What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
PuTTY has reached the SSH public-key authentication stage, sent a public key, and the server rejected it. The failure is therefore usually tied to the remote username, a mismatched key pair, the target account’s authorized_keys file, ownership or permissions, or an SSH policy that disallows the key. Work through those checks in that order, then confirm the exact reason in PuTTY’s Event Log and the server’s authentication log.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “Server refused our key” actually means
This message is more specific than a generic connection failure. The TCP connection and SSH handshake have already progressed far enough for PuTTY to offer public-key authentication. The server saw the public key associated with the identity PuTTY offered and declined to authenticate the session with it.
As an Amazon Associate I earn from qualifying purchases.
PuTTY documentation describes the message as meaning that PuTTY “has sent a public key to the server and offered to authenticate with it, and the server has refused to accept authentication.” In practical terms, the network path, host, and basic SSH negotiation are probably working. Concentrate first on the account and server-side key configuration rather than reinstalling PuTTY or changing Windows firewall settings.
The most common causes are:
- PuTTY is logging in as a different user from the account where the key was installed.
- The selected private key does not match the public key on the server.
- The public-key line is missing, damaged, wrapped onto multiple lines, or stored in the wrong account’s home directory.
- The home directory,
.sshdirectory, orauthorized_keysfile has unacceptable ownership or permissions. - Public-key authentication, the authorized-keys path, the key algorithm, or an account restriction in the SSH server configuration prevents acceptance.
- Pageant or another SSH agent is offering a different identity than the one you intended.
Use the following procedure rather than changing several settings at once. A single controlled retest after each correction makes the server’s response meaningful.
1. Verify the remote username first
An SSH key is authorized for an account, not for a server in the abstract. A key placed in /home/alex/.ssh/authorized_keys does not authenticate a session that PuTTY starts as ubuntu, ec2-user, or another account.
Set the username in PuTTY
- Open the saved PuTTY session.
- Go to Connection > Data.
- Enter the intended account in Auto-login username.
- Return to Session and save the session if you want the value retained.
- Reconnect and check that the username shown in the login exchange is the one whose key file you inspected.
You can also leave Auto-login username blank and type the account at the SSH prompt. That is useful when testing several accounts, but it is easier to make a transcription error. For a cloud image, use the image provider’s documented default username for that specific image and distribution. AWS, for example, tells PuTTY users seeing this error to verify the username associated with the AMI.
Recommended Free Tools
If you have administrative access through a console or another account, check the target account’s home directory directly. For a user named alex, the expected file is commonly /home/alex/.ssh/authorized_keys, but the server may be configured with a different home path or an alternate authorized-keys location.
2. Select the private key that matches the installed public key
PuTTY must possess the private half of the exact key pair whose public half appears in the target account’s authorized-keys file. A file can be valid, load successfully, and still be the wrong identity.
Choose the key in PuTTY
- Open Connection > SSH > Auth.
- Use the private-key browse control to select the intended
.ppkfile. - Check the rest of the SSH authentication settings for the session, then reconnect.
Do not infer a match from filenames such as server.ppk or id_rsa.ppk. Compare the public key derived from the selected private key with the complete line installed on the server. PuTTYgen can display the public key for a loaded private key; use that value for the comparison, not a similarly named file copied from another machine.
Convert a foreign key format when necessary
PuTTY uses its own .ppk private-key format in many Windows workflows. If your private key is in OpenSSH or another foreign format and the installed PuTTY version does not accept it directly, open PuTTYgen, import the existing private-key file, and save a new .ppk file. Select that converted file in PuTTY. Conversion changes the container format; it does not make an unrelated key pair match.
Rank #2
- Portable Design: 11.2" L x 7.3" W x 1.6" T. Optimized key case holds up to 24 keys. Optimal choice for bankers, businessmen, landlords, hotel managers, real estate agents, car dealers, etc.
- Watertight & Fireproof: With soft and smooth silicone coating, it can resist high temperature up to 2000 °F. Effectively protect keys from heat, water or other extreme conditions.
