OpenSSH to PPK Converter

How do you convert an OpenSSH key to PPK?

PuTTY, WinSCP and FileZilla on Windows load private keys in PuTTY's own .ppk format, so a key made by ssh-keygen or downloaded as a .pem from a cloud provider has to be converted first. Paste the key above, enter its passphrase if it has one, pick the PPK version, and download the .ppk: the key and its fingerprint stay exactly the same.

With PuTTY installed, the same thing is puttygen id_ed25519 -o id_ed25519.ppk, or in the PuTTYgen window: Conversions → Import key, then Save private key.

What it reads

Two things cannot be done in a browser: keys encrypted with chacha20-poly1305@openssh.com or with 3DES (DES-EDE3-CBC in an old PEM). Re-encrypt them first with ssh-keygen -p -f key, which rewrites the key with aes256-ctr. FIDO keys (sk-ssh-ed25519@openssh.com) cannot be converted at all: their private half lives on the hardware token, and the file holds only a handle to it.

PPK version 3 or version 2?

• Version 3 is what PuTTY 0.75 (2021) and later write. Its passphrase protection is Argon2id; this page uses PuTTYgen's default 8 MiB of memory, one lane and 13 passes, with a random salt, and writes those settings into the file. The MAC is HMAC-SHA-256.
• Version 2 is for PuTTY before 0.75, and for WinSCP and FileZilla releases older than their PPK3 support. Its key derivation is SHA-1 of the passphrase with no salt or work factor, which is quick to guess: if you need version 2, use a long passphrase or keep the file somewhere only you can read.

Both versions encrypt the private part with AES-256-CBC, add PuTTY's padding, and protect the whole file with a MAC, exactly as PuTTYgen does. A key with no comment gets imported-openssh-key, the name PuTTYgen gives it.

A worked example

AWS gave you deploy.pem and you need it in WinSCP. Open deploy.pem above, choose version 3, set a passphrase, and download id_rsa.ppk. Before you load it, check it is the right key: the fingerprint here must match ssh-keygen -l -f deploy.pem on any machine with OpenSSH. On Windows 10 and later:

ssh-keygen -l -f $env:USERPROFILE\Downloads\deploy.pem

In PuTTY, set it under Connection → SSH → Auth → Credentials, "Private key file for authentication". In WinSCP, Advanced → SSH → Authentication → Private key file.

Common errors and how to fix them

• "This is a public key" You pasted id_ed25519.pub. Conversion needs the private key, the file without .pub.
• "Wrong passphrase" The key could not be decrypted with what you typed. Passphrases are case-sensitive; if the key never had one, leave the field empty.
• "Unable to use key file … (OpenSSH SSH-2 private key (new format))" in PuTTY means you gave PuTTY the OpenSSH file itself. Load the .ppk instead.
• "PuTTY key format too new" in WinSCP or an old PuTTY: convert again with PPK version 2.
• "Server refused our key" The .ppk is fine but the server does not have its public key in ~/.ssh/authorized_keys. The public key line shown here is what goes there.

Shipown and PuTTY keys

Shipown reads OpenSSH private key files, so keep your original key for the app and use the .ppk only for PuTTY-family tools. When you add a server, the app's main process reads the key and nothing else sees it. To check which keys a server account trusts, paste its authorized_keys into the authorized_keys analyzer.