Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse PuTTYgen to create an SSH-2 key pair, save the private key as a protected .ppk file, copy the complete one-line public key from the box labeled Public key for pasting into OpenSSH authorized_keys file, and append that line to the target account’s ~/.ssh/authorized_keys file. Then load the matching .ppk under PuTTY’s Connection > SSH > Auth settings and connect with the same username. The server keeps the public key; your computer keeps the private key.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a PuTTY SSH key pair does
SSH public-key authentication uses two mathematically related files. The private key stays on your computer and proves that you are the key’s owner. The public key is installed in the server account you want to use. During login, the server offers a challenge that can be answered only with the matching private key; the private key itself is not uploaded to the server.
As an Amazon Associate I earn from qualifying purchases.
PuTTY’s native private-key format is .ppk. PuTTYgen creates and manages that file, while an OpenSSH server normally expects the public half as one line in the account’s ~/.ssh/authorized_keys file. These are different jobs: the .ppk is consumed by PuTTY, and the OpenSSH-formatted public-key line is consumed by the server.
PuTTY documentation describes the initial choice as selecting both the key type and its strength. For ordinary modern connections, use an SSH-2 algorithm accepted by the server. SSH-1 is obsolete and should not be selected for a normal deployment.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before you generate the key
- Install PuTTYgen. It is included with the PuTTY suite and is also available as the
puttygenutility. - Keep an existing way into the server. You need a current password login, console session, or another administrator-controlled method to place the public key in
authorized_keys. Generating a key does not install it automatically. - Know the target account and path. A key placed in one user’s home directory will not authenticate a different username. Confirm which account will run the SSH session and where that account’s home directory is located.
- Check the server’s algorithm policy. Ask the administrator or consult the server configuration before choosing RSA, DSA, ECDSA, or EdDSA. The strongest algorithm is useful only if the server, client libraries, and organizational policy all permit it.
- Plan secure storage. The private key is a credential. Save it somewhere protected by the operating system and make a separate recovery plan; do not place it in a public download folder or a shared file share.
Generate an SSH key in PuTTYgen
1. Start PuTTYgen
Open PuTTYgen from the PuTTY installation or launch the puttygen executable. The main window contains key-type controls, a strength or size control when the selected algorithm supports one, a large blank area used during generation, a public-key text box, a comment field, and passphrase fields.
2. Select an SSH-2 key type
Under the key-type controls, choose an SSH-2 algorithm that the server accepts. PuTTY documentation lists RSA, DSA, ECDSA, and EdDSA for SSH-2. Do not choose SSH-1 merely because it appears in an older guide; SSH-1 is obsolete and rarely needed.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhen PuTTYgen exposes a key-size control, set the size required by the server or your security policy. A larger value is not automatically compatible with every service, so follow the receiving server’s documented policy rather than copying a number from an unrelated setup.
3. Generate the key material
Click Generate. In the Windows graphical interface, PuTTYgen asks you to move the pointer over the blank area. Move it as requested until generation completes; the movement supplies additional randomness for the key-generation process. Do not close the window while the operation is running.
4. Add an identifying comment
Enter a comment that helps you identify the key later, such as the computer name, account, or purpose. A comment is metadata, not a secret. It is commonly retained at the end of the public-key line and helps an administrator distinguish several authorized keys without opening each private key.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Protect the private key with a passphrase
Type a passphrase in the passphrase fields and confirm it. The passphrase encrypts the saved private-key file, so someone who copies the .ppk still needs the passphrase before the key can be used. Choose a phrase you can retrieve when you connect; PuTTY will prompt for it when the encrypted key is loaded or used.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Save the private key as a .ppk file
Click Save private key. PuTTY’s manual explicitly presents this as the point at which you save the private key to disk. Choose a protected location and a filename that identifies the purpose without exposing secrets. The resulting file normally has the .ppk extension. Keep the original file even if you later export a copy for another SSH client.
Treat the saved file and its passphrase as a pair. A backup of only the encrypted file is unusable if the passphrase is forgotten; a note containing the passphrase without the file is also insufficient. Store backups under the same access controls you use for other credentials.
7. Copy the correct public-key text
In PuTTYgen, select and copy the entire contents of the box labeled Public key for pasting into OpenSSH authorized_keys file. Include the algorithm prefix at the beginning and the trailing comment, if one is present. Copy the complete single line, not a screenshot and not a partial selection.