- Reliable & Reusable: Perfect 3-layer covers with excellent durability. Outer layer: protective silicone coating and fiberglass fabric. Middle layer: cardboard for supporting the whole structure. Inner layer: cozy oxford cloth.
- Flexible Hooks: Come with sturdy ABS hooks rotating freely to flexibly arrange multiple keys. Firmly fixed by thick and well-sewn nylon straps, they are long-lasting and unlikely to fall out.
- 24 Key Tags: Contain soft and pliable key tags (10 colors) with removable labels to write and clear windows for easy visibility. Great readable method to track your keys quickly.
Keep the original private key protected. Never paste its private material into authorized_keys; that file must contain only the public key.
3. Inspect authorized_keys on the server
For the verified account, open the file that the SSH daemon actually reads. In the usual configuration this is ~/.ssh/authorized_keys. The public key corresponding to the selected PuTTY private key must be present as one intact line.
Check the line itself
- It begins with a key type such as
ssh-ed25519or another type enabled by the server, followed by the base64 key data. - It ends before the newline; a comment after the key is optional and does not replace the key data.
- There are no accidental line breaks inside the key.
- No characters were lost or added while copying.
- The line is in the target account’s file, not in root’s file or another user’s home directory.
- The file path matches the daemon’s configured
AuthorizedKeysFilesetting if that setting has been customized.
A wrapped line is especially easy to create when copying through a terminal editor or a web console. Remove the damaged entry and paste the public key again as a single line. If the file contains several keys, leave unrelated valid entries in place while testing, but make sure the intended entry is complete.
Compare without exposing the private key
Use PuTTYgen to show the public key associated with the private key selected in PuTTY, then compare it character-for-character with the server entry. The comparison is about the key type and encoded public-key data. A changed comment at the end does not alter the key, but any change in the encoded portion does.
Microsoft’s SSH troubleshooting guidance likewise identifies a missing or incorrect authorized_keys file as a cause of public-key authentication failures. If you cannot open the file because you have no working account, use the hosting provider’s serial console, recovery console, or another administrative login to correct it.
4. Correct ownership and permissions
Even a perfectly matching key can be rejected when the SSH daemon considers the account’s path unsafe. The daemon checks the ownership and writability of the home directory, the .ssh directory, and the authorized-keys file. The exact acceptable modes depend on the server’s configuration, but restrictive ownership is the reliable baseline.
Common Unix baseline
After logging in through a console or a different administrative account, replace account and the path with the real values:
sudo chown -R account:account /home/account/.ssh
sudo chmod 700 /home/account/.ssh
sudo chmod 600 /home/account/.ssh/authorized_keysThese commands make the account the owner, permit only that account to access the .ssh directory, and restrict the authorized-keys file to the owner. On systems where the user’s primary group differs from the username, use the actual account group instead of blindly repeating the username.
Check the home directory too
The home directory must not be owned by another user or writable by inappropriate users. Inspect it before changing its mode:
ls -ld /home/account
ls -ld /home/account/.ssh
ls -l /home/account/.ssh/authorized_keysDo not apply a broad recursive permission change to the entire home directory. Applications may require their own modes, and a careless command can remove needed access. Correct only the ownership and permissions that the SSH log identifies as unsafe. PuTTY documentation and Microsoft’s guidance both call out wrong ownership or permissions as frequent causes of a refused key.
5. Check the SSH server’s authentication policy
If the username, key pair, file contents, and access controls are correct, inspect the server policy. A matching key is accepted only when the SSH daemon is configured to use public-key authentication and permits that key type for the connection.
Settings and restrictions to verify
- Public-key authentication is enabled for the effective configuration.
- The daemon is reading the expected authorized-keys path, including any customized
AuthorizedKeysFilevalue. - The key algorithm used by the installed public key is allowed by the server’s current SSH policy.
- A
Matchblock or per-user rule is not overriding the global settings. - Account restrictions such as allow/deny rules are not excluding the user.
- A forced command, restricted shell, or other account policy is not rejecting the session after key selection.
- The account is enabled and has a valid home directory and shell according to the server’s policy.
