PuTTY download for Windows: install, connect over SSH, keys and Pageant

Short answer: download PuTTY for Windows only from its official site, chiark.greenend.org.uk/~sgtatham/putty/, and run the 64-bit MSI installer. Start PuTTY, type your server’s IP address under Host Name, leave the port at 22 and the connection type at SSH, click Open, accept the host key once, and log in with your username and password or a key.

Below: which download to pick and how to check it, the first connection and its host-key prompt, saved sessions, keys with PuTTYgen (including converting OpenSSH keys to .ppk and back), Pageant, the “Server refused our key” error, keepalives, copy and paste, and when the SSH client already built into Windows is the simpler choice. Menu names and messages come from the PuTTY 0.85 manual and FAQ, read 21.10.2026; the key conversion with ssh-keygen was run on Debian 12 with OpenSSH 9.2p1.

Where do I download PuTTY for Windows safely?

PuTTY’s home is chiark.greenend.org.uk/~sgtatham/putty/, run by its author Simon Tatham. Since August 2025 the team has also registered putty.software as an official landing page that links there. The PuTTY FAQ is blunt about the most common lookalike: putty.org is not their website and never has been. The FAQ also confirms that the free “PuTTY” app in the Microsoft Store is published by the PuTTY team. Download portals that wrap PuTTY in an installer of their own are not; take the files from the links on the official download page.

As of October 2026, the latest release is 0.85, published on 16 August 2026 according to the site’s changes page. It fixes four security problems, among them a use-after-free in Pageant and a buffer overflow with OpenSSH encrypt-then-MAC cipher modes, so an older copy is worth replacing. Your installed version is under About in the PuTTY configuration window.

• putty-64bit-0.85-installer.msi for almost every Windows 10 or 11 PC and Windows Server.
• putty-arm64-0.85-installer.msi for Windows on Arm laptops.
• putty-0.85-installer.msi (32-bit) only for very old PCs, as the download page itself says.
• A bare putty.exe for each architecture if you cannot install software: it runs without setup. puttygen.exe and pageant.exe are separate downloads on the same page.

The download page publishes checksums for every file (MD5, SHA-1, SHA-256 and SHA-512, each with a GPG signature). Compare the SHA-256 value before you run the installer:

Get-FileHash .\putty-64bit-0.85-installer.msi -Algorithm SHA256
# Algorithm  Hash                                    Path
# SHA256     (64 hex characters)                     C:\Users\you\Downloads\putty-64bit-0.85-installer.msi

How do I install PuTTY?

Run the MSI and accept the defaults. It installs into C:\Program Files\PuTTY and adds Start menu entries for PuTTY (the SSH client), PuTTYgen (keys), Pageant (the key agent) and PSFTP, plus the command-line tools pscp (copy files) and plink (run commands). To update later, run the newer MSI over the old one; your saved sessions stay, because they live in the registry, not in the program folder.

How do I connect to a server with PuTTY?

1. 1Enter the host and port

   On the Session page, type the IP address or hostname under Host Name (or IP address). You can write root@203.0.113.10 to set the username at the same time. Port stays 22 unless the server’s SSH runs elsewhere (the SSH port guide explains how to find out), and Connection type stays SSH.

2. 2Click Open and answer the host-key prompt

   On the first connection to a server, PuTTY shows a security alert with the server’s key fingerprint. The next section explains what to compare before you click Accept.

3. 3Log in

   A terminal window opens and asks login as: unless you already gave a username, then the password. Nothing appears while you type the password, not even asterisks; type it and press Enter. A wrong password ends in Access denied and a new prompt.

login as: root
root@203.0.113.10's password:
Linux vps1 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 x86_64
root@vps1:~#

The banner is illustrative; yours shows your server’s own system. The same connection works from the command line, which is handy for a desktop shortcut: putty.exe -ssh root@203.0.113.10 -P 22, or putty.exe -load "my-vps" for a saved session.

The first host-key prompt: Accept, Connect Once or Cancel

PuTTY’s alert reads “The host key is not cached for this server”, followed by the server’s fingerprint, for example ssh-ed25519 255 SHA256:Tddl.... The manual describes the three buttons: Accept stores the key and connects, Connect Once connects without storing it, and Cancel stops. Stored keys go to the registry under HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys.

Accepting without checking works almost always, which is exactly why an attacker in the middle would rely on it. To check properly, read the fingerprint on the server itself, through a console that does not go over SSH (on a VPS, the browser console in your provider’s panel), and compare it with the one PuTTY shows:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
# 256 SHA256:Tddl...  root@vps1 (ED25519)

If the same server later shows WARNING - POTENTIAL SECURITY BREACH!, its key has changed. After a reinstall that is expected; otherwise stop and find out why. Host key verification failed walks through both cases.

Save a session (and change PuTTY’s defaults)

PuTTY forgets everything you set unless you save it, and saving happens on the Session page even when the setting lives elsewhere:

1. 1Fill in the server

   Host name, port and connection type, as above.

2. 2Set the extras

   Connection → Data → Auto-login username for the user, Connection → Seconds between keepalives (see keepalives), and your .ppk key under Connection → SSH → Auth → Credentials.

3. 3Go back to Session and save

   Type a name such as my-vps under Saved Sessions and click Save. Next time, double-click the name to connect. To change the starting values for every new session (a bigger font, more scrollback), change them, select Default Settings and click Save.

Saved sessions are stored in the registry at HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions, so copying the program folder to a new PC does not bring them along. Export them, host keys included, with one command and double-click the file on the new PC:

reg export "HKCU\Software\SimonTatham\PuTTY" putty-settings.reg

SSH keys with PuTTYgen

A key pair replaces the password with something that cannot be guessed. PuTTY keeps private keys in its own .ppk format, made by PuTTYgen. The concepts (why a passphrase, which key type) are the same as with OpenSSH and are covered in generating an SSH key.

1. 1Generate the key

   Open PuTTYgen, choose EdDSA with Ed25519 in the Parameters area (or RSA with 4096 bits if an old system needs RSA), click Generate and move the mouse over the blank area until the bar is full. PuTTYgen uses the movement as extra randomness.

2. 2Protect and save the private key

   Set a Key comment you will recognise later (for example laptop), enter a Key passphrase twice, and click Save private key. That .ppk file is the secret half: keep it on your PC and in your backups, nowhere else.

3. 3Put the public key on the server

   Copy the whole text from the box Public key for pasting into OpenSSH authorized_keys file. It is one line that starts with ssh-ed25519. Log in with your password once and add that line to the user’s authorized_keys:

   mkdir -p ~/.ssh && chmod 700 ~/.ssh
   nano ~/.ssh/authorized_keys        # paste the line, save with Ctrl+O, Enter, Ctrl+X
   chmod 600 ~/.ssh/authorized_keys

4. 4Point PuTTY at the key

   Load your saved session, set the .ppk file under Connection → SSH → Auth → Credentials → Private key file for authentication, go back to Session and click Save. The next login asks for the key passphrase instead of the server password.

Convert an OpenSSH key to .ppk, and back

• OpenSSH to PuTTY: in PuTTYgen, Conversions → Import key, pick the private key (for example id_ed25519), enter its passphrase, then Save private key.
• PuTTY to OpenSSH: Load the .ppk, then Conversions → Export OpenSSH key. Use Export OpenSSH key (force new file format) if the target expects the newer OpenSSH private key format.
• PPK version 3 or 2: PuTTY 0.75 (2021) introduced PPK version 3 with Argon2 passphrase hashing, and PuTTYgen saves it by default. PuTTY 0.74 and older, and tools built on that code, cannot read it. For those only, set version 2 under Key → Parameters for saving key files and save again.

