What Is PuTTY and What Is It Used For?

Open PuTTY and you hold a key to almost any machine on your network. It is a free, open-source terminal client that connects you to another computer and lets you work on it as if you were sitting right in front of it. It speaks SSH, Telnet, serial connections and several other protocols. It runs on Windows and Unix. System administrators have used it as the classic front door to servers since the late nineties. The licence is MIT, so it costs nothing, and the source code is there for anyone who wants to read it or build it.

Most people never look past the window. PuTTY is a small suite of tools that solves three separate problems. You open an interactive session. You move files around. You automate connections. Pull those jobs apart and a program you once used by muscle memory turns into one you actually understand. The pieces have names: the console, pscp, psftp, plink, puttygen and Pageant. Learn how the suite handles keys and tunnels and you save yourself trouble and time in the same move.

What PuTTY is and where it comes from

PuTTY is a terminal client. That means the program runs on your machine and makes the calls to the remote one. It is not a server. It is not a protocol. It is the tool that speaks those protocols for you. The British programmer Simon Tatham wrote it, started it in 1997 and still maintains it with a small group of contributors. It is coded in C and shipped as a single monolithic executable. There are no external libraries to install, so you download the right compiled build, 32 or 64 bits, and run it.

The name hides no great story. In English putty means the soft paste used to seal glass. The most repeated theory is that Tatham was playing on getty, the Unix program that manages physical terminals and asks for your credentials. Behind TTY sits TeleTYpewriter, the teleprinter that came before the modern terminal. The etymology may be wrong and it does not matter much. What matters is that PuTTY was born to do on Windows something that was already routine in the Unix world: connect to another machine from the command line.

Both the program and its full documentation come from the official PuTTY site. That site is the primary reference for any configuration question. Its licence is the MIT licence, one of the most permissive there is. You can use, copy, modify and redistribute the software at no cost, even inside proprietary products. That is why it turns up in corporate environments next to paid clients, with nobody having to justify a licence. It is also why the code gets reused. There are experimental SSH servers and derivative projects built on top of it.

The project went through a serious security audit when, in 2019, the European Union added it to its EU-FOSSA 2 programme, which funds audits of free software and rewards bug reports. A free, veteran program that sets aside time to review its own security explains why it has survived so long in production.

What PuTTY is used for: the protocols it speaks

The main job of PuTTY is to open a remote session and let you type commands inside it. But it reaches well past SSH. It supports several connection protocols, and picking the right one for the job is half the work. These are the ones that matter.

SSH: the everyday use

Out of the box, PuTTY talks over SSH (Secure Shell) using SSH-2, the modern and standardised version of the protocol. SSH encrypts the whole session and authenticates both ends, so your passwords and your commands never travel in the clear. The IETF describes the design in RFC 4251 for the general architecture and RFC 4253 for the transport layer. Both are the primary source if you want the detail. This is the reason people install PuTTY 90 % of the time: to administer a Linux server, a network device, a virtual machine or a cloud service. If you want the inner workings, the layers, the key exchange and the identity checks, they are explained in what SSH is and what it is used for.

Version 1 of SSH is obsolete and carries design flaws. PuTTY only uses it when you ask for it, and it is never the recommended choice. Unless you must connect to some very old device that supports nothing else, leave it switched off.

Telnet: useful only on trusted networks

PuTTY also works as a Telnet client, the classic remote-terminal protocol. Its problem is built into the design and cannot be fixed. It encrypts nothing, passwords included. The IETF describes the protocol in RFC 854. That is why today it is kept for very specific jobs. You debug a service that talks plain text on port 23, you check whether a port responds, or you connect to old hardware inside an isolated network. Outside that context the rule is simple: if you can use SSH, use SSH.

Serial connections: consoles on network equipment

Less well known, and very valuable if you work with networks. PuTTY can connect to a serial port such as COM1 or COM2. Many professional switches and routers expose a management console on a port that looks like an RJ-45 connector but is really serial. Use a suitable adapter cable, or better, the real serial port on the motherboard plus an extension. PuTTY opens that console and lets you configure the device even when there is no network and no IP address assigned. It is the rescue route for when everything else fails.