Configuration changes should be validated before reloading the daemon. On many Linux systems, an administrator can run sshd -t to test syntax, then reload the service using the distribution’s service manager. The service name may be ssh or sshd, so use the command appropriate for that operating system. A syntax error can prevent a reload and may lock out additional sessions if the existing daemon is later restarted.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- PRODUCT DIMENSIONS: approximately 8.25 x 9.8 x 1.57 inches, medium size with 24 key keychains for easy to carry.
- LARGE CAPACITY: This leather key case helps to stay stay neat & organized. It contains 24 key rings with labeling position, convenient to distinguish the keys, you just need to write the description on the paper and insert it into the corresponding label card slot.
- MAKE THE BEST FIRST IMPRESSION: Inspired by sleek design. This professional portfolio leather folder is made of high-grade PU fabrics for a high-end look at an affordable price. Durable, smooth and shiny, feels good! Individuation key ring design, the structure is easy to assemble and disassemble.
- EXCELLENT OFFICE APPLIANCES: This portable key bag is perfect for banker, hotel executives, lawyers, businessmen, landlord, property managers & more. It is especially suitable for estate agents and car rental service, car dealerships and repair shops!
- SUPERIOR SERVICES : We are committed to quality products and superior service. Just contact us if you have any product quality problem and we will solve the problem for you ASAP.
Do not loosen every security control as a test. Enabling obsolete algorithms or making files world-writable can hide the real problem and weaken the server. Let the authentication log identify the specific policy decision.
6. Read PuTTY’s Event Log and the server log together
Logs turn a guess into a diagnosis. PuTTY explicitly recommends its Event Log for this error.
Open the PuTTY Event Log
- Start the session and wait for the failure.
- Open the PuTTY window’s system menu or session controls.
- Select Event Log.
- Record the username context, the key identity PuTTY offered, and any server diagnostic text.
The log can reveal that PuTTY offered a different key than expected, that the server refused a particular algorithm, or that no usable key was offered at all. Save the text before closing the session if you need to compare attempts.
Inspect the server-side record
At the same timestamp, inspect the SSH authentication log or system journal. Depending on the operating system, the relevant record may be in an authentication log file or available through the journal service. Typical diagnostics include an absent key, bad ownership, unsafe permissions, a disabled algorithm, or an account policy restriction. The exact wording varies by SSH implementation and distribution.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFor a system using the journal, an administrator can filter the SSH service entries around the failed attempt with the system’s journal command. For systems that write a traditional authentication log, inspect the entries for the source address and username. Compare the server’s reason with PuTTY’s offered identity; this prevents correcting the wrong account or key.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Retest with exactly one identity
Multiple identities can obscure the result. Pageant may have several keys loaded, and PuTTY can offer an identity different from the file you just repaired.
Best Value
- Package Includes: Pack Of 1 Piece Large Key Holder And 28 Piece Small Key Ring And 30 Piece Assorted Color Plastic Key Tags
- Size Information: This Silver Key Organizer Length Is About 5.9 Inches (15 cm), Width Is About 5.5 Inches (14 cm), Made Of High Quality Stainless Steel
- Unique Design: Smooth Plastic Handle,Safe For Your Hand,1-28 Numbers Mark On Key Chain,Also Come With 28 Separable Portable Key Rings,So Easy To Distinguish,You'll Need To Assemble The Key Rings And Key Tags By Yourself
- Effective Management: 30 Assorted Color Black Green Red Blue Yellow Plastic Key Tags,Organize And Identify With Assorted Colors Tag With Blank Inserts
- Widely Used: Great For Large Family Multi Key Management, Hotel, Rental Housing,School, Factory Warehouse, Office, Home, Apartments And Workshop Use
- In PuTTY, select the verified
.ppkdirectly under Connection > SSH > Auth. - Temporarily clear unrelated keys from Pageant, or quit Pageant for the test.
- Use the verified username under Connection > Data > Auto-login username.
- Reconnect once and capture both logs.
If the connection succeeds only after unrelated Pageant keys are removed, the earlier failure was an identity-selection problem rather than a damaged authorized-keys file. Afterward, reload only the keys you need and keep the session’s intended key explicit.
