PPK vs PEM: Complete Guide to SSH Key Formats, Differences and Conversion

PEM (.pem) is the standard OpenSSH private key format. It is what AWS, DigitalOcean, Google Cloud and every major cloud provider give you when you create a key pair. PEM works natively on Linux, macOS, Windows OpenSSH, Git, and all CI/CD tools. PPK (.ppk) stands for PuTTY Private Key and is a proprietary format used exclusively by PuTTY and its companion tools on Windows. PuTTY cannot read PEM files directly, so you must convert PEM to PPK using PuTTYgen before connecting. Both formats contain the same underlying private key — conversion only changes the file encoding, not the key itself.

Rule of thumb: keep the PEM file as your master key. Only convert to PPK when you specifically need to use PuTTY on Windows. If you use the built-in ssh command in PowerShell or Windows Terminal, or Git Bash on Windows, you do not need PPK at all — PEM works directly.

The table below covers every tool and platform so you can find your exact situation at a glance:

PEM stands for Privacy Enhanced Mail. The name is historical — PEM files have nothing to do with email. In practice a PEM file is a Base64-encoded text container used to store SSH private keys, public keys, and SSL/TLS certificates. You can open a PEM file in any text editor and see the Base64 content between the header and footer lines.

PEM is the native format of OpenSSH, which is used by Linux, macOS, Windows 10 and 11 (via the built-in OpenSSH feature), Git, GitHub, and every modern cloud CLI. When you create a key pair in the AWS EC2 console and click Download, the file you receive is a .pem file. The same format is used by DigitalOcean, Google Cloud, Azure, and Linode.

On Linux and macOS you use PEM keys directly. Set permissions first, then connect: chmod 400 my-key.pem and then ssh -i my-key.pem ubuntu@server-ip. On Windows with built-in OpenSSH, the same command works in PowerShell: ssh -i .my-key.pem ubuntu@server-ip. No conversion needed.

PPK stands for PuTTY Private Key. PPK is a proprietary format created by the PuTTY project to store SSH private keys on Windows. The PPK full form in AWS documentation and tutorials always means PuTTY Private Key. AWS guides for Windows users specifically mention converting the downloaded .pem file to .ppk format because AWS only provides PEM keys and PuTTY cannot read them directly.

PuTTY is the most widely used third-party SSH terminal on Windows. Before Microsoft added OpenSSH to Windows 10 in 2018, PuTTY was the primary way to SSH from Windows at all. Because PuTTY predates modern OpenSSH conventions, it uses its own key format. The PuTTYgen tool (included with every PuTTY download) handles creating and converting PPK files.

PPK files only work within the PuTTY ecosystem: PuTTY (the terminal emulator), WinSCP (the graphical file transfer client), Pageant (the SSH agent that holds keys in memory so you do not retype the passphrase), and plink (the command-line PuTTY used in scripts). No other SSH tool recognises PPK format.

On Linux or macOS: always PEM. Every SSH tool on Linux and macOS reads PEM natively. There is no reason to use PPK on these platforms.

On Windows with PuTTY: you need PPK. Convert the PEM to PPK once using PuTTYgen. Keep both files. Use PPK in PuTTY and WinSCP, and PEM for everything else.

On Windows with built-in OpenSSH: PEM. Windows 10 (version 1809 and later) and Windows 11 include OpenSSH. Open PowerShell and run ssh -i .my-key.pem ubuntu@server-ip. If the ssh command is not found, go to Settings, Apps, Optional features, Add a feature, and install OpenSSH Client. No PPK needed.

On Windows with Git Bash: PEM. Git for Windows ships with OpenSSH. PEM keys work in Git Bash exactly like on Linux.

On Windows with VS Code Remote SSH: PEM. Configure the key path in ~/.ssh/config and VS Code connects using OpenSSH.

AWS EC2 always generates key pairs in PEM format. When you launch an instance and create a new key pair, the file you download is a .pem file named something like my-ec2-key.pem. AWS documentation covers two connection paths depending on your OS and SSH client.