PuTTYgen can save a public key separately, but the public key can always be recovered by loading the private key again. The text in the OpenSSH-authorized-keys box is the form intended for a typical OpenSSH server. Do not substitute an RFC 4716 multi-line export when the server expects OpenSSH authorized_keys syntax.
Recommended Free Tools
Rank #3
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & convenient login: Plug in your YubiKey via USB-A and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most secure passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Install the public key on the server
Use an existing login
Log in to the server through a method that already works, using the exact account that should receive the key. If you are an administrator installing a key for another user, switch to that user or edit that user’s home directory carefully; placing the line under the wrong account is one of the most common causes of a refusal.
Open or create authorized_keys
Make sure the target account has an .ssh directory and an authorized_keys file. On a Unix-like server, a typical sequence is:
mkdir -p ~/.ssh
nano ~/.ssh/authorized_keysUse the editor available on your server. Append the copied PuTTYgen line as one uninterrupted line. The algorithm prefix, base64 key body, and optional comment must remain together. Do not insert line breaks to make the text easier to read, and do not paste terminal prompts or quotation marks around the key.
If the file already contains other keys, add the new line below them rather than replacing the existing entries. Save the file and exit the editor. The account’s SSH service must be configured to read public keys from this location; a server using a different home directory or an alternate authorized-key path requires that path instead.
Check ownership and access
The SSH daemon must be able to read the account’s key file, while unrelated users should not be able to modify it. Confirm that the .ssh directory and authorized_keys file belong to the intended account and follow the server’s permissions policy. If an administrator has imposed stricter ownership or access rules, satisfy those rules before testing.
Rank #4
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & Convenient Login: Plug in your YubiKey via USB-C and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most Secure Passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to Last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Tell PuTTY to use the private key
- Open PuTTY and enter the server host name or address and SSH port used by the service.
- In the category tree, open
Connection > SSH > Auth. The exact wording or placement can vary by PuTTY release. - Use the private-key file control to browse to the saved
.ppkfile. - Return to the session settings if necessary and enter the username that owns the installed public key.
- Start the connection. When PuTTY asks for the key’s passphrase, enter the passphrase used when the
.ppkwas saved.
The server verifies the public key it finds in authorized_keys; PuTTY proves possession of the matching private key. A successful password prompt for the account does not prove that key authentication is configured, so test with the intended key loaded and the intended username.
Choose among RSA, DSA, ECDSA and EdDSA
There is no universally correct algorithm independent of the server. Compatibility and policy decide the practical choice. Use the following comparison before generating a replacement key.
| Algorithm | When it can be appropriate | Compatibility question | Important caution |
|---|---|---|---|
| RSA | Environments that require broad support or explicitly document RSA. | Does the server accept the RSA variant and the key size required by policy? | Follow the receiving service’s current RSA policy instead of assuming every RSA size or signature mode is enabled. |
| DSA | Legacy systems only, when the server specifically requires it. | Does the server still permit DSA authentication? | Many modern SSH policies reject DSA; it is not a sensible default for a new key. |
| ECDSA | Deployments whose server and client libraries support the selected elliptic-curve policy. | Is the required curve and implementation accepted by the server and organization? | Do not assume that support for one elliptic-curve option means support for every option. |
| EdDSA | Modern deployments that explicitly support an EdDSA key type. | Do all participating clients, libraries, and the server accept the chosen EdDSA form? | Older clients may lack support, so verify compatibility before distributing the key. |
The strongest choice on paper can fail at the login prompt if the server rejects that algorithm. Conversely, selecting an old algorithm merely to avoid checking compatibility can leave you with a key your security policy does not allow. Ask which SSH-2 types are accepted, then generate the strongest permitted option.
Understand .ppk and OpenSSH formats
PuTTY’s .ppk file is a private-key container designed for PuTTY. Other software may instead request an OpenSSH private-key format or another format. The private-key format affects which client can load the secret; it does not change the rule that the server receives the matching public key in its expected authorized-keys encoding.
