Generate an SSH key on Windows with ssh-keygen (built into Windows 10+), PuTTYgen (for the PuTTY ecosystem), or WSL. The easy way: ssh-keygen with no arguments and the defaults.
Table of contents
- The easy way: ssh-keygen
- The right way: ed25519 keys
- Copy the public key to the server
- The PuTTY way (PuTTYgen)
- The WSL way
- What usually breaks
- The Windows OpenSSH architecture
- The PuTTY ecosystem
- FAQ
The easy way: ssh-keygen
Windows 10 (1809+) and Windows 11 ship with OpenSSH built-in. Open PowerShell or Command Prompt and run:
ssh-keygenPress Enter three times to accept the defaults (file location ~/.ssh/id_rsa, no passphrase). The result: a public key at ~/.ssh/id_rsa.pub and a private key at ~/.ssh/id_rsa.
The team that wants a passphrase (more secure) types one when prompted. The team that wants a custom filename types the path.
The right way: ed25519 keys
The default is RSA 3072. The stronger choice is ed25519:
ssh-keygen -t ed25519 -C "[email protected]"ed25519 keys are shorter, faster, and considered more secure than RSA. Most modern SSH servers accept them. The team that uses ed25519 has the modern best practice.
Copy the public key to the server
The right tool for copying the key:
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@host "cat >> ~/.ssh/authorized_keys"Or, if ssh-copy-id is available (it ships with Git for Windows and modern OpenSSH):
ssh-copy-id user@hostThen test:
ssh user@hostIf the prompt for password is gone, the key-based auth works.
The PuTTY way (PuTTYgen)
For the team that uses PuTTY (older but still common on Windows):
- Download PuTTY from putty.org.
- Open PuTTYgen.
- Click “Generate” and move the mouse to generate randomness.
- Save the public key and private key (.ppk format).
- The private key (.ppk) is loaded by PuTTY for SSH connections.
The team that uses PuTTY loads the .ppk in PuTTY’s SSH > Auth settings. The team that uses OpenSSH converts the .ppk with puttygen id.ppk -O private-openssh -o id_rsa.
The WSL way
For the team that has WSL (Windows Subsystem for Linux) installed:
ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pubCopy the public key to the server. The private key stays in WSL. The team that uses WSL has a Linux environment that integrates with the Windows filesystem, so the keys can be used from either side.
What usually breaks
The four pitfalls:
- Wrong file location. The default in Windows OpenSSH is
%USERPROFILE%\.ssh\id_rsa, not~/.ssh/id_rsa. The team that uses the wrong path has SSH look in the wrong place. - Wrong file format. PuTTY uses .ppk; OpenSSH uses PEM. The team that copies a .ppk to authorized_keys has SSH refuse it.
- Wrong line endings. A Windows-edited authorized_keys has CRLF line endings; SSH expects LF. Convert with
dos2unixor use Notepad++ to save as Unix. - Permissions wrong. SSH refuses to use keys with too-permissive permissions.
icacls %USERPROFILE%\.ssh\id_rsa /inheritance:r /grant:r "%USERNAME%:(R)".
The Windows OpenSSH architecture
Windows 10 (1809+) and Windows 11 include OpenSSH as an optional feature:
SSH client. ssh.exe in C:\Windows\System32\OpenSSH\. Same OpenSSH as Linux.
SSH server. sshd.exe in the same directory. Configurable via C:\ProgramData\ssh\sshd_config.
SSH agent service. ssh-agent.exe. Manage with Start-Service ssh-agent.
ssh-keygen. For generating keys.
sftp.exe. For SFTP transfers.
Install via Settings → Apps → Optional Features → OpenSSH Client (or Server). The team that installs OpenSSH on Windows has the same tools as Linux.
For older Windows versions (Windows 7, 8), the team that needs OpenSSH uses:
- Git for Windows. Includes OpenSSH in
C:\Program Files\Git\usr\bin\. - WSL (Windows Subsystem for Linux). Full Linux environment with native OpenSSH.
- Cygwin. Linux-like environment with OpenSSH.
The team that uses one of these has working SSH on any Windows version.
The PuTTY ecosystem
PuTTY is older but still widely used. The PuTTY ecosystem:
- PuTTY. The SSH client itself.
- PuTTYgen. Key generator.
- Pageant. SSH authentication agent.
- PSCP / PSFTP. Command-line secure copy and SFTP.
PuTTY uses .ppk (PuTTY Private Key) format for private keys. OpenSSH uses PEM format. Conversion:
puttygen id.ppk -O private-openssh -o id_rsaThe team that has both .ppk and OpenSSH keys can convert between them. The team that uses PuTTY for the SSH client but OpenSSH keys has the modern key format with the legacy client.
FAQ
Where are SSH keys stored on Windows?
At %USERPROFILE%\.ssh\ by default. The full path is C:\Users\YourName\.ssh\.
Should I use RSA or ed25519?
ed25519. It’s shorter, faster, and considered more secure. Most modern SSH servers support it. The team that uses RSA is fine; the team that uses ed25519 has the modern best practice.
Should I use a passphrase?
Yes, if you can. A passphrase protects the private key if the laptop is stolen. The team that uses ssh-agent with the key cached has the convenience of no passphrase with the security of one.
How do I use the same SSH key on multiple Windows machines?
Copy the private key (id_rsa or id_ed25519) to the new machine’s .ssh directory with the right permissions. Or use ssh-agent and forward the key from a single machine.
Can I use the same SSH key on Windows and WSL?
Yes. Copy the private key from %USERPROFILE%\.ssh\ to ~/.ssh/ in WSL. The team that uses the same key has the simplest key management.
Does Windows have ssh-agent?
Yes, built into Windows 10+ OpenSSH. Run Start-Service ssh-agent to start it. Set Set-Service ssh-agent -StartupType Automatic to start on boot. The team that uses ssh-agent doesn’t have to type passphrases.
What’s the difference between Windows OpenSSH and Git for Windows OpenSSH?
Windows OpenSSH (the optional feature) is signed by Microsoft. Git for Windows OpenSSH is bundled with Git; it’s the Cygwin version. Both work; the team that uses Windows OpenSSH has the better integration with the OS.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: