PuTTY Guide: Download, Connect to a VPS and Use SSH Keys

Published on

Download PuTTY 0.85 from the official site, log in to your VPS and check its host key, save the session, set up SSH keys in PuTTYgen, or use Windows' ssh.

A technician holding a tablet in a data center aisle between rows of server racks with blue status lights

You have a VPS, an IP address and a root password, and you're on Windows. PuTTY is the free SSH client most guides send you to, but its own FAQ warns about imitators and unofficial landing pages, the first connection opens a security alert, and its key files use their own format. This guide covers all of it with PuTTY 0.85, the current release, plus the ssh command Windows already has.

Quick answer: Download PuTTY only from its official site, chiark.greenend.org.uk/~sgtatham/putty, or the PuTTY team's Microsoft Store listing; putty.org is not theirs. Most Windows 10 and 11 PCs need the 64-bit x86 installer, which includes PuTTYgen. For your PuTTY login, type the VPS's IP address under Host Name, keep port 22, click Open, check the host key fingerprint, click Accept and enter your username at login as:. For keys, generate an Ed25519 key in PuTTYgen, paste its public line into ~/.ssh/authorized_keys on the server and select the .ppk under Connection > SSH > Auth > Credentials. Windows' own ssh command works without PuTTY.

PuTTY Download: 64-Bit, Arm or 32-Bit

PuTTY is maintained primarily by Simon Tatham, and its real home has always been chiark.greenend.org.uk/~sgtatham/putty. Its download page links to the.earth.li, a separate file server that the FAQ confirms is legitimate. Since August 2025 the team also runs putty.software, a short landing page that points back to the main site. Is putty.org theirs? "No, it isn't, and it never has been," says the FAQ: someone selling a competing SSH client set it up.

The current version is 0.85, released on 16 August 2026. It fixes several security bugs, the worst in Pageant, PuTTY's key agent, so replace older copies. The team also publishes the installers free of charge in the Microsoft Store, usually a few days after a release. The FAQ warns that other people have uploaded PuTTY copies there too, some of them paid.

Your PCFile on the official download page
Most Windows 10 and 11 PCs (Intel or AMD)64-bit x86 MSI, putty-64bit-0.85-installer.msi
A Windows on Arm laptop64-bit Arm MSI, putty-arm64-0.85-installer.msi
A very old PC or 32-bit Windows32-bit x86 MSI, putty-0.85-installer.msi
You don't want to install anythingputty.exe and puttygen.exe as single files

Not sure which processor you have? Settings > System > About lists it under Device specifications. The download page itself says you "probably want the 64-bit x86 version".

Check the file before you run it. Windows builds carry Simon Tatham's Authenticode signature: right-click the file, choose Properties and open the Digital Signatures tab, which should name Simon Tatham. Or compare the file's hash with the official SHA-256 list, where the 64-bit installer's line ends in w64/putty-64bit-0.85-installer.msi. In PowerShell, from your Downloads folder:

Get-FileHash .\putty-64bit-0.85-installer.msi

Get-FileHash uses SHA-256 by default. The installer adds PuTTY, PuTTYgen, Pageant and PSFTP to the Start menu.

Used PuTTY for years? Versions 0.68 to 0.80 could expose NIST P-521 ECDSA private keys through their signatures (CVE-2024-31497). If you made such a key, remove it from every authorized_keys file and make a new one. Ed25519 keys are not affected.

Your First PuTTY Login

You need the VPS's IP address, a username (often root) and its password. Then:

  1. Start PuTTY and type the IP address, such as 203.0.113.10, under Host Name (or IP address).
  2. Leave Port at 22 and Connection type on SSH, unless you moved SSH to another port.
  3. Click Open.

On the first connection, a PuTTY Security Alert appears, along these lines:

The host key is not cached for this server:
  203.0.113.10 (port 22)
You have no guarantee that the server is the computer you think it is.
The server's ssh-ed25519 key fingerprint is:
  ssh-ed25519 255 SHA256:TddlQk20DVs4LRcAsIfDN9pInKpY06D+h4kSHwWAj4w

Checking the fingerprint stops someone from redirecting your connection to their own machine and catching your password, and the PuTTY manual asks you to verify it by other means. For a VPS, that means the provider's web console, which doesn't run over SSH; on a Space-Node VPS it's the browser console in the panel. Log in there and run:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

It prints a line like 256 SHA256:TddlQk20... root@vps (ED25519). PuTTY counts an Ed25519 key as 255 bits and OpenSSH as 256, so compare only the text after SHA256:. If PuTTY names another key type, such as ecdsa-sha2-nistp256, check ssh_host_ecdsa_key.pub instead. When they match, click Accept: PuTTY stores the key in the Windows registry and checks it on every later connection.

The terminal window then shows login as:. Type the username, press Enter, then type the password; nothing appears while you type it. Many SSH servers won't let you switch usernames after Enter, so if you mistype it, close PuTTY and start again.

Copy and paste work differently from other Windows programs: selecting text copies it, a right-click pastes, and Ctrl+C sends an interrupt to the server instead of copying.

Save the Session

PuTTY doesn't store passwords, but a saved session keeps everything else:

  1. Enter the IP address and port as above.
  2. Under Connection > Data, set Auto-login username to root or your own user.
  3. If idle sessions drop, set Seconds between keepalives under Connection. The manual's example: when a firewall cuts idle connections after ten minutes, enter 300.
  4. Go back to Session, type a name such as my-vps under Saved Sessions and click Save.

From now on, double-click the name to connect. To change it later, load the session, make the change, go back to Session and click Save again.

Create an SSH Key with PuTTYgen

With a key, you prove who you are with a signature, so the server never receives a secret that could leak. Open PuTTYgen from the Start menu:

  1. Under Parameters, select EdDSA and keep Ed25519 (255 bits) as the curve. PuTTYgen 0.85 starts on RSA with 2048 bits, which works too.
  2. Click Generate and move the mouse over the blank area until the bar fills.
  3. Change Key comment to something you'll recognize, such as laptop-2026. The default is eddsa-key- plus the date.
  4. Type a Key passphrase twice. Without one, anyone who copies the file can log in as you, and a forgotten passphrase can't be recovered.
  5. Click Save private key and keep the .ppk file somewhere private.
  6. Select everything in the box Public key for pasting into authorized_keys file and press Ctrl+C.

Skip the Save public key button for a Linux server: it writes the multi-line RFC 4716 format, while OpenSSH wants the one-line text from the box. If that file is all you have, ssh-keygen -i -f key.pub on the server prints it as one line.

Add the Key to Your VPS

Log in with your password as the user the key is for. In the second command, replace the text between the single quotes with your key (a right-click pastes it), all on one line:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA...your-key... laptop-2026' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

The permissions matter: sshd won't use an authorized_keys file when that file, ~/.ssh or your home directory is writable by other users.

Now point PuTTY at the key. Load your saved session, open Connection > SSH > Auth > Credentials, click Browse next to Private key file for authentication and pick the .ppk. Go back to Session and click Save. The field has lived on this Credentials page since PuTTY 0.78, so older guides still show it on the Auth page.

Keep your first window open and start the session in a second one. PuTTY should print Authenticating with public key "laptop-2026" and ask for the key's passphrase instead of the server password.

To type that passphrase only once per Windows session, use Pageant: start it from the Start menu, double-click its tray icon (a computer wearing a hat), click Add Key and choose the .ppk. PuTTY then uses Pageant's keys by itself. Leave Allow agent forwarding under Connection > SSH > Auth off unless you need it.

Convert Keys Between .ppk and OpenSSH

PuTTY only loads .ppk files. Give it an OpenSSH key and you get Unable to use key file "...\id_ed25519" (OpenSSH SSH-2 private key (new format)). PuTTYgen's Conversions menu works in both directions:

  • OpenSSH to .ppk: Conversions > Import key, choose the file, enter its passphrase, then click Save private key.
  • .ppk to OpenSSH: Load the .ppk, then Conversions > Export OpenSSH key. For Windows' own ssh, save it as C:\Users\<you>\.ssh\id_ed25519, without an extension; mkdir $env:USERPROFILE\.ssh in PowerShell creates that folder if it's missing.
  • Older tools: PuTTYgen saves PPK version 3, which PuTTY 0.74 and older can't read. Under Key > Parameters for saving key files, choose version 2 and save a copy.