| Item | Purpose | Where it belongs | What to do if another program needs it |
|---|---|---|---|
.ppk private key |
Lets PuTTY prove possession of the private half. | Protected storage on the client computer, then selected in PuTTY’s SSH authentication settings. | Use PuTTYgen’s private-key conversion options to export the format required by that client, while retaining the original .ppk for PuTTY. |
| OpenSSH public-key line | Identifies the private key that the server should trust. | The target account’s ~/.ssh/authorized_keys file, one line per key. |
Copy it from PuTTYgen’s specifically labeled OpenSSH-authorized-keys box. |
| Separate public-key export | A standalone copy for a system that asks for a public key file. | Only where that system’s instructions specify. | If it is missing, reload the private key in PuTTYgen and copy or save the public key again. |
| RFC 4716 public-key export | A different SSH-2 public-key representation. | Only where the receiving software explicitly expects RFC 4716. | Do not paste this multi-line form into an OpenSSH authorized_keys file that expects the single-line format. |
To convert a private key, open PuTTYgen, load the existing .ppk, and use the available conversion or export command for the format requested by the other client. Conversion does not require generating a new key pair, so the server’s already-installed public key remains the same. Keep the original encrypted file unless your policy requires its destruction after a controlled migration.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Diagnose a failed key login
Server refused our key
- Return to PuTTYgen and recopy the line from Public key for pasting into OpenSSH authorized_keys file. A different public-key export may use incompatible formatting.
- Check that the line was not wrapped, truncated, or split across two lines when pasted.
- Verify the username. The public key must be in that account’s home directory, not merely somewhere on the server.
- Verify the path and filename. The server may use a configured authorized-key location different from the conventional
~/.ssh/authorized_keys. - Confirm that the
.sshdirectory and file are owned and protected according to the server’s SSH policy. - Confirm that PuTTY loaded the private key corresponding to the public line installed on the server. Loading a different
.ppkproduces the same refusal even when the file itself is valid.
PuTTY asks for a passphrase
This is expected when the .ppk is encrypted. Enter the passphrase set during saving. The passphrase is not the server account password and is not sent to the server as a replacement for the private-key proof.
The server rejects the algorithm
Generate or select an SSH-2 key type allowed by the server’s policy. DSA and SSH-1 are common causes when an old tutorial has been followed. If you change algorithms, install the new public-key line before removing the old one so you do not lock yourself out during the transition.
Another client reports a format error
The program may not understand PuTTY’s .ppk container. Use PuTTYgen’s conversion options to produce the private-key format that program requires, or configure the program to accept .ppk if it supports that format. Do not paste a private key into authorized_keys; only the public half belongs there.
The public-key file was lost
You do not need to regenerate the pair. Load the existing .ppk into PuTTYgen and copy the public-key text again. The recovered public key will authenticate with the same private key, provided the server still contains the matching line.
Replace, rotate, or revoke a key safely
Add a replacement before removing the old key
When a key is lost, exposed, or due for rotation, generate a new pair and install its public line while the old key still works. Test a fresh PuTTY session with the new .ppk and the intended account. Only after successful testing should you remove the old line from authorized_keys.
Revoke a compromised key
If an unauthorized person may have copied the private key, treat it as compromised even if the file is passphrase-protected. Remove its public-key line from every server account where it was installed, then check other systems that received the same key. Generate a new pair rather than continuing to rely on the exposed private key.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Keep comments and inventories useful
Use comments that identify purpose and owner without placing passwords or other secrets in the public line. Maintain an inventory of which account and server received each key, the date it was created, and where its encrypted private file is stored. This makes later cleanup possible when a computer is retired or a person changes role.
Practical checklist
- PuTTYgen is installed and the server’s accepted SSH-2 algorithms are known.
- The key type and requested strength were selected before clicking Generate.
- The pointer was moved over PuTTYgen’s blank area when the Windows interface requested randomness.
- The key has an identifying comment and a memorable, strong passphrase.
- The encrypted private key was saved as a protected
.ppkfile. - The complete one-line key was copied from the box labeled Public key for pasting into OpenSSH authorized_keys file.
- The line was appended unchanged to the correct account’s
~/.ssh/authorized_keysfile. - PuTTY loaded the matching
.ppkunderConnection > SSH > Auth. - The connection used the username whose account contains the public key.
- A new session was tested before any old key was deleted.
Key facts to remember
PuTTYgen creates the pair; it does not automatically configure the server. The private key remains on the client, normally as .ppk, and should be protected with a passphrase. The server generally needs the OpenSSH single-line public key in the target account’s authorized_keys file. If you lose a separate public-key export, reload the private key in PuTTYgen and recover the public text. For modern connections, use an SSH-2 algorithm accepted by the server and avoid SSH-1.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
