PPK to OpenSSH Converter

How do you convert a PPK file to OpenSSH?

A PuTTY .ppk file and an OpenSSH private key hold the same key in two different file formats, so converting one to the other changes the wrapping, not the key. Paste the .ppk above, enter its passphrase if it has one, and download the OpenSSH key: the same public key and fingerprint, in the -----BEGIN OPENSSH PRIVATE KEY----- format that ssh, scp, Git and most SSH libraries expect.

On a computer with PuTTY installed the same conversion is one command, puttygen key.ppk -O private-openssh-new -o id_ed25519, or in the PuTTYgen window: load the key, then Conversions → Export OpenSSH key (force new file format).

How the conversion works

PuTTY's format is documented in appendix C of the PuTTY manual. A .ppk has a header naming the key type, the encryption and a comment, the public key in base64, the private key in base64, and a MAC that covers all of them.

• Version 2 (PuTTY before 0.75) encrypts with AES-256-CBC. The key comes from SHA-1 of the passphrase, the IV is zero, and the MAC is HMAC-SHA-1.
• Version 3 (PuTTY 0.75, 2021, and later) runs the passphrase through Argon2 with the memory, passes, parallelism and salt written in the file (Argon2-Memory, Argon2-Passes …). That yields the AES key, the IV and the key for an HMAC-SHA-256.

The page derives the keys the same way, decrypts, and checks the MAC before using anything: a wrong passphrase or an edited file is reported, not turned into a broken key. It then checks that the private key really belongs to the public key and writes an openssh-key-v1 file, encrypted the way ssh-keygen does it (bcrypt, aes256-ctr) if you set a new passphrase.

What can be converted

A worked example

You have server.ppk from a hosting provider, protected with a passphrase. Paste it, type the passphrase, leave the new passphrase empty if the key is for an automated job, and download id_ed25519. Then:

mv ~/Downloads/id_ed25519 ~/.ssh/server_key
chmod 600 ~/.ssh/server_key
ssh-keygen -y -f ~/.ssh/server_key        # prints the public key: proof the file is good
ssh -i ~/.ssh/server_key ubuntu@203.0.113.10

ssh-keygen -y must print the same line as the public key on this page, and ssh-keygen -l -f ~/.ssh/server_key the same fingerprint as the one shown here and in PuTTYgen.

Common errors and how to fix them

• "Wrong passphrase" The MAC did not match. Passphrases are case-sensitive; also check the keyboard layout. If you are certain of it, the file has been altered.
• "The file’s MAC does not match" on an unencrypted file: something edited it, often the Comment: line, which the MAC covers. Get a fresh copy.
• "Cut short" Some lines are missing. Copy the whole file, from PuTTY-User-Key-File- down to Private-MAC.
• "Asks Argon2 for … more than a browser tab can do" The file was saved with unusually heavy Argon2 settings. In PuTTYgen, Key → Parameters for saving key files, lower them and save again.
• "Invalid format" from ssh after the conversion usually means the file picked up .txt or Windows line endings on the way. Save it again exactly as downloaded.

Using the converted key with Shipown

When you add a server in Shipown, you give it a private key file and its passphrase, if any; the key converted here is in the OpenSSH format the app reads. The key file stays where you saved it and is read by the app's main process, and credential settings decide whether the passphrase is remembered. Going the other way, for PuTTY or WinSCP, use the OpenSSH to PPK converter.