On Linux, the puttygen command from the putty-tools package (Ubuntu and Debian) does the same:

puttygen mykey.ppk -O private-openssh -o id_ed25519
puttygen id_ed25519 -o mykey.ppk
puttygen -L mykey.ppk

The first line converts to OpenSSH, the second back to .ppk, and the third prints the one-line public key for authorized_keys.

Windows' Built-In SSH Client

PuTTY's own FAQ says you may not need PuTTY at all: Windows comes with OpenSSH as an optional component, from Windows 10 build 1809 on, updated through Windows Update. Run ssh -V in PowerShell; if it prints a version, you're set. If not, search the Start menu for Optional features and add OpenSSH Client, or run this in PowerShell as administrator:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Create a key on your PC and print its public half:

ssh-keygen -t ed25519
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

ssh-keygen saves the key pair in C:\Users\<you>\.ssh\ (press Enter to accept that) and asks for a passphrase. Then connect:

ssh root@203.0.113.10

The first connection shows the fingerprint and asks Are you sure you want to continue connecting; compare it as above, then type yes. Log in with your password and add the public line to authorized_keys exactly like PuTTYgen's. From then on, ssh root@203.0.113.10 uses id_ed25519 by itself. If the server's host key changes for a good reason, ssh-keygen -R 203.0.113.10 removes the old one from known_hosts.

Common PuTTY Errors

MessageWhat it meansWhat to do
Network error: Connection timed outNo answer at allCheck the IP address and that the VPS is running
Network error: Connection refusedNothing accepts connections on that port, or a firewall rejects themCheck the port in your session, then SSH and the firewall from the web console
Server refused our keyThe server won't accept that key for that userCheck the username, the one-line key and the permissions above
Unable to use key fileThe key isn't a .ppkImport it in PuTTYgen and save a .ppk
No supported authentication methods available (server sent: publickey)The server takes keys only, and none workedSelect the right .ppk or add it to Pageant
A POTENTIAL SECURITY BREACH warningThe host key changedNormal after an OS reinstall; check the new fingerprint, then Accept

For a refused key, right-click the title bar and open the Event Log. On AlmaLinux and Rocky Linux, restorecon -F ~/.ssh ~/.ssh/authorized_keys resets the SELinux labels, as OpenSSH's own ssh-copy-id script does.

Next Step: Switch Off Password Logins

Once your key works, follow our SSH hardening guide to turn off password authentication, and test from a second window before you close the first. Our UFW and Fail2Ban guide adds a firewall. The web console still asks for your account password, so make sure your user has one you know (passwd sets it) before you rely on keys alone. Need a server for all this? Space-Node VPS plans come with full root access on KVM in an EU data center, with Ubuntu, Debian, AlmaLinux and Rocky Linux images.

FAQ

Where do I download PuTTY 64-bit for Windows 11? From the official download page: putty-64bit-0.85-installer.msi for an Intel or AMD PC, or putty-arm64-0.85-installer.msi for an Arm PC. The PuTTY team's Microsoft Store listing has the latest release too, usually a few days after it comes out.

Where do I get PuTTYgen for Windows 11? It comes with the PuTTY installer and shows up in the Start menu as PuTTYgen. For the tool alone, the same download page has a standalone puttygen.exe for 64-bit x86, 64-bit Arm and 32-bit Windows.

What do I type at PuTTY's login as prompt? The username for your server, often root on a new VPS, then its password, which stays invisible while you type. Your VPS provider gives you those details; the PuTTY team can't.

Is putty.org the official PuTTY website? No. The official site is chiark.greenend.org.uk/~sgtatham/putty, and putty.software is the team's own short address. The FAQ advises against putty.org and any other landing page that isn't theirs.

Can PuTTY remember my password? No. Its FAQ calls that a bad plan, since anyone with access to your PC could use it, and points to public keys instead. A key in Pageant comes close: one passphrase per Windows session.

Do I need PuTTY on Windows 11? Not necessarily. Windows 10 and 11 can run OpenSSH's ssh command, and ssh -V shows whether it's installed. PuTTY's FAQ lists what it adds: saved sessions that hold SSH, terminal and logging settings, a settings window you can open mid-session, and serial connections. Both are free and either works for a VPS.

Sources

All opened on 1 November 2026: