PPK vs PEM: Differences, Formats, and How to Convert Between Them

PEM (.pem) is the standard OpenSSH private key format. It is what AWS, DigitalOcean, Google Cloud, and every major cloud provider give you when you create a key pair. PEM works natively on Linux, macOS, Windows OpenSSH, Git, and all CI/CD tools. PPK (.ppk) stands for PuTTY Private Key — a proprietary format used exclusively by PuTTY and its companion tools on Windows. PuTTY cannot read PEM files directly, so you must convert PEM to PPK using PuTTYgen before connecting with PuTTY.

Both formats contain the same underlying private key. Conversion only changes the file encoding, not the key itself. The public key fingerprint stays identical, meaning the same authorized_keys entry on your server works regardless of which client you connect with.

Rule of thumb: keep the PEM file as your master copy. Only convert to PPK when you specifically need to use PuTTY on Windows. If you use the built-in ssh command in PowerShell, Windows Terminal, or Git Bash, you do not need PPK at all.

The table below covers every tool and platform so you can find your exact situation at a glance.

PEM stands for Privacy Enhanced Mail. The name is historical — PEM files have nothing to do with email today. A PEM file is a Base64-encoded text container used to store SSH private keys, public keys, and SSL/TLS certificates. You can open a PEM file in any text editor and see the Base64 content between the header and footer lines.

PEM is the native format of OpenSSH, which is used by Linux, macOS, Windows 10 and 11 (via the built-in OpenSSH feature), Git, GitHub, and every modern cloud CLI. When you create a key pair in the AWS EC2 console, the file you download is a .pem file. The same format is used by DigitalOcean, Google Cloud, Azure, and Linode.

On Linux and macOS you use PEM keys directly. Set permissions first, then connect: chmod 400 my-key.pem then ssh -i my-key.pem ubuntu@server-ip. On Windows with built-in OpenSSH, the same command works in PowerShell: ssh -i .my-key.pem ubuntu@server-ip. No conversion needed.

PPK stands for PuTTY Private Key. It is a proprietary format created by the PuTTY project for storing SSH private keys on Windows. The PPK full form in AWS documentation always means PuTTY Private Key. AWS guides for Windows users mention converting the downloaded .pem file to .ppk format because AWS only provides PEM keys and PuTTY cannot read them directly.

PuTTY is the most widely used third-party SSH terminal on Windows. Before Microsoft added OpenSSH to Windows 10 in 2018, PuTTY was the primary way to SSH from Windows. Because PuTTY predates modern OpenSSH conventions, it uses its own file format. PuTTYgen (included with every PuTTY download) handles creating and converting PPK files.

PPK files only work within the PuTTY ecosystem: PuTTY (terminal emulator), WinSCP (graphical file transfer), Pageant (SSH agent that holds keys in memory so you avoid retyping the passphrase), and plink (command-line PuTTY for scripts). No other SSH tool recognises the PPK format.

PuTTY 0.76 (released July 2021) introduced PPK version 3, which uses stronger key derivation (Argon2id) compared to the older PPK v2 format (SHA-1 based). New PPK files saved by PuTTY 0.76 and later are v3 by default. Files saved by PuTTY 0.75 and earlier are v2.

The version incompatibility only affects older PuTTY installs. If you create a PPK v3 file on a new machine and then try to load it with PuTTY 0.75 or older (or an older version of WinSCP), you will see the error Not a recognised key file format or similar. The fix is either to upgrade PuTTY to 0.76 or later on all machines, or to save the PPK file in v2 format from the PuTTYgen Export menu.

In PuTTYgen, you can force v2 format by going to Key, then Parameters for saving key file, and selecting PPK version 2 before clicking Save private key. This is useful in corporate environments where all machines cannot be updated simultaneously. If you control all machines using the PPK, upgrading to a current PuTTY version is the cleaner long-term solution.

On Linux or macOS: always PEM. Every SSH tool on Linux and macOS reads PEM natively. There is no reason to use PPK on these platforms.

On Windows with PuTTY: you need PPK. Convert the PEM to PPK once using PuTTYgen. Keep both files. Use PPK in PuTTY and WinSCP, and PEM for everything else.

On Windows with built-in OpenSSH: PEM. Windows 10 (version 1809 and later) and Windows 11 include OpenSSH. Open PowerShell and run ssh -i .my-key.pem ubuntu@server-ip. If the ssh command is not found, go to Settings, Apps, Optional features, Add a feature, and install OpenSSH Client. No PPK needed.

On Windows with Git Bash: PEM. Git for Windows ships with OpenSSH. PEM keys work in Git Bash exactly like on Linux.

On Windows with VS Code Remote SSH: PEM. Configure the key path in your SSH config file and VS Code connects using OpenSSH.

AWS EC2 always generates key pairs in PEM format. When you launch an instance and create a new key pair, the file you download is a .pem file. AWS documentation covers two connection paths depending on your SSH client.

If you are on Linux or macOS, or using Windows with PowerShell or Git Bash, use the PEM file directly. If you are on Windows using PuTTY, convert the PEM to PPK first with PuTTYgen.

A practical recommendation for AWS users: download the PEM file, store it securely, and convert to PPK only if you use PuTTY. Installing Windows OpenSSH or Git Bash lets you use the PEM file directly on Windows and skip the conversion entirely.

Step 1: Download PuTTY from putty.org and run the installer. PuTTYgen is included — no separate download needed. After installation, find PuTTY Key Generator in the Start menu.

Step 2: Open PuTTYgen. You will see a window with a key type selector and a Generate button. Do not click Generate — you are loading an existing key, not creating a new one.

Step 3: Click Load. In the file dialog, change the file type filter from PuTTY Private Key Files (*.ppk) to All Files (*.*). This is the step people most often miss — without changing the filter your .pem file will not appear in the list.

Step 4: Navigate to your .pem file and click Open. PuTTYgen imports the key and shows the fingerprint. If the key is passphrase-protected, enter the passphrase when prompted.

Step 5: Click Save private key. When PuTTYgen asks whether to save without a passphrase, click Yes if your key has none, or add one now for extra security. Save the file with a .ppk extension. The resulting file works in PuTTY, WinSCP, and Pageant.

On Linux, install putty-tools to get the command-line puttygen. On macOS, install putty via Homebrew. The conversions are single commands that work in scripts and CI/CD pipelines without a GUI.

To use a PPK file in PuTTY: open PuTTY, enter the server IP in Host Name, set Port to 22, then in the left panel go to Connection, then SSH, then Auth, then Credentials. In the Private key file for authentication field, click Browse and select your .ppk file. Back in Session, type a name in Saved Sessions and click Save to avoid reconfiguring on every connection.

In WinSCP: when creating a new site, expand the Advanced settings, go to SSH, then Authentication, and set the Private key file to your .ppk file.

plink is the command-line version of PuTTY for Windows automation scripts. It reads PPK files with the -i flag:

Both PPK and PEM formats support the same underlying SSH key algorithms. RSA 2048 and RSA 4096 are the oldest and most compatible — every SSH server and client in existence supports RSA. ED25519 is the modern recommendation: shorter key, faster to generate, faster to authenticate, and more resistant to certain side-channel attacks. ECDSA uses elliptic curve math and is faster than RSA but slightly less widely supported than ED25519 on older systems.

When generating a new key pair in PuTTYgen, the key type selector shows RSA, DSA, ECDSA, ED25519, and ED448. Select ED25519 for new keys on any server running OpenSSH 6.5 or later (which covers all modern Linux distributions). Select RSA 4096 only if you need to connect to a very old server or appliance that predates ED25519 support.

When you create an ED25519 key in PuTTYgen and save it as PPK, the resulting .ppk file contains an ED25519 key in PuTTY format. When you convert that .ppk to .pem using puttygen -O private-openssh, the output is an ED25519 key in OpenSSH format. The algorithm is preserved through conversion — only the file format changes.

WARNING: UNPROTECTED PRIVATE KEY FILE or bad permissions: the PEM file is readable by other users. Run chmod 400 my-key.pem on Linux or macOS. On Windows with OpenSSH, right-click the file, open Properties, go to Security, click Advanced, disable inheritance, remove all entries except your own account, and grant Read permission only.

Unable to load key file in PuTTY: you are loading a .pem file directly into PuTTY. PuTTY cannot read PEM format. Convert it to PPK using PuTTYgen first, then load the .ppk file under Connection, SSH, Auth.

Not a recognised key file format (PPK v3 on old PuTTY): the PPK file was saved in v3 format by a newer PuTTY, but the machine loading it has an older PuTTY version. Fix: upgrade PuTTY to 0.76 or later, or re-save the PPK in v2 format via PuTTYgen Key, Parameters, PPK version 2.

PuTTYgen: not a recognised key file when loading PEM: the PEM file has Windows CRLF line endings. Open a terminal and run dos2unix my-key.pem, then retry the import in PuTTYgen.

Permission denied (publickey): the key file is readable but the server does not accept it. Check that you are using the correct username (ubuntu for Ubuntu AMIs, ec2-user for Amazon Linux) and that the public key fingerprint matches the one in authorized_keys on the server.

A private key file grants SSH access to every server that has the matching public key. Treat it with the same care as a password. Never commit PEM or PPK files to a git repository, upload them to public cloud storage, or share them in Slack or email. One accidental push to a public GitHub repository can expose the key globally before you can delete it.

Add *.pem and *.ppk to your global git ignore file: echo "*.pem" >> ~/.gitignore_global then git config --global core.excludesfile ~/.gitignore_global. For CI/CD pipelines, store the key content as an environment variable or in a secret manager (GitHub Actions Secrets, AWS Secrets Manager, HashiCorp Vault) rather than as a file checked into the repository.

Use Pageant on Windows to avoid retyping your PPK passphrase on every connection. Pageant is a PuTTY SSH agent that holds the decrypted key in memory for the duration of your Windows session. Load the .ppk file into Pageant once, and PuTTY, WinSCP, and plink all pick it up automatically. On Linux and macOS, ssh-agent serves the same role for PEM keys.