PuTTY for Developers Who Need SSH Without the Drama

PuTTY is a free SSH and telnet client for Windows (with related tools for keys and file copy). Decades after its first release, it remains what many developers reach for when they need to reach a Linux box, jump host, or legacy appliance from a corporate laptop that standardizes on Windows.

This guide covers what PuTTY is good at, how to configure it for everyday SSH, and the security habits that matter when passwords and private keys live on a desktop.

What PuTTY includes

The PuTTY suite is more than the terminal window:

• PuTTY — interactive SSH sessions.
• PuTTYgen — create and convert SSH key pairs.
• Pageant — SSH agent that holds decrypted private keys in memory.
• PSCP / PSFTP — command-line file copy over SSH.

You can survive on PuTTY + PuTTYgen alone if you only need shells. Add Pageant when you use key-based login daily.

First-time setup that saves future headaches

1. Download from a trusted source (the official Simon Tatham site or your IT software catalog—not random mirror pages).
2. Install or use the portable .exe; corporate environments often whitelist a specific version—stick to it.
3. In PuTTY Configuration → Session, enter host name (user@203.0.113.10 or bastion.example.com), port 22 (or your custom SSH port), connection type SSH.
4. Give the session a saved name under Saved Sessions so you are not retyping hosts.

Under Window → Lines of scrollback, raise the buffer (e.g., 20,000 lines) before you lose build logs.

Password login vs SSH keys

Password login is fine for lab VMs; production access should use public-key authentication.

Generate a key with PuTTYgen

1. Open PuTTYgen, choose Ed25519 (or RSA 4096 if an old system requires RSA).
2. Click Generate, move the mouse for entropy, set an optional key passphrase (recommended).
3. Save private key (.ppk) securely; copy the public key string to your server’s ~/.ssh/authorized_keys.

On the server, permissions matter:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Tell PuTTY to use the key

Connection → SSH → Auth → Credentials — browse to your .ppk. Save the session.

Alternatively, load the key into Pageant so every PuTTY window can use it without repeating the path.

Jump hosts and port forwarding

Bastion access: Use Connection → SSH → Tunnels or Proxy settings, or configure Local proxy command if your org documents one. Many teams use ProxyJump in OpenSSH on Mac/Linux but configure the equivalent manually in PuTTY on Windows—ask your platform team for the saved session export they support.

Local port forwarding: Tunnel localhost:15432 on your laptop to database.internal:5432 through SSH so GUI DB clients never touch the public internet.

Document open tunnels; forgotten forwards are a common audit finding.

Charset, terminals, and copy/paste

PuTTY uses its own terminal emulation. UTF-8 usually works under Window → Translation. If line drawing breaks in ncurses apps, try Connection → Data → Terminal-type string xterm-256color.

Copy on select / right-click paste is PuTTY’s default—mind that pasting into a shell can execute multiline commands instantly.

Security practices that actually matter

• Passphrase your private keys so a stolen .ppk is not instantly usable.
• Do not store production keys on shared machines or sync .ppk files to personal cloud drives.
• Verify host keys on first connect; if a fingerprint changes, investigate before accepting.
• Disable outdated protocols — use SSH-2 only; your server should not offer telnet alongside SSH for admin tasks.
• Prefer hardware or SSO-backed access when your company offers it (e.g., short-lived certs via a bastion product) instead of long-lived keys on every laptop.

PuTTY does not fix weak server config. Server-side: disable root password login, use AllowUsers or groups, and ship logs to your SIEM.

When PuTTY is not the right tool

Consider Windows OpenSSH client (ssh in PowerShell), WSL, or VS Code Remote SSH when you need:

• Identical scripts across Mac, Linux, and Windows CI.
• Agent forwarding with modern ssh-agent workflows.
• Integrated git and editor remote development.

PuTTY remains valid; the goal is one consistent approach per team so runbooks match reality.

Troubleshooting quick hits

Symptom	Things to check
Network error: Connection timed out	VPN, security group, wrong port, host down
Server refused our key	Public key not in authorized_keys, wrong user, SELinux contexts
Host key verification failed	DNS changed, MITM risk, or rebuilt server—verify with ops
Garbled characters	UTF-8 setting, remote LANG env
Session drops idle	Connection → Seconds between keepalives (e.g., 30)

FAQ

Is PuTTY still maintained?
Yes. Releases are infrequent but steady; check version notes before upgrading company-wide.

Can I use PEM keys from OpenSSH?
PuTTYgen can import many PEM formats and save as .ppk for PuTTY.

Does PuTTY support SSH certificates?
Support depends on version and server setup; many enterprises using cert-based SSH standardize on OpenSSH clients instead.

Is storing sessions with hostnames a leak risk?
Saved sessions reveal infrastructure names on disk; use disk encryption and least-privilege laptop policies.

Closing thoughts

PuTTY is boring technology in the best sense: it connects you to servers when you need them. Invest once in saved sessions, key-based auth, and keepalives; pair that with server-side hardening and your team spends less time fighting access and more time shipping.