How to Add an SSH Key with PuTTY on Windows?

Logging in with an SSH key is standard practice when you administer a server or use hosting and VPS at Nodea. This guide walks you through, step by step, how to generate a key pair in PuTTYgen on Windows, upload the public key to your server and log in through PuTTY without typing a password.

What is an SSH key and what does it consist of?

An SSH key is a pair of two files — a private key and a public key — that together let you log in to a server without entering a password. Logging in with an SSH key is more secure than a password alone, because a cryptographic key cannot be guessed or cracked by brute force. The two files fit together like a key and a lock:

• the private key stays on your computer and you never share it with anyone,
• the public key goes onto the server, into the list of authorized keys.

We cover the whole process step by step below. One point up front: PuTTY is a program (a client) for connecting over SSH, not the protocol itself — more on that in the next section. The key pair uses the RSA algorithm with a length of at least 2048 bits.

Why do you need PuTTY on Windows?

PuTTY is a free SSH client for Windows — you need it because older Windows versions can't connect over SSH on their own. An SSH client gives you a terminal window through which you issue commands on the remote server. Windows 10 and 11 already include built-in OpenSSH in Command Prompt, but PuTTY remains the most convenient tool for saving sessions and working with keys.

PuTTY isn't a single file — the package ships several tools: PuTTYgen for generating and converting keys, PSCP for copying files and Pageant (an agent that keeps your key in memory). You can download PuTTY from the official project site at putty.org. After installation you have immediate access to PuTTYgen, which you'll use in the next step. If you want to understand the underlying SSH connection to a server first, see our glossary.

Generate an SSH key in PuTTYgen

How do you generate an SSH key in PuTTYgen? Open PuTTYgen, click Generate, set at least 2048 bits and save the private key as a .ppk file. Here is the full sequence:

1. Open PuTTYgen (the PUTTYGEN.EXE file from the PuTTY package).
2. In the Parameters section at the bottom, set the key length to at least 2048 bits (the Number of bits in a generated key field).
3. Click the Generate button in the Actions section.
4. Move your mouse around the blank area of the window — this randomness feeds the key generation. The progress bar will fill up.
5. Copy the public key from the box at the top of the window (Public key for pasting…) — it begins with ssh-rsa. You'll need it in the next step.
6. Click Save private key and save the private key to disk as id_rsa.ppk.
7. Optionally, set a passphrase in the Key passphrase fields — you'll then enter it on every login.

PuTTYgen is the only tool in the package that creates a key pair: the private key in .ppk format and the public key in ssh-rsa format. Don't close the window until you've uploaded the public key to the server.

Already have a key from Linux? Import it into PuTTY

Already generated an SSH key on Linux? Copy the id_rsa file to Windows and import it in PuTTYgen through the Conversions menu — no need to generate a new one.

1. Copy the private key id_rsa from Linux to your Windows machine.
2. In PuTTYgen, choose Conversions › Import Key from the top menu and select the copied file.
3. Save it in PuTTY format with Save private key as id_rsa.ppk.

We cover generating the key on the Linux side separately — if you work across both systems, see how to add an SSH key on Linux.

Upload the public key to the server's authorized_keys file

How do you upload the public key to the server? Log in to the server through PuTTY and paste the public key into the ~/.ssh/authorized_keys file. Without this step, key-based login won't work.

1. Copy the entire public key from the PuTTYgen window — from ssh-rsa to the very end of the line.
2. Log in to the server through PuTTY with your current credentials (username and password).
3. Open or create the key list file with vi ~/.ssh/authorized_keys (if the .ssh directory doesn't exist, create it first: mkdir -p ~/.ssh).
4. Paste the public key into the file, then save and close the editor.
5. Set file permissions so the group and other users have no write access — the simplest way is chmod 600 ~/.ssh/authorized_keys.
6. Log out of the server with exit.

The actual "adding the key" is exactly this step: pasting the public key into ~/.ssh/authorized_keys on the server. Overly loose permissions on that file are one of the most common reasons the server rejects the key, so don't skip the chmod command. If you more often copy whole files to the server, see how to connect to an FTP account.

Log in to the server with the private key in PuTTY

How do you log in with a key in PuTTY? In the connection settings, point to the .ppk private key file under Connection › SSH › Auth, then connect to the server.

1. Open PuTTY and enter the server hostname or IP address in the Session section.
2. In the left-hand tree go to Connection › SSH › Auth (in newer versions: Auth › Credentials).
3. In the Private key file for authentication field, click Browse and select the id_rsa.ppk file you saved earlier.
4. Return to Session, click Open to connect, and enter your username.
5. If you didn't set a passphrase, you'll log in without a password — just the username.

The .ppk private key is the only file PuTTY needs to authenticate. It's worth saving the whole session (the Save button in the Session section) so you don't have to point to the key again next time.

What to do when you get the "Server refused our key" error

Seeing the "Server refused our key" message? Most often you're logging in as the wrong user or you pasted the public key into authorized_keys incorrectly. Check three things in order:

• Whether you're logging in as the correct user — a public key only works for the account whose home directory holds the authorized_keys file.
• Whether the public key was pasted in full, on a single line, with no stray spaces or line breaks.
• Whether authorized_keys has the correct permissions (chmod 600) and the ~/.ssh directory has chmod 700.

How to generate an SSH key via the command line (cmd)?

How do you generate an SSH key without PuTTYgen? Open Command Prompt (cmd), type ssh-keygen and the key is created in your user folder. This method works on newer Windows with built-in OpenSSH.

1. Open Command Prompt: press Windows+R, type cmd and confirm with Enter.
2. Type ssh-keygen and confirm each prompt with Enter (file location, optional passphrase).
3. The key is created in C:\Users\username\.ssh.
4. The file ending in .pub is the public key — place it on the server in ~/.ssh/authorized_keys.
5. To log in from PuTTY, the private key needs .ppk format — open it in PuTTYgen (Conversions › Import Key) and save it as id_rsa.ppk.

Newer Windows has built-in OpenSSH, so you don't always need PuTTYgen just to generate a key — but to log in from PuTTY you still convert the private key to .ppk format. If the connection still fails after these steps, the Nodea team helps configure access as part of Linux administration support.