SSH on Windows 10 and 11: the built-in OpenSSH client, keys, PuTTY and WinSCP

Short answer: Windows 10 and 11 ship Microsoft’s build of the OpenSSH client, so you do not need PuTTY to connect to a server: open PowerShell or Windows Terminal and type ssh USER@SERVER_IP. If the command is missing, add the “OpenSSH Client” optional feature, which takes one PowerShell line.

ssh -V
ssh root@SERVER_IP

The first line prints the client version and proves it is installed; the second logs in to your server. Everything below uses the built-in ssh.exe, with keys, the agent, a config file, scp and sftp, then covers PuTTY, WinSCP and WSL for the cases where they are the better tool. Facts about Windows, PuTTY and WinSCP come from Microsoft Learn and the tools’ own manuals, linked where they appear; commands that behave the same on every platform were checked against OpenSSH 9.2 on Debian.

Check whether the OpenSSH client is installed

According to Microsoft’s OpenSSH for Windows overview, the client is a Feature on Demand from Windows 10 build 1809 and Windows Server 2019 on, Windows 11 included. Many PCs have it already, but Microsoft still documents it as an optional feature you may have to add, so check first: ssh -V answers with a line that starts OpenSSH_for_Windows_. A fully updated Windows 10 22H2 or Windows 11 reports at least 9.5: Microsoft moved the built-in client to that release with the October 2024 cumulative updates. Older or unpatched images still report 8.1, or 7.7 on early builds.

If PowerShell says the term ssh is not recognized, install the client. Through the GUI: press Start, type Optional features, open it, choose View features (or Add a feature on Windows 10), search for OpenSSH Client and install it. In PowerShell, run as Administrator:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

The first line shows State : Installed or NotPresent for the client and the server; the second adds the client, the same command Microsoft’s install guide uses. Open a new terminal afterwards. On company PCs that get updates from WSUS, it can fail with 0x800F0954, because Windows cannot fetch the feature package; Microsoft’s troubleshooting article has the workarounds.

The binaries live in C:\Windows\System32\OpenSSH. If you also have Git for Windows or a newer OpenSSH from GitHub, Get-Command ssh shows which ssh.exe actually runs.

Connect to a server for the first time

Run ssh root@SERVER_IP, or ssh -p 2222 root@SERVER_IP when SSH listens on another port. On the first connection, ssh cannot know whether the server is genuine and asks:

The authenticity of host '203.0.113.10 (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:xRjk9isUVT5Q/lCDaIaJ3VdsIiZn4C4UWrdU3lMuKMg.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

To be sure, compare the fingerprint with the one the server itself reports. On a VMHeaven server, open the VNC console in the panel, log in and run:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

If the SHA256: strings match, type yes. ssh saves the key in %USERPROFILE%\.ssh\known_hosts and then asks for the password, which stays invisible while you type. Should the server be reinstalled later, ssh refuses to connect with REMOTE HOST IDENTIFICATION HAS CHANGED; Host key verification failed explains how to check and replace the entry. ssh-keygen -R SERVER_IP works in PowerShell exactly as on Linux.

Create an SSH key on Windows

ssh-keygen -t ed25519 -C "laptop"

Accept the suggested path and set a passphrase. The private key lands in C:\Users\NAME\.ssh\id_ed25519, the public key next to it as id_ed25519.pub. Only the .pub file ever leaves your PC. Print it, or copy it straight to the clipboard:

Get-Content "$env:USERPROFILE\.ssh\id_ed25519.pub"
Get-Content "$env:USERPROFILE\.ssh\id_ed25519.pub" | Set-Clipboard

Windows has no ssh-copy-id. To install the key on a Linux server, use the PowerShell one-liner in ssh-copy-id on Windows, which does the same job including the file modes. On a VMHeaven Linux VPS you can paste the line at checkout instead, and the key is in place when the server first boots.

Enable ssh-agent so you type the passphrase once

The agent ships with Windows, but its service, “OpenSSH Authentication Agent”, is disabled by default. Until you change that, ssh-add fails with Error connecting to agent: No such file or directory. In PowerShell as Administrator, as in Microsoft’s key management guide:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Then, in a normal PowerShell window, load your key:

ssh-add "$env:USERPROFILE\.ssh\id_ed25519"
ssh-add -l

Unlike the agent on Linux, the Windows service keeps added keys across reboots, tied to your Windows account, so you enter the passphrase once. One trap: Git for Windows uses its own ssh, which does not talk to this agent. Point Git at the Windows one:

git config --global core.sshCommand "C:/Windows/System32/OpenSSH/ssh.exe"

Save servers in the SSH config file

Microsoft’s OpenSSH configuration page lists where the client looks: a file passed with -F, then %USERPROFILE%\.ssh\config, then %PROGRAMDATA%\ssh\ssh_config. Create your file and open it in Notepad (if it exists already, New-Item says so and changes nothing):

New-Item -ItemType File "$env:USERPROFILE\.ssh\config"
notepad "$env:USERPROFILE\.ssh\config"

Host myvps
    HostName SERVER_IP
    User root
    Port 22
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Now ssh myvps is enough, and ~ means your profile folder. Three Windows-specific rules:

• The file needs no extension: check that Notepad did not save config.txt.
• It must be ASCII or UTF-8; the Win32-OpenSSH notes say UTF-16 is not supported. That is what > and Out-File write by default in Windows PowerShell 5.1, so do not build the file with echo ... > config there.
• ControlMaster connection sharing is not supported on Windows; leave it out.

