PuTTYgen & SSH Keys: A Practical Guide

Learning objectives

• Explain the distinct roles of public and private keys.
• Generate and save a protected key pair with PuTTYgen.
• Install the public key for a Linux account and use the PPK in PuTTY.
• Diagnose common key authentication failures.

Prerequisites

• PuTTY and PuTTYgen obtained from the official PuTTY project source.
• Authorized access to the target account, often initially by password.
• A secure location on your Windows profile for the private key.

Public keys, private keys, and PPK files

A key pair contains mathematically linked parts. The public key may be placed on servers you are allowed to access. The private key proves your identity and must remain confidential. Anyone who obtains an unprotected private key may be able to authenticate as you.

PuTTY stores private keys in PuTTY Private Key (.ppk) format. Current PuTTY versions use modern PPK formats and can import common OpenSSH private-key formats. OpenSSH generally does not use PPK directly, so use PuTTYgen’s conversion features when moving between client families—never use a random online converter.

Generate a key pair with PuTTYgen

1. Open PuTTYgen

   Launch it from the Start menu on your local Windows computer. Select a modern key type accepted by the remote server. Ed25519 is a strong, compact choice when supported. If the server or your organization requires RSA, use the key size specified by its current policy rather than guessing a compatibility value.

2. Generate entropy

   Choose Generate and move the pointer in the blank area as directed. PuTTYgen uses this input as part of key generation.

3. Add a label and passphrase

   Use a comment that identifies purpose without exposing secrets. Enter a strong, unique key passphrase and confirm it. A passphrase encrypts the private-key file at rest.

4. Save the private key

   Choose Save private key and store the .ppk in a folder accessible only to your Windows account. Back it up only to an approved encrypted location.

5. Copy the public key

   Copy the complete single-line value from “Public key for pasting into OpenSSH authorized_keys file.” You can also save a public-key copy for reference; it is not a substitute for the private key.

Enable public-key authentication

In PuTTYgen on your local Windows computer, copy the complete single-line value labeled “Public key for pasting into OpenSSH authorized_keys file.” This is the public key. Keep the .ppk private key on your local computer; never paste or upload the private key to the server.

Open an existing authorized session to the remote Linux account. The following remote commands create the SSH directory and then open an append-only input operation:

umask 077
mkdir -p ~/.ssh
chmod 700 ~/.ssh
touch ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
cat >> ~/.ssh/authorized_keys

After running cat >>, paste the public key as one complete line, press Enter once, and press Ctrl+D to finish. The double angle bracket >> appends; a single > could overwrite existing authorized keys and must not be used here. These permissions allow only the account owner to modify the directory and key list. Some managed servers require different ownership or a key-management portal, so follow the administrator’s policy when it differs.

Keep the original session open. In a second PuTTY window on the local computer, open Connection → SSH → Auth → Credentials, select the local .ppk private-key file, return to Session, and save the profile. Test the new login and enter the private-key passphrase locally when asked. Close the original session only after the key login succeeds.

Protect the private key

• Use a passphrase unless a controlled automation design requires otherwise.
• Limit file access to your user account and secure every backup.
• Never place the private key in authorized_keys, a ticket, chat, form, or source repository.
• If the private key may be exposed, remove its public key from every server and issue a new pair.
• Pageant can hold unlocked keys in memory for convenience; lock the workstation and remove keys when no longer needed.

Common authentication problems

• Server refused our key: confirm the public key was installed for the username actually used and that it remains one complete line.
• Wrong format: PuTTY expects an appropriate PPK private key; the Linux server expects an OpenSSH-format public-key line, not the PPK contents.
• Permissions rejected: OpenSSH may ignore user-writable-by-others key directories or files. Check ownership and the server’s policy rather than making files broadly writable.
• Algorithm unavailable: old clients and servers may lack overlapping accepted algorithms. Update supported software; do not globally re-enable obsolete algorithms without a narrow, reviewed compatibility plan.
• Passphrase lost: it cannot normally be recovered. Install a newly generated public key using another authorized access path.

PuTTY’s Event Log and OpenSSH verbose mode (ssh -v) show which keys were offered. Logs can contain hostnames and usernames, so remove private details before sharing them. Never share private-key material.

Continue learning