How to Use a PPK File in PuTTY

A PPK file is PuTTY’s private key format. If you are connecting to a Linux server or AWS EC2 instance from Windows using PuTTY, this is the file format PuTTY expects for key-based SSH access.

Many hosting providers and cloud platforms give you a PEM file first. If you use PuTTY, you often convert that PEM file into a PPK file with PuTTYgen before trying to connect.

Before using a PPK file in PuTTY, make sure you have the target server IP or hostname, the correct SSH username, and the private key file already converted into PPK format. You also need PuTTY installed on your Windows machine.

For AWS EC2, the username depends on the image you launched. Common examples include ubuntu, ec2-user, admin, and root, depending on the server setup.

Open PuTTY and enter the server IP or hostname in the Host Name field. Leave the port as 22 unless your server uses a custom SSH port. Then, in the left sidebar, expand Connection, expand SSH, and click Auth.

In the Auth section, look for the private key file field and browse to your PPK file. Select it, then go back to the Session tab. At that point, you are ready to connect or save the session for later use.

If you will connect regularly, save the session so you do not have to re-enter the server host and key file path every time. In the Session section, enter a name under Saved Sessions and click Save.

This is especially helpful if you manage multiple servers from Windows and want each one to keep its own key association and host settings.

The first time you connect, PuTTY may show a server host key warning. This is normal when the host has not been seen before on your machine. Verify that the server is the one you expect, then accept the key and continue.

After that, PuTTY will open the terminal session and prompt you for the username if it was not already supplied in the session settings.

Most PuTTY SSH problems are caused by the wrong username, a server firewall issue, or the wrong private key. If PuTTY says access denied or authentication failed, double-check that the PPK file matches the server and that you are using the correct login user.

If PuTTY times out, confirm that the server is running, reachable publicly, and allowing inbound SSH on port 22 or your custom port.

If your cloud provider gave you a PEM file — which is common with AWS EC2 key pairs and many managed VPS services — you need to convert it to PPK before PuTTY can use it. PuTTYgen handles this conversion and ships alongside PuTTY in the same download package.

Open PuTTYgen and click Load. Change the file filter to show all files so the PEM file appears in the browser. Select the file, and PuTTYgen will read the key and display its type and fingerprint. Click Save private key and choose a location for the resulting PPK file. You can then load this PPK file into PuTTY using the Auth steps described above.

If you plan to connect to the same server frequently, save the PuTTY session after loading the PPK file. This stores the host settings and key file path together so you can reconnect with a single click from the session list. Keeping the original PEM file alongside the PPK is good practice in case you later switch to OpenSSH or a different SSH client on another machine.

One of the most frequent causes of PuTTY authentication failure is using the wrong SSH username. The username is set by the server image, not the key file. A correct PPK file combined with the wrong username produces an "Access denied" error every time, regardless of whether the key itself is valid.

For AWS EC2, the correct username depends on the AMI. Ubuntu images use ubuntu. Amazon Linux and Amazon Linux 2 use ec2-user. Debian images use admin. CentOS images typically use centos or ec2-user. RHEL images use ec2-user. Bitnami-based images use bitnami. If you launched a custom AMI or a marketplace image, check the product documentation or the instance console output for the expected login user.

For non-AWS servers, the username is usually set by your hosting provider. Most DigitalOcean, Linode, and Vultr droplets use root for fresh Ubuntu deployments. Managed panel hosts often use a custom username tied to the account. When in doubt, check the welcome email or the server console in your hosting dashboard — the correct username is almost always documented there.

If you regularly connect to more than one server from Windows, saving separate PuTTY sessions for each one significantly reduces setup friction. Each session stores the hostname, port, SSH username (if configured under Connection > Data > Auto-login username), and the path to the PPK private key file. You load the session from the list and connect immediately.

To update a saved session after changing a server IP or swapping key files, load the session, make the changes in the appropriate sections, return to the Session tab, and click Save again with the same session name. PuTTY overwrites the existing record.

For teams that manage many servers, organizing session names by environment — for example, prod-api, staging-db, dev-web — makes the PuTTY session list easier to navigate. Naming sessions consistently also reduces the risk of accidentally connecting to the wrong environment during maintenance.

If you still have a PEM file instead of a PPK, start with the PEM-to-PPK conversion guide first. If you are using AWS EC2 from Windows, the EC2 SSH tutorial is the best companion article because it explains usernames, security groups, and host key details in context.