Connecting from Windows with PuTTY and SSH keys

Windows 10 and 11 include OpenSSH, so you can run ssh directly in PowerShell or Windows Terminal without installing anything. PuTTY is still worth having for saved sessions, its key agent (Pageant) and a familiar interface. This guide sets up key login with PuTTY from start to finish.

1. Generate a key pair with PuTTYgen

PuTTYgen is installed alongside PuTTY.

1. Open PuTTYgen.
2. Under Type of key to generate, choose EdDSA with Ed25519. Choose RSA at 4096 bits only if a tool you use cannot handle ed25519.
3. Click Generate and move the mouse over the blank area until the bar fills.
4. Enter a Key passphrase. It encrypts the private key on disk, so a copied key file is useless without it.
5. Click Save private key and keep the .ppk file somewhere safe.
6. Copy the public key from the box at the top of the window, labeled for pasting into an OpenSSH authorized_keys file.

2. Install the public key

Store it in the console

In the console, open SSH Keys, add a new key, name it after this PC (for example "office-desktop") and paste the line you copied. It starts with ssh-ed25519.

Put it on a running server

Log in once with your root password (or use Reset root password on the server page to get one), then add the key:

mkdir -p ~/.ssh && chmod 700 ~/.sshecho 'ssh-ed25519 AAAAC3Nza...your-key... office-desktop' >> ~/.ssh/authorized_keyschmod 600 ~/.ssh/authorized_keys

Paste the whole key on one line.

3. Configure and save a session

1. Open PuTTY.
2. Session: enter the server IP, for example 203.0.113.10, and port 22.
3. Connection → Data: enter root (or your user) as Auto-login username.
4. Connection → SSH → Auth → Credentials: browse to your .ppk file under Private key file for authentication.
5. Go back to Session, type a name under Saved Sessions and click Save.
6. Click Open.

The first time, PuTTY asks you to accept the server's host key. Accept it. You are then asked for the key passphrase, not the server password.

4. Skip the passphrase prompt with Pageant

Pageant holds your decrypted key in memory for the session. Start Pageant, right-click its tray icon, choose Add Key and select the .ppk. Enter the passphrase once, and every PuTTY session uses the key without asking again until you sign out.

Using a key made with ssh-keygen

A key from ssh-keygen is in OpenSSH format, which PuTTY will not load directly. Convert it:

1. Open PuTTYgen.
2. Conversions → Import key and select the private key (for example id_ed25519).
3. Click Save private key to write a .ppk.

The reverse also works: Conversions → Export OpenSSH key turns a .ppk into a key the built-in ssh command can use.

If it will not connect

• "Server refused our key". The public key is not in authorized_keys, or it was pasted from PuTTY's saved file instead of PuTTYgen's box.
• Asks for a password instead. PuTTY is not finding the key. Check the path under Auth → Credentials and that you loaded the saved session.
• "Network error: Connection refused". SSH is not running on the server, or listens on another port. Check from Open Console.
• "Network error: Connection timed out". A firewall is blocking you, at your end or on the server. See our network troubleshooting guide.

Next steps

• New to keys? Start with SSH keys: generate, add and use.
• Deploy a Windows Server 2022 or Ubuntu Cloud Server.
• Need a hand? Visit the Help Center or email [email protected].