SSH & Keys

PEM to PPK Converter

PEM to PPK

Convert PEM to PPK

Paste or upload your OpenSSH PEM private key to convert it to PuTTY's PPK format.

Passphraseoptional

Learn more

Guides & explainers related to this tool

Article

PEM vs PPK: SSH Key Formats Compared

Why OpenSSH and PuTTY use different key files.

Guide

How to Convert PPK to PEM

Take a PuTTY key back to OpenSSH for Linux/macOS/AWS.

Tool features

Comprehensive SSH key conversion with security focus
4 features

PEM to PPK conversion

Repackages an OpenSSH or PEM private key into the container PuTTY expects.

Passphrase preserved

An encrypted source key produces an encrypted PPK — the protection carries across.

Key type detected

RSA, ECDSA and Ed25519 are recognised automatically; there is nothing to configure.

Format validation

Malformed or truncated keys are caught up front with a specific error.

What PEM to PPK conversion does & how it works

Why PuTTY needs its own key container

PuTTY does not read OpenSSH private keys. It expects its own container — PPK (PuTTY Private Key) — so a key generated with ssh-keygen, downloaded from a cloud provider, or handed to you as a .pem file has to be repackaged before PuTTY, Pageant, or WinSCP will accept it.

Conversion does not change the key itself. The same private key material comes out the other side in a different wrapper, so the public key and fingerprint are unchanged and every server that already trusts the key keeps working. Nothing needs to be reinstalled on the server side.

PEM
The OpenSSH-side format, starting -----BEGIN …PRIVATE KEY-----. What Linux, macOS, and AWS hand you.
PPK
PuTTY's own format, used by PuTTY, Pageant, WinSCP, and PSFTP on Windows.
Passphrase
If the source key is encrypted, the passphrase is needed to read it — and carries across to the converted PPK.
Fingerprint
Unchanged by conversion, because the underlying key material is identical. A useful way to confirm the output is the same key.

How to use this tool

Convert an OpenSSH key for PuTTY in four steps
1
Provide the PEM key
Paste the private key or upload the file. It should begin with -----BEGIN OPENSSH PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----.
2
Enter the passphrase if the key is encrypted
An encrypted key cannot be read without it. The passphrase carries over, so the resulting PPK stays protected too.
3
Convert
Run the conversion. The key type and length are detected automatically — there is nothing to configure.
4
Download the .ppk and load it
Save the file, then point PuTTY at it under Connection → SSH → Auth → Credentials, or add it to Pageant so it is offered automatically.

Related tools

Keep debugging with tools from the same suite
3 tools
PPK to PEM Converter
Convert PuTTY PPK format SSH keys to PEM format for Linux/Mac SSH clients
SSH Key Converter
Convert SSH keys between different formats (OpenSSH, PuTTY PPK, PEM)
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication

Frequently asked questions

Common questions about PEM and PPK key formats
7 Q&A

PuTTY only reads its own PPK container. An OpenSSH or PEM key is the same key in a different wrapper, and PuTTY will reject it with an unhelpful error until it is converted. This tool does the same job as PuTTYgen's Load → Save private key flow, without installing anything.

No. The private key material is identical afterwards — only the file format differs — so the public key and fingerprint stay the same and every authorized_keys entry keeps working. You do not need to touch the server.

Yes. If you supply the passphrase for an encrypted source key, the resulting PPK is written with the same passphrase, so it stays encrypted at rest. A key with no passphrase converts to a PPK with no passphrase.

Yes — use the PPK to PEM converter. Round-tripping is lossless because both formats hold the same key material.

RSA, ECDSA and Ed25519 all convert. Ed25519 needs a reasonably current PuTTY — support landed in 0.75 — so if an Ed25519 PPK is rejected, check your PuTTY version before suspecting the key.

The key is processed on our server and discarded immediately; it is not stored or logged. That said, a private key is a credential and it does cross the network here, so this is best suited to test and lab keys. For a production key, install PuTTYgen and convert locally — the key never leaves your machine that way.

Pageant is PuTTY's key agent, the Windows equivalent of ssh-agent. Loading your PPK into it once means PuTTY, WinSCP and PSFTP can all use the key without prompting for the passphrase on every connection. It is optional but saves a lot of typing.