SSH & Keys

PPK to PEM Converter

PPK to PEM

Convert PPK to PEM

Paste or upload your PuTTY .ppk private key to convert it to OpenSSH PEM format.

PPK passphraseif encrypted

How to Use This Tool

Moving from Windows/PuTTY to Linux, macOS, or AWS? Here's how to convert your key in 4 easy steps.

1
Get your PPK key

Open PuTTYgen on Windows, load your existing key or export it. You'll find .ppk files created by PuTTY or downloaded from cloud dashboards.

2
Paste or upload

Paste the PPK content directly into the text area, or use the Upload tab to select the .ppk file from your machine.

3
Convert

Click "Convert to PEM". If your key is passphrase-protected, enter it when prompted. The conversion runs server-side and the key is never stored.

4
Use on Linux / macOS / AWS

Download the PEM file. Use it with OpenSSH: ssh -i key.pem user@host. For AWS EC2, set permissions with chmod 400 key.pem first.

Learn more

Guides & explainers related to this tool

Guide

How to Convert PPK to PEM

Full step-by-step, online or with puttygen.

Article

PEM vs PPK: SSH Key Formats Compared

PPK v2 vs v3 and which format each tool needs.

Tool features

Comprehensive SSH key conversion with security focus
4 features

PPK to PEM conversion

Turns a PuTTY key into the OpenSSH form that ssh, scp, git and Ansible expect.

Passphrase preserved

An encrypted PPK produces an encrypted PEM — the protection carries across.

PPK v2 and v3

Both PuTTY container versions are read automatically; there is nothing to select.

Format validation

Malformed or truncated PPK files are caught up front with a specific error.

What PPK to PEM conversion does & how it works

Taking a PuTTY key back to OpenSSH

A PPK file is PuTTY's own private-key container. It works well inside PuTTY, Pageant and WinSCP, but nothing else reads it — ssh, scp, rsync, git, Ansible, and every cloud console expect the OpenSSH/PEM form instead. Moving a key off Windows almost always means converting it first.

The conversion is lossless and does not touch the key material, so the public key and fingerprint are identical afterwards. Any server that already trusts the key continues to accept it — you are changing the file on your side only, not the credential the server knows about.

PPK
PuTTY Private Key. Starts with PuTTY-User-Key-File- followed by a version number.
PEM
The OpenSSH-compatible form that belongs in ~/.ssh/, starting -----BEGIN …PRIVATE KEY-----.
chmod 600
SSH refuses a private key that other users can read, so the converted file needs its permissions tightened after download.
PPK version
PuTTY 0.75+ writes version 3 files; older tooling may expect version 2. The version affects the container, not the key inside.

How to use this tool

Convert a PuTTY key for OpenSSH in four steps
1
Provide the PPK file
Paste the contents or upload the .ppk. A valid file starts with PuTTY-User-Key-File-2 or -3.
2
Enter the passphrase if the key is encrypted
PuTTY-protected keys need their passphrase before they can be read. It carries over to the converted PEM.
3
Convert
Run the conversion. The key type and PPK version are read from the file, so there is nothing to select.
4
Install the PEM key
Download it into ~/.ssh/, then run chmod 600 on it — OpenSSH refuses keys with permissions that let other users read them.

Related tools

Keep debugging with tools from the same suite
3 tools
PEM to PPK Converter
Convert PEM format SSH keys to PuTTY PPK format for Windows SSH clients
SSH Key Converter
Convert SSH keys between different formats (OpenSSH, PuTTY PPK, PEM)
SSH Key Generator
Generate SSH key pairs (RSA, ECDSA, Ed25519) for secure server authentication

Frequently asked questions

Common questions about PPK and PEM key formats
10 Q&A

The usual causes are: (1) the file is not a valid PPK — check it starts with PuTTY-User-Key-File; (2) the key is passphrase-protected and the passphrase was missing or wrong; (3) the file is corrupted or truncated, often from copying only part of it.

A PPK (PuTTY Private Key) file is the format used by PuTTY and related Windows tools — WinSCP, FileZilla, Pageant — to store private SSH keys. It is PuTTY-specific and not readable by OpenSSH. PEM is the standard form used by OpenSSH, Linux, macOS, AWS and most Unix tooling.

PPK is PuTTY-specific. OpenSSH clients — ssh, scp, git, Ansible, and the SSH support built into most CI systems — only read PEM/OpenSSH keys and will not recognise a PPK no matter where you put it. Converting produces a file those tools accept.

No. The private key material is unchanged, so the derived public key and fingerprint are identical. Every authorized_keys entry keeps working and there is nothing to update on the server.

Nine times out of ten it is file permissions. Run chmod 600 ~/.ssh/your-key and chmod 700 ~/.ssh — OpenSSH deliberately refuses a private key that is group- or world-readable, and the "UNPROTECTED PRIVATE KEY FILE" warning is easy to miss in a wall of output.

PPK v2 uses HMAC-SHA-1 for integrity and AES-256-CBC for passphrase encryption. PPK v3, introduced in PuTTY 0.75, uses Argon2 — a memory-hard key derivation function — making brute-force attacks much harder. Both convert here. Note that v3 keys may not be accepted by older tools such as some WinSCP or CI/CD versions; if you hit that, re-save as v2 in PuTTYgen.

This tool converts PPK private keys to OpenSSH PEM private keys. A public key is not a PPK file — it is plain text, usually a .pub, and needs no conversion. To derive the public key from the converted PEM, run ssh-keygen -y -f key.pem > key.pem.pub.

Yes. Supply the passphrase for an encrypted PPK and the resulting PEM is written with the same one. Load it into ssh-agent with ssh-add so you only type it once per session.

Yes — the PEM to PPK converter goes the other way, and round-tripping is lossless. Many people keep both formats: PPK for PuTTY on Windows, PEM for WSL and command-line tooling.

It is not stored and not logged. Conversion runs on our server using puttygen, which requires a file path — so the key is written to a temporary file, converted, and unlinked immediately afterwards. It does cross the network, so prefer this for test and lab keys. To keep a production key entirely on your machine, convert locally with puttygen key.ppk -O private-openssh -o key.pem, or PuTTYgen's Conversions → Export OpenSSH key on Windows.