PEM to PPK Converter

Complete technical guide

PEM to PPK: Why and How to Convert an SSH Key for PuTTY

What Is a PEM File?

PEM (Privacy-Enhanced Mail) is the near-universal text container for SSH private keys on Linux, macOS, and in cloud provider consoles — base64 DER data wrapped in -----BEGIN ... PRIVATE KEY----- / -----END ... PRIVATE KEY----- lines. An RSA key is typically PKCS#1 (-----BEGIN RSA PRIVATE KEY-----) or the more generic PKCS#8 (-----BEGIN PRIVATE KEY-----). This is the format ssh-keygen, AWS/GCP/Azure, GitHub, and most Linux tooling hand you by default.

What Is a PPK File?

A .ppk file is PuTTY's own private key container — a plain-text format with a header naming the algorithm and format version, an Encryption: field, a free-text Comment:, the public key as base64 (Public-Lines), the private key as base64 (Private-Lines), and a Private-MAC line that lets PuTTY detect a corrupted file or wrong passphrase before ever using the key.

PEM vs PPK: The Real Difference

Both are just containers around the same RSA key material — converting between them changes the file format only, never the cryptographic key itself or what it's capable of. The practical difference is ecosystem: PEM is what OpenSSH, cloud consoles, and Linux/macOS tooling expect; PPK is what the PuTTY family of Windows SSH tools expects. This tool bridges the two without regenerating a new key pair, so every server, Git host, and CI secret that already trusts your existing key keeps working unchanged.

Why Convert PEM to PPK?

The most common trigger: a key generated on a Linux server, in a cloud console, or via ssh-keygen now needs to authenticate from a Windows machine using PuTTY, WinSCP, or FileZilla — none of which read a raw .pem file directly. Rather than generating a brand-new key pair (and updating every server's authorized_keys to match), converting the existing key preserves its identity while making it usable in the PuTTY ecosystem.

PuTTY, WinSCP & FileZilla

PuTTY is the classic Windows SSH terminal client; WinSCP and FileZilla are SFTP/SCP file-transfer clients popular on Windows. All three — plus PuTTY's own SSH agent, Pageant — authenticate using the PPK format natively, which is exactly why a converted key from this tool loads into any of them without extra steps.

How the Conversion Works

This tool parses your PEM using the same DER/ASN.1 structure OpenSSL and OpenSSH use, extracts the RSA key's public exponent, modulus, private exponent, and CRT parameters, then writes them out using PuTTY's own SSH wire-format encoding (length-prefixed integers, called "mpints") for the Public-Lines and Private-Lines sections. Finally, it computes the Private-MAC the same way PuTTYgen does — an HMAC-SHA1 over the concatenated algorithm name, encryption state, comment, and key blobs, keyed by a SHA-1 hash of a fixed label string — so PuTTY's own integrity check passes cleanly.

What This Tool Supports Today

• Unencrypted RSA keys in PKCS#1 (BEGIN RSA PRIVATE KEY) or PKCS#8 (BEGIN PRIVATE KEY) form — by far the most common case for keys already sitting on a Linux server or downloaded from a cloud console.
• PPK format v2 output, accepted by every current release of PuTTY, WinSCP, and plink.

What's Not Supported Yet

• Modern OpenSSH-format keys (BEGIN OPENSSH PRIVATE KEY) — convert to classic PEM first with ssh-keygen -p -m PEM -f yourkey, then paste the result here.
• Passphrase-encrypted PEM keys — remove the passphrase first (ssh-keygen -p), then convert.
• ECDSA and Ed25519 keys, and PPK v3 output — for these, and for the reverse direction with full algorithm coverage, use ToolAdda's PPK to PEM Converter.

Common Errors

• "This is a new OpenSSH-format key" — you pasted a BEGIN OPENSSH PRIVATE KEY file; convert it to classic PEM first as noted above.
• "Passphrase-encrypted PEM keys are not supported" — strip the passphrase with ssh-keygen -p before converting.
• "Unable to load key" in PuTTY after conversion — extremely rare with a correctly-generated PPK; double-check you copied the entire output including the final Private-MAC: line if you used copy/paste rather than Download.

Security Best Practices

1. Set a passphrase on the converted PPK afterward (open it in PuTTYgen, add a passphrase, re-save) if it will live on disk for any length of time.
2. Never commit a private key, in either format, to a Git repository — even a private one.
3. Delete the plaintext .pem copy once you've confirmed the .ppk works, if you don't need both formats going forward.
4. Restrict file permissions on both the original PEM and the converted PPK to your own account only.

Developer Tips

• Keep the original PEM around if you also work from Linux/macOS or CI — PuTTY only needs the PPK copy.
• Use Ctrl+Enter after pasting a key into the box as a quick keyboard shortcut to convert.
• If PuTTY reports a corrupt key file after conversion, re-copy the PEM source carefully — a missing header/footer line is the most common cause, not a bug in the MAC computation.