This is an old revision of the document!
Using PuTTYgen
PuTTYgen is a key generator. It generates pairs of public and private keys to be used with WinSCP. PuTTYgen generates RSA, DSA, ECDSA, and Ed25519 keys.
- Obtaining and Starting PuTTYgen
- PuTTYgen Window
- Selecting the Type of Key
- Selecting the Size (Strength) of the Key
- The Generate Button
- The Key Fingerprint Box
- Setting a Comment for Your Key
- Setting a Passphrase for Your Key
- Saving Your Private Key to a Disk File
- Saving Your Public Key to a Disk File
- Public Key for Pasting into authorized_keys File
- Reloading a Private Key
- Dealing with Private Keys in Other Formats
Obtaining and Starting PuTTYgen
PuTTYgen is included in the WinSCP installation package. You can also download it separately from the WinSCP download page.
PuTTYgen originates from PuTTY and is also part of the PuTTY installation package. It does not matter if you use PuTTYgen from WinSCP or the PuTTY installation package, they are identical.
To start PuTTYgen, go to Tools > PuTTYgen on Login dialog.
PuTTYgen Window
When you run PuTTYgen you will see a window where you have two choices: Generate, to generate a new public/private key pair, or Load to load in an existing private key.
-----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA5Ra4qgZ+5M6warQcfNLbGbDq0Uic5dWTBopuY66CW14o4M3AN0MBKEZru08w qVua3o62ZzB/c2RJgaxun1AJrWb+Tuuf1+wm7hxxSvg1bhsGDrWIcOr3jDkTVC4HLEGeeuLxvPuZ tkRYjr3bmt3GKiasDgIljEWIpPFy237ojZfCchJtyVUoVMWNy4ViM5ZXwTbf2bdvV6DFpKBDOzmA yaOKYl90lniqVgQDN5s8EFIqYEgSJ0M/3boWe8DqF/78hpsxjwN66×2FeeP43Oiz3×9EfuMhvqZC pWUdxthH4ik77qussr5YHWmeLGzBnKHQ3e48U353uDFouVGriYXFPQIDAQABAoIBAQCE0F5xHGD2 8ClxQ0h8yZYC2AHbIZjs2pxpn1oOan7iz70tT7vPjgYevmz45BlXJmer/dscCg7p7Et9ZWWg8Tsb D+oCATLjcOLFCzJXf30if4JMhsw6gs7PuctN831vF0SJxTrx5XgFpDLykhKNAZYeBAIth38Vwe HGk1feb/JtLQ8Ebipg0qief3xhSX+QYE3Wi2Qc38ZcEbrt9uQvD1r6v3FFjZ+oO86LXGIg81Zy/h pUQYRRtjrslfS0hBl4DBkie9g6BoyfG3Nv7eF6tXeetrHmhc+CmZoQDu4wxazirpdav68Hzv49vu gFU1Yoqiv2e+QLq9SSept7GzTjj1AoGBAPfeo6oWe4v8GXp+itZx/bzeRHQFO+VJONTbLKf70qNT hh63JZJlcEYrfV/so5DlZSC/eR1zw/2rRr6PaHaVspEXx1zd0JLh6VY2Vise2T0ls07JsZlzBqJF ThjwqCPjlWbyR8XvZTSzQzZnrX1uLxNkUHnRT0FzM2fofKHp3hF3AoGBAOyaYO7eJakk4rAhVo3K aWFeBax7E4AYt2wSKJZ5+Gsy4bFmN1gJ+MFCKmTNLNjjBKo3YB2AUOKVWINxEU+A3ypAayh6Yoyk gZBk1xpWGbIJGa+kUsldqCqDf9V9y8DpD3Uti3Zfp1Li2d9ocD+KgenSIuFqs0PJCDz23T+BWWvr AoGARFAZ7zCPED+Ejhv+C6gS9FCVsRwYK9MIVLGrFwjyPo0wc5qqQjSuwsgNn7hKRA7U1jevG4zi QTFJKA/CDJypQA+7pD6F01Vrx5TmHrA70vxm9Jnl1pK7C1HqejkpPerlLCAt48FctS+KoJ3mVKFf XArTmx8ypqknS8XpQ35+83UCgYA3Bfvu8RifCmXxgf9IAD+blisJnqG9U4IsjtiDjh/4hh+4isXq In+IKiQDxzdbxQfLsg8XLUUiPIsWHlBhRd4gTFTfV/7dKFC9TMY9aLKXFci0cSmTjMVUBbrP4m5l EY43uPzK7ZnTC9CRRQ99p29o+iaEd7Ty2aihzONNJn6uOwKBgQCwhIoy99T2RtWMOD0m3txcZoLL XXSKacvl/KeLiH7PVk8/BfQkQuu8zU2kE1XyEzG2EybPSmm2mJrALIyLwj9EHkyeen0WJqGDirow 2fiG5g9jN1Qv+WjSWT0aFunRK67vZaqN+PiI0amWk96VneHAK0oeOUB/6WITw2gYK2NKUQ== -----END RSA PRIVATE KEY-----
Selecting the Type of Key
Before generating a key pair using PuTTYgen, you need to select which type of key you need. PuTTYgen currently supports these types of key:
- An RSA key for use with the SSH-2 protocol.
