SSH6 min read

How to Convert PPK to PEM

A PuTTY .ppk key cannot be used by OpenSSH directly. This guide converts it to PEM — online or with puttygen — so you can connect with ssh, scp, and AWS on Linux and macOS.

Moving from Windows/PuTTY to Linux, macOS, or AWS? Your .ppk key will not work with OpenSSH as-is — the ssh command needs the PEM format. Converting takes seconds and keeps the same key pair, so nothing on the server side has to change. Here are two ways to do it.

The fastest way — no installUse the browser-based PPK to PEM converter. It runs the conversion securely, never stores your key, and hands back a ready-to-use .pem file. The steps below cover both the online tool and puttygen.

Step 1 — Locate Your PPK File

Find the .ppk file you use with PuTTY, WinSCP, or Pageant. If you are not sure it is valid or whether it is passphrase-protected, you can inspect it first with the SSH Key Validator, which shows the algorithm, PPK version, and whether encryption is enabled. (New to the formats? See PEM vs PPK.)

Step 2 — Convert to PEM

Option A — Online (recommended):

  1. Open the PPK → PEM converter.
  2. Paste the PPK contents or upload the .ppk file.
  3. If the key is encrypted, enter its passphrase.
  4. Click Convert to PEM and download the result.

Option B — Command line with puttygen:

bash
# Install PuTTY tools if needed # Debian/Ubuntu: sudo apt install putty-tools # macOS (Homebrew): brew install putty # Convert PPK to an OpenSSH PEM private key puttygen key.ppk -O private-openssh -o key.pem

Step 3 — Set Correct Permissions

OpenSSH refuses private keys that other users can read, so fix the file mode before using it:

bash
chmod 600 key.pem # standard OpenSSH # For AWS EC2, use: chmod 400 key.pem
Never email or commit a private keyThe converted .pem is your secret. Keep it out of git repositories, shared drives, and chat. Store it in ~/.ssh/ and delete stray copies you no longer need.

Step 4 — Connect With the PEM Key

bash
# Standard OpenSSH login ssh -i key.pem user@your-server.com # AWS EC2 example ssh -i key.pem ec2-user@203.0.113.10 # Copy a file with scp scp -i key.pem localfile.txt user@your-server.com:/remote/path/

To avoid the -i flag every time, add the key to ~/.ssh/config:

text
Host myserver HostName your-server.com User user IdentityFile ~/.ssh/key.pem

Going the Other Way

Need to bring an OpenSSH key into PuTTY instead? Use the PEM → PPK converter. And if you would rather start fresh, the SSH Key Generator can produce a key and download it in both formats at once.