If you are on Linux or macOS, or using Windows with PowerShell or Git Bash, use the PEM file directly. If you are on Windows and use PuTTY, you must convert the PEM to PPK first using PuTTYgen. AWS provides step-by-step instructions for this conversion in the EC2 documentation under Connecting to your Linux instance using PuTTY.

A practical recommendation for AWS users: download the PEM file, store it securely, and convert to PPK only if you use PuTTY. If you install Windows OpenSSH or Git Bash, you can use the PEM file directly on Windows and skip the conversion entirely.

Step 1: Download PuTTY from putty.org and run the installer. PuTTYgen is included — no separate download needed. After installation, find PuTTY Key Generator in the Start menu or search for puttygen.

Step 2: Open PuTTYgen. You will see a window with a key type selector (RSA is default) and a Generate button. Do not click Generate — you are loading an existing key, not creating a new one.

Step 3: Click Load. In the file dialog, change the file type filter from PuTTY Private Key Files (*.ppk) to All Files (*.*). This is the step people most often miss. Without changing the filter your .pem file will not appear in the list.

Step 4: Navigate to your .pem file and click Open. PuTTYgen imports the key and shows the fingerprint. If the key is passphrase-protected, enter the passphrase when prompted.

Step 5: Click Save private key. When PuTTYgen asks whether you want to save without a passphrase, click Yes if your key has no passphrase, or add one now for extra security. Save the file with a .ppk extension. The file is ready to use in PuTTY and WinSCP.

On Linux, install putty-tools to get the command-line puttygen. On macOS, install putty via Homebrew. The conversions are single commands:

To use a PPK file in PuTTY: open PuTTY, enter the server IP in Host Name, set Port to 22, then in the left panel go to Connection, then SSH, then Auth, then Credentials. In the Private key file for authentication field, click Browse and select your .ppk file. Back in Session, type a name in Saved Sessions and click Save so you do not need to reconfigure this every time.

plink is the command-line version of PuTTY for Windows automation and deployment scripts. It reads PPK files with the -i flag:

WARNING: UNPROTECTED PRIVATE KEY FILE or bad permissions: the PEM file is readable by other users. Run chmod 400 my-key.pem on Linux or macOS to restrict it to owner-read-only. On Windows with OpenSSH, right-click the file, open Properties, go to Security, click Advanced, disable inheritance, remove all entries except your own account, and grant Read permission only.

Unable to load key file in PuTTY: you are loading a .pem file directly into PuTTY. PuTTY cannot read PEM format. Convert it to PPK using PuTTYgen first, then load the .ppk file in PuTTY under Connection, SSH, Auth.

PuTTYgen: not a recognised key file: the PEM file has Windows CRLF line endings. Open a Linux terminal and run dos2unix my-key.pem to convert line endings, then retry the import in PuTTYgen.

Invalid private key or No supported authentication methods: the PPK file header starts with PuTTY-User-Key-File but the tool expects a PEM file. Convert back to PEM using puttygen -O private-openssh or PuTTYgen Conversions menu.

Permission denied (publickey): the key file is readable but the server does not accept it. The public key must be in ~/.ssh/authorized_keys on the server. Check that you are using the correct username (ubuntu for Ubuntu, ec2-user for Amazon Linux) and that the public key fingerprint matches.

A private key file grants SSH access to every server that has the matching public key. Treat it with the same care as a password. Never commit PEM or PPK files to a git repository, upload them to public cloud storage, or share them in Slack or email.

Add *.pem and *.ppk to your global git ignore file immediately: echo "*.pem" >> ~/.gitignore_global and git config --global core.excludesfile ~/.gitignore_global. For CI/CD pipelines, store the key content in an environment variable or secret manager (GitHub Actions Secrets, AWS Secrets Manager, HashiCorp Vault) rather than as a file.

Always add a passphrase when generating or saving a PPK file. Use Pageant (the PuTTY SSH agent) to enter the passphrase once per Windows session — Pageant holds the decrypted key in memory so you do not retype it for every PuTTY or WinSCP connection. On Linux and macOS, ssh-agent serves the same role for PEM keys.