- A DSA key for use with the SSH-2 protocol.
- An ECDSA (elliptic curve DSA) key for use with the SSH-2 protocol.
- An Ed25519 key (another elliptic curve algorithm) for use with the SSH-2 protocol.
- An RSA key for use with the SSH-1 protocol.
The SSH-2 protocol supports more than one key type. The types supported by WinSCP are RSA, DSA, ECDSA, and Ed25519.
The SSH-1 protocol only supports RSA keys; if you will be connecting using the SSH-1 protocol, you must select the last key type or your key will be completely useless.
Selecting the Size (Strength) of the Key
The Number of bits input box allows you to choose the strength of the key PuTTYgen will generate.
For RSA, 2048 bits should currently be sufficient for most purposes.
For ECDSA, only 256, 384, and 521 bits are supported. (ECDSA offers equivalent security to RSA with smaller key sizes.)
For Ed25519, the only valid size is 256 bits.
The Key Fingerprint Box
The Key fingerprint box shows you a fingerprint value for the generated key. This is derived cryptographically from the public key value, so it doesn’t need to be kept secret; it is supposed to be more manageable for human beings than the public key itself.
The fingerprint value is intended to be cryptographically secure, in the sense that it is computationally infeasible for someone to invent a second key with the same fingerprint, or to find a key with a particular fingerprint.
Setting a Comment for Your Key
If you have more than one key and use them for different purposes, you don’t need to memorize the key fingerprints in order to tell them apart. PuTTYgen allows you to enter a comment for your key, which will be displayed whenever WinSCP or Pageant asks you for the passphrase.
The default comment format, if you don’t specify one, contains the key type and the date of generation, such as rsa-key-20011212. Another commonly used approach is to use your name and the name of the computer the key will be used on, such as simon@simons-pc.
To alter the key comment, just type your comment text into the Key comment box before saving the private key. If you want to change the comment later, you can load the private key back into PuTTYgen, change the comment, and save it again.
Setting a Passphrase for Your Key
The Key passphrase and Confirm passphrase boxes allow you to choose a passphrase for your key. The passphrase will be used to encrypt the key on disk, so you will not be able to use the key without first entering the passphrase.
When you save the key, PuTTYgen will check that the Key passphrase and Confirm passphrase boxes both contain exactly the same passphrase, and will refuse to save the key otherwise.
If you leave the passphrase fields blank, the key will be saved unencrypted. You should not do this without good reason; if you do, your private key file on disk will be all an attacker needs to gain access to any machine configured to accept that key. If you want to be able to passwordless log in without having to type a passphrase every time, you should consider using Pageant so that your decrypted key is only held in memory rather than on disk.
Under special circumstances you may genuinely need to use a key with no passphrase; for example, if you need to run an automated batch script that needs to make an SSH connection, you can’t be there to type the passphrase. In this case we recommend you generate a special key for each specific batch script (or whatever) that needs one, and on the server side you should arrange that each key is restricted so that it can only be used for that specific purpose. The documentation for your SSH server should explain how to do this (it will probably vary between servers).
