Convert keys between PuTTY (.ppk) and OpenSSH formats

PuTTY stores private keys in its own .ppk format, while OpenSSH (the ssh command on Linux, macOS and Windows) uses a different format. If you move between tools, or a service hands you a key in the wrong format, you need to convert it. PuTTYgen, which installs with PuTTY, does this in a few clicks, and the command-line version can do it on Linux and macOS too.

Before you start

• PuTTY installed on Windows, which includes PuTTYgen. See Connect to a Linux VPS with PuTTY.
• The private key file you want to convert, and its passphrase if it has one.
• A basic understanding of SSH keys. If you have never set one up, read Set up SSH keys first.

Know which format you have

Open the key file in Notepad (do not change it) and look at the first line:

• PuTTY-User-Key-File-3: ssh-ed25519 or PuTTY-User-Key-File-2: ssh-rsa: a PuTTY.ppk key, version 3 or 2.
• -----BEGIN OPENSSH PRIVATE KEY-----: an OpenSSH private key, the current default for ssh-keygen.
• -----BEGIN RSA PRIVATE KEY-----: an older PEM format RSA key. OpenSSH still reads it.
• A single line starting with ssh-ed25519 or ssh-rsa: that is a public key, not a private one. It goes in the server's authorized_keys and needs no conversion.

PPK version 2 vs version 3

PuTTY 0.75 introduced PPK version 3, which protects passphrases with the stronger Argon2 key derivation. Current PuTTYgen saves version 3 by default.

Older tools, including some versions of FileZilla, WinSCP and older PuTTY releases, cannot read version 3. If a tool rejects a key that works in current PuTTY, save a version 2 copy:

1. In PuTTYgen, open the Key menu and choose Parameters for saving key files....
2. Set PPK file version to 2 and click OK.
3. Save the private key under a new name.

Prefer upgrading the old tool where you can, because version 3 is the better format.

Convert PPK to OpenSSH

Use this when you have a .ppk and need a key for ssh, VS Code, Git or a Linux or macOS machine.

1. Open PuTTYgen.
2. Click Load, change the file filter to *All Files (\.\)* if needed, and pick the .ppk file. Enter the passphrase if asked.
3. Open the Conversions menu and choose Export OpenSSH key (force new file format). The plain Export OpenSSH key option writes the older PEM style for RSA keys, which also works.
4. Save it without an extension, for example id_ed25519, into C:\Users\<you>\.ssh\.

PuTTYgen keeps the passphrase on the exported key. To get the public key in OpenSSH format, copy the text from the box labelled Public key for pasting into OpenSSH authorized_keys file.

On Linux or macOS, the puttygen command does the same. Install it with sudo apt install putty-tools on Ubuntu or Debian, or brew install putty on macOS, then:

puttygen mykey.ppk -O private-openssh-new -o ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519

Convert OpenSSH to PPK

Use this when you created a key with ssh-keygen and want to use it in PuTTY or WinSCP.

1. Open PuTTYgen and click Load.
2. Set the filter to *All Files (\.\)* and select the OpenSSH private key, for example id_ed25519.
3. Enter the passphrase if asked. PuTTYgen shows a notice that it imported a foreign key. Click OK.
4. Click Save private key and save it as id_ed25519.ppk.

From the command line:

puttygen ~/.ssh/id_ed25519 -o id_ed25519.ppk

Generate a new Ed25519 key in PuTTYgen

If you are starting fresh, Ed25519 keys are short, fast and secure.

1. In PuTTYgen, under Parameters, select EdDSA and make sure Ed25519 is chosen in the drop-down.
2. Click Generate and move the mouse over the blank area until it finishes.
3. Type a Key comment such as deploy@laptop, and a Key passphrase twice.
4. Click Save private key to keep the .ppk.
5. Copy the public key from the box at the top.

Add the public key to the server, as the user you will log in as:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste the key on its own line, save, and set permissions:

chmod 600 ~/.ssh/authorized_keys

Load the key in PuTTY

1. Open PuTTY and load your saved session.
2. Go to Connection → SSH → Auth → Credentials.
3. Next to Private key file for authentication, click Browse and select the .ppk.
4. Go back to Session and click Save.

To avoid typing the passphrase every time, load the key into Pageant instead. See Use SSH keys in PuTTY with Pageant.

Check it works

Connect with the key. In PuTTY, you should see Authenticating with public key "deploy@laptop" followed by a passphrase prompt, and no password prompt.

For an OpenSSH key, test from PowerShell or a terminal:

ssh -i ~/.ssh/id_ed25519 deploy@203.0.113.10

Troubleshooting

• Couldn't load private key (unrecognised cipher name) or similar in an older tool: the tool does not understand PPK v3. Save a version 2 copy or update the tool.
• Load key... invalid format from ssh: you passed a .ppk to OpenSSH. Convert it to OpenSSH format first.
• UNPROTECTED PRIVATE KEY FILE! on Linux or macOS: the key file is readable by others. Run chmod 600 on it.
• PuTTY says Server refused our key: the public key is not in the right user's ~/.ssh/authorized_keys, or that file has wrong permissions. See Fix PuTTY "Server refused our key".