Pageant: type the passphrase once per session

Pageant is PuTTY’s SSH agent. Start it, right-click the icon of a computer wearing a hat in the system tray, choose Add Key and enter the passphrase once. PuTTY, PSFTP, pscp, plink and tools such as WinSCP then use the key without asking again, and you no longer need the key path in every saved session. Pageant forgets its keys when it exits, so let it load them at sign-in: put a shortcut into the folder that shell:startup opens (Win+R), with the key as an argument.

"C:\Program Files\PuTTY\pageant.exe" --encrypted "C:\Users\you\keys\laptop.ppk"

--encrypted loads the key but asks for the passphrase only when a connection first needs it. One warning from the Pageant manual: only enable agent forwarding to servers whose administrators you trust, because they can use the forwarded agent to sign in as you elsewhere while you are connected.

“Server refused our key”: what to check

PuTTY offered the key and the server said no; PuTTY then falls back to asking for the password, if the server still allows one. Work through these in order:

• Wrong user or wrong file. The public key must be in ~/.ssh/authorized_keys of the exact user you log in as: /root/.ssh/ for root, /home/NAME/.ssh/ for anyone else.
• Wrong format. The RFC 4716 block from Save public key was pasted, or the one line was broken into several while pasting.
• Permissions. OpenSSH ignores authorized_keys when the home directory, ~/.ssh or the file is writable by others. chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys, owned by that user.
• An old PuTTY with an RSA key. PuTTY added SHA-2 RSA signatures in 0.75; older releases sign only with SHA-1, which OpenSSH 8.8 and later refuse by default. Update PuTTY.
• A different key loaded. Check the .ppk under Credentials, or what Pageant offers under View Keys.

The server log says which one it is: sudo journalctl -u ssh -n 30 on Debian and Ubuntu. The full checklist, with the log messages, is in Permission denied (publickey), the OpenSSH name for the same refusal.

Keepalives: stop idle sessions from dropping

Routers, NAT gateways and firewalls forget connections that stay silent for a while. The session then dies with Network error: Software caused connection abort or Connection reset by peer, or simply freezes. PuTTY’s answer is under Connection → Seconds between keepalives: the default 0 sends none. Set 60, go back to Session, and save the session (or Default Settings for all of them). The manual’s own example is 300 seconds for a firewall that cuts after ten minutes; shorter is safer and costs a few bytes a minute. The server side of the same problem is in SSH broken pipe.

Copy and paste in PuTTY

• Copy: select text with the mouse. That is all; it is already on the clipboard. Ctrl+C does not copy, it sends an interrupt to the program running on the server.
• Paste: right-click in the window, or press Shift+Insert. The Window → Selection panel can switch the mouse to the usual Windows behaviour if you prefer it.
• Careful with multi-line pastes: a right-click pastes at once, with no confirmation. Check what is on the clipboard before you paste into a root shell, and paste long scripts into an editor such as nano on the server rather than at the prompt.

Common PuTTY errors

Do you still need PuTTY on Windows?

Not necessarily. Windows 10, Windows 11 and current Windows Server ship Microsoft’s OpenSSH client, so ssh root@203.0.113.10 in PowerShell or Windows Terminal does the same job with OpenSSH keys, an agent and a config file. PuTTY still earns its place for saved sessions in a GUI, serial consoles, and tools that expect Pageant or .ppk files. A key converted as above works in both, so you can switch at any time. SSH on Windows covers the built-in client step by step, and scp (or pscp, which takes nearly the same arguments) copies files.

Using PuTTY with a new VPS

A fresh Linux VPS usually gives you an IP address, the user root and the password you chose at checkout. At VMHeaven you can also paste the one-line public key from PuTTYgen into the order form, so the first login already uses the key, and the panel’s VNC console is the out-of-band way to read the host-key fingerprint before you accept it. Once key login works, turn off password logins and add a non-root user, as described in initial server setup and securing SSH access.

Frequently asked