Choosing a good passphrase is difficult. Just as you shouldn’t use a dictionary word as a password because it’s easy for an attacker to run through a whole dictionary, you should not use a song lyric, quotation or other well-known sentence as a passphrase. If you want your passphrase to make grammatical sense, this cuts down the possibilities a lot and you should use a longer one as a result.
Do not forget your passphrase. There is no way to recover it.
Saving Your Private Key to a Disk File
Once you have generated a key, set a comment field and set a passphrase, you are ready to save your private key to disk.
Press the Save private key button. PuTTYgen will put up a dialog box asking you where to save the file. Select a directory, type in a file name, and press Save.
This file is in PuTTY’s native format (*.PPK); it is the one you will need to tell WinSCP to use for authentication.
If you have started PuTTYgen from SSH > Authentication page of Advanced Site Settings dialog, WinSCP automatically detects the saved key and will insert its path it into Private key file box.
Saving Your Public Key to a Disk File
RFC 4716 specifies a standard format for storing SSH-2 public keys on disk. Some SSH servers (such as ssh.com’s) require a public key in this format in order to accept authentication with the corresponding private key. (Others, such as OpenSSH, use a different format)
To save your public key in the SSH-2 standard format, press the Save public key button in PuTTYgen. PuTTYgen will put up a dialog box asking you where to save the file. Select a directory, type in a file name, and press Save.
You will then probably want to copy the public key file to your SSH server machine.
If you use this option with an SSH-1 key, the file PuTTYgen saves will contain exactly the same text that appears in the Public key for pasting box. This is the only existing standard for SSH-1 public keys.
Reloading a Private Key
PuTTYgen allows you to load an existing private key file into memory. If you do this, you can then change the passphrase and comment before saving it again; you can also make extra copies of the public key.
To load an existing key, press the Load button. PuTTYgen will display a dialog box where you can browse around the file system and find your key file. Once you select the file, PuTTYgen will ask you for a passphrase (if necessary) and will then display the key details in the same way as if it had just generated the key.
If you use the Load command to load a foreign key format, it will work, but you will see a message box warning you that the key you have loaded is not a PuTTY native key. See below for information about importing foreign key formats.
Dealing with Private Keys in Other Formats
Most SSH-1 clients use a standard format for storing private keys on disk. WinSCP uses this format as well; so if you have generated an SSH-1 private key using OpenSSH or ssh.com’s client, you can use it with WinSCP, and vice versa.
However, SSH-2 private keys have no standard format. OpenSSH and ssh.com have different formats, and WinSCP’s is different again. So a key generated with one client cannot immediately be used with another.
Using the Import command from the Conversions menu, PuTTYgen can load SSH-2 private keys in OpenSSH’s format and ssh.com’s format. Once you have loaded one of these key types, you can then save it back out as a PuTTY-format key (*.PPK) so that you can use it with the WinSCP. The passphrase will be unchanged by this process (unless you deliberately change it). You may want to change the key comment before you save the key, since OpenSSH’s SSH-2 key format contains no space for a comment and ssh.com’s default comment format is long and verbose.
PuTTYgen can also export private keys in OpenSSH format and in ssh.com format. To do so, select one of the Export options from the Conversions menu. Exporting a key works exactly like saving it – you need to have typed your passphrase in beforehand, and you will be warned if you are about to save a key without a passphrase.
For OpenSSH there are two options. Modern OpenSSH actually has two formats it uses for storing private keys. Export OpenSSH key will automatically choose the oldest format supported for the key type, for maximum backward compatibility with older versions of OpenSSH; for newer key types like Ed25519, it will use the newer format as that is the only legal option. If you have some specific reason for wanting to use OpenSSH’s newer format even for RSA, DSA, or ECDSA keys, you can choose Export OpenSSH key (force new file format)//.
Note that since only SSH-2 keys come in different formats; the export options are not available if you have generated an SSH-1 key.1
You can also use WinSCP /keygen command-line switch to convert the private key from other formats.
- The text is copy of PuTTY User Manual or was inspired by it.Back