each key's passphrase.

You can also make Pageant launch PuTTY after loading the keys with the -c option:

"C:\Program Files\PuTTY\pageant.exe" "C:\Users\you\keys\deploy.ppk" -c "C:\Program Files\PuTTY\putty.exe"

Passphrases: keep them

It is tempting to remove the passphrase so the key works without prompts. Do not do that on a laptop or shared PC. Without a passphrase, anyone who copies the .ppk file can log in to your servers.

Pageant gives you the convenience of a passwordless key while the file on disk stays protected. To change or set a passphrase, load the key in PuTTYgen, type the new passphrase twice and click Save private key.

Turn off password logins (optional)

Once key login works for every user who needs access, you can disable password logins on the server. That stops password-guessing attacks completely. Follow the steps in Disable root SSH login, and keep your current session open while you test.

Check it works

1. Make sure Pageant shows your key under View Keys.
2. Open a saved session in PuTTY.
3. The terminal should show Authenticating with public key "..." from agent and log you in without asking for any password or passphrase.

Troubleshooting

• Server refused our key: the server does not have the matching public key for that user, or permissions on ~/.ssh are too open. Check that the key is in the right user's authorized_keys, ~/.ssh is 700 and authorized_keys is 600. See Fix PuTTY "Server refused our key".
• Unable to use key file (OpenSSH SSH-2 private key): PuTTY needs .ppk format. Convert the key with PuTTYgen.
• PuTTY still asks for a password: Pageant is not running, or the auto-login username is wrong. Check the tray icon and the username in Connection → Data.
• Disconnected: No supported authentication methods available: the server only accepts keys and PuTTY offered none. Add the key to Pageant or the session.
• Too many keys in Pageant cause Too many authentication failures: the server stops after a few attempts. Remove unused keys from Pageant.