Every other directive works as on Linux; precedence, ProxyJump, Include and ssh -G are in the SSH config file guide. In Windows Terminal, add a profile whose command line is ssh myvps, and the server gets its own entry in the new-tab menu.

Copy files with scp and sftp

scp and sftp come with the same feature and use the same keys and config. Put Windows paths in double quotes:

scp "$env:USERPROFILE\Downloads\site.zip" myvps:/root/
scp myvps:/var/log/nginx/error.log .

sftp myvps opens an interactive session where put uploads, get downloads, ls lists the server folder, lcd changes the local one, and exit leaves. Ports, folders and the quoting rules are in the scp command guide. For syncing folders, rsync is the better tool, and on Windows it runs in WSL (below).

Reach a web panel through an SSH tunnel

Admin pages such as phpMyAdmin or a dashboard bound to 127.0.0.1 on the server do not need an open port. Forward one from your PC:

ssh -N -L 8080:127.0.0.1:80 myvps

While that runs, http://localhost:8080 in your browser reaches port 80 on the server’s loopback, encrypted. -N opens no shell; stop it with Ctrl+C. Remote and dynamic forwards work the same way on Windows; the SSH tunnel guide covers them.

PuTTY and .ppk keys

PuTTY is a separate download from its official site (or winget install PuTTY.PuTTY). It still makes sense if you want saved sessions in a window, a serial console, or a tool that expects Pageant, its agent. PuTTY uses its own key format, .ppk, and PuTTYgen converts in both directions:

• OpenSSH key to .ppk: in PuTTYgen choose Conversions → Import key, select id_ed25519, then Save private key.
• .ppk to OpenSSH: load the .ppk, then Conversions → Export OpenSSH key, and save it as %USERPROFILE%\.ssh\id_ed25519.
• The public key for a server: copy the box labelled Public key for pasting into OpenSSH authorized_keys file. The .pub file PuTTYgen saves is in a different format that authorized_keys does not accept.

PuTTY 0.75 and later save PPK version 3. Tools built on older PuTTY code reject it; for those, set version 2 under Key → Parameters for saving key files, as the PuTTYgen manual describes. In PuTTY itself, the key goes under Connection → SSH → Auth → Credentials; save the session on the Session page.

WinSCP for drag-and-drop transfers

WinSCP (winget install WinSCP.WinSCP) is a two-pane file manager over SFTP or SCP, handy for uploading a site or editing a config file on the server in a local editor. Its authentication settings want a .ppk, and when you pick an OpenSSH key it offers to convert it. It can also take keys from Pageant. WinSCP 6.6, still a release candidate in October 2026, can use the Windows OpenSSH agent instead once you select it in the preferences, so a key loaded with ssh-add works without a key file.

WSL: a full Linux ssh, rsync included

wsl --install in an administrator PowerShell installs Ubuntu by default. Inside it you have the Linux ssh, rsync and every other tool, with their own ~/.ssh in the Linux home, separate from the Windows one. Do not point ssh at keys under /mnt/c/Users/NAME/.ssh: files on the Windows drive appear with mode 0777, so ssh prints WARNING: UNPROTECTED PRIVATE KEY FILE! and ignores the key. Copy it into the Linux home instead:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
cp /mnt/c/Users/NAME/.ssh/id_ed25519* ~/.ssh/
chmod 600 ~/.ssh/id_ed25519

Replace NAME with your Windows user name. The rsync command then works exactly as on a Linux desktop.

SSH into a Windows machine

Everything above is the client. To log in to a Windows machine over SSH, it needs the OpenSSH Server feature. Windows Server 2025 has it installed but not enabled; Windows Server 2022 and 2019 and Windows 10 and 11 need it added first. Per Microsoft’s install guide, in PowerShell as Administrator on that machine:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

Setup creates the firewall rule OpenSSH-Server-In-TCP for port 22, and the default shell is cmd.exe. Keys for accounts in the Administrators group go into C:\ProgramData\ssh\administrators_authorized_keys, not the user’s own folder, as the note in ssh-copy-id on Windows explains. On a server with a public address, allow port 22 only from addresses you trust.

Which SSH client should you use on Windows?

Errors and fixes

The term ssh is not recognized

The client is not installed, or C:\Windows\System32\OpenSSH is missing from the PATH. Install it as shown above, then open a new terminal.

Connection timed out or Connection refused

Not a Windows problem: SSH does not reach the server. “Refused” usually means nothing listens on that port; a timeout means a firewall drops the packets or the address is wrong. See SSH connection timed out and SSH connection refused. The open port checker tests from outside whether the port answers at all.

Permission denied (publickey)

The server did not accept any key ssh offered. Run ssh -v myvps to see which keys were tried, and work through Permission denied (publickey).

UNPROTECTED PRIVATE KEY FILE on Windows

Windows’ OpenSSH checks file permissions too: the private key and the config file must belong to you, and no other user may have access. This mostly hits keys copied from another folder or another PC. Remove the inherited permissions and grant only yourself read access:

icacls "$env:USERPROFILE\.ssh\id_ed25519" /inheritance:r /grant:r "$($env:USERNAME):(R)"

Bad configuration option or no argument after keyword

A garbled first word in the message, such as \377\376h, means the config file was saved as UTF-16. Open it in Notepad, choose Save as with the encoding UTF-8, and keep the name config without an extension.

Frequently asked