Use the symptom to choose the next check
| Observed symptom | Most likely location | Next action |
|---|---|---|
| “Server refused our key” after PuTTY offers a key | Remote account or server policy | Verify username, matching key, authorized-keys line, ownership, permissions, and server logs. |
| PuTTY offers a key name you did not intend | PuTTY or Pageant identity selection | Select the intended .ppk directly and clear unrelated agent keys. |
| The key is absent from the target account’s file | Server file installation | Install the matching public key as one intact line in the correct account and path. |
| Server log reports bad ownership or permissions | Remote filesystem access control | Correct the owner and restrictive modes on the home path, .ssh, and authorized_keys. |
| Server log reports a disabled algorithm | SSH policy compatibility | Use an approved key type or update the policy through an administrator; do not weaken policy indiscriminately. |
| “No supported authentication methods available” | Authentication methods offered by the server | Check whether public-key authentication is enabled, whether the username is valid, and whether PuTTY has a usable private key. |
“Server refused our key” versus “No supported authentication methods available”
These messages describe different stages. “Server refused our key” means PuTTY did offer a public key and the server rejected that offered identity. “No supported authentication methods available” generally means the server did not offer an authentication method that PuTTY could use, or PuTTY had no usable credential configured for the methods offered.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor the second message, check that you selected a private key, that the server permits public-key authentication, and that the session is using the intended account. If password or keyboard-interactive authentication is disabled and no acceptable public-key method is available, the server can end the exchange without ever evaluating the key line in authorized_keys. Do not treat the two messages as interchangeable; the first points strongly toward acceptance of a specific offered key, while the second requires checking the available methods themselves.
Recovery when you cannot log in with any key
You need another administrative path to repair a rejected key. Depending on the environment, use an existing administrator account with sudo, a hosting control panel console, a cloud serial or recovery console, or an out-of-band console supplied by the provider.
- Identify the exact target username and home directory.
- Back up the existing
authorized_keysfile before editing it. - Install the public key derived from the intended PuTTY private key as one line.
- Set the correct owner and restrictive permissions.
- Check the effective SSH configuration and authentication log.
- Test from a separate PuTTY session while keeping the recovery session open.
Keeping an existing administrative session open is important. It gives you a way to undo a mistaken ownership, permission, or daemon-configuration change without relying on the key you are currently repairing.
Common mistakes that waste time
- Changing the Windows firewall first: a refused key proves the SSH exchange reached authentication, so transport troubleshooting is usually not the next step.
- Copying the private key to the server: the server needs the public key only; keep the private key on the Windows client.
- Putting the key in root’s file: a key in
/root/.ssh/authorized_keysdoes not authorize a login as another account. - Assuming a filename proves a match: derive and compare the public key instead.
- Wrapping the key for readability: the authorized-keys entry must remain one line.
- Running a recursive chmod on the whole home directory: this can break unrelated applications and still fail to fix the specific path.
- Editing the wrong SSH configuration file: verify the daemon’s effective settings and any per-user or
Matchrules. - Testing with Pageant full of old keys: remove ambiguity by offering one verified identity.
- Reloading an untested daemon configuration: validate syntax first and retain a recovery session.
A compact verification checklist
Before escalating the issue, confirm each item:
- The PuTTY username exactly matches the account that owns the installed key.
- The selected private key is the pair for the public key on the server.
- The key is stored in the daemon’s expected authorized-keys path.
- The public-key entry is complete and occupies one line.
- The home directory,
.sshdirectory, andauthorized_keysfile have appropriate ownership. - The directory and file permissions are restrictive enough for the server’s policy.
- Public-key authentication and the key algorithm are enabled.
- No account restriction or forced policy blocks the user.
- PuTTY’s Event Log identifies the expected key.
- The server authentication log explains the rejection or confirms the correction.
- The final test uses one selected
.ppkand no confusing Pageant identities.
Once all of these conditions align, PuTTY can authenticate without changing the network, replacing hardware, or weakening the server’s security settings.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