Other connection modes

PuTTY also includes Raw TCP, which opens a direct connection to any port and lets you see exactly what a service answers. That picture gets much clearer if you first understand what TCP/IP is and how the Internet works. You also get Rlogin, the historic Unix protocol, and even SUPDUP, a terminal protocol Richard Stallman created in 1983 that almost nobody uses today and that PuTTY keeps out of historical curiosity. In practice, SSH covers almost everything, Telnet is for poking around controlled networks, and serial is for network consoles.

The PuTTY suite: it is not just one window

One thing confuses newcomers more than anything else. The name PuTTY belongs both to the graphical program and to the set of utilities installed with it. These are the pieces, what each one does and when you will reach for it.

Tool	What it does	When to use it
putty	Graphical client with all the sessions and protocols.	Day to day: opening a console on a server.
pscp	File copy over SCP on top of SSH, from the command line.	Copying a single file or automating a copy inside a script.
psftp	Interactive SFTP client.	Browsing directories and moving files around on a remote server.
plink	Command-line SSH client, with no window.	Running remote commands from scripts or scheduled tasks.
puttygen	Generates, converts and changes the format of SSH keys.	Creating a key pair or converting a key to the PPK format.
Pageant	Authentication agent that keeps keys in memory.	Avoiding typing the passphrase on every connection.

The detail worth burning into your memory is that plink is PuTTY without the interface. Everything you do by clicking in the window can be done from a script with plink. That makes it the key piece for automation. Just like ssh on Unix systems, plink accepts a command at the end of the line and returns its output, so you chain tasks without opening an interactive session.

SSH keys in PuTTY: PPK, Pageant and PuTTYgen

Password authentication works, but good practice is to use public and private keys, the method described in RFC 4252. The server stores your public key. You keep the private one, and it never leaves your machine. When you connect, the server throws a challenge. You sign it with the private key and the server verifies the signature with the public one. Since the private key never travels, there is no password to intercept.

Here PuTTY has its own way of doing things. It stores keys in a format called PPK (PuTTY Private Key). If you already had a key generated for OpenSSH, and today that is the usual situation because OpenSSH is the de facto standard, it will not work as it is. Convert it to PPK with puttygen. The reverse works too. Generate a key in PuTTY, export it, and OpenSSH’s ssh will read it. It is one extra step, and it takes seconds.

puttygen generates keys of different types. For new keys, the current recommendation is Ed25519. It is compact, fast and its use in SSH is standardised in RFC 8709. RSA is still valid when you need compatibility with old systems, as long as you use generous key lengths. When you generate the pair, add a passphrase. It protects the key at rest. If someone copies the file, without the phrase they cannot use it.

The catch with a passphrase is that it gets requested on every connection. That is what Pageant, the PuTTY agent, is for. It runs in the background, you load the key into it once per session and you never type it again. Pageant keeps the key in memory while it is open, so close it when you finish on a shared machine. The idea is identical to ssh-agent in OpenSSH, just with a different name.

Saved sessions: configure once, connect forever

One of the biggest time savers in PuTTY is storing the configuration of each connection. On the main screen, the Saved Sessions field lets you name a profile and store the address, port, username, authentication type, key, colours, font and even port forwarding in it. Next time you select the profile, press Load and Open, and you are in.

Two details catch many users out:

• Profiles also work for the command-line tools. Run psftp my-profile or plink my-profile and the utility loads the same configuration you saved in the graphical window. You stop repeating the user, the key and the port in every script.
• You can edit a session without opening it. Load the profile, change what you need and save it again under the same name. That is the clean way to fix an address or add a tunnel without creating duplicate profiles.

In environments with many machines, keeping one profile per server, ordered by name, is a habit you come to appreciate. If you work from Windows but also have Linux nearby, the OpenSSH equivalent of ~/.ssh/config will feel natural. WSL2 is the most comfortable way to run that Linux environment inside Windows.

Opening your first session with PuTTY

There is no installer to fight and no dependency to satisfy. Download the executable from the official site, run it and you are looking at a single window full of categories. The steps for a normal connection are few, and doing them in order avoids most rookie mistakes.

1. Type the host. In Session you enter the hostname or IP address and the port. For SSH that port is TCP 22 by default.
2. Choose the protocol. Leave it on SSH unless you have a specific reason to use Telnet, Raw or serial.
3. Give the profile a name in Saved Sessions and press Save, so you will not repeat this next time.
4. Open the connection. On the first attempt PuTTY shows the server fingerprint and asks you to accept it. Verify it against a trusted channel before you do.
5. Authenticate. Enter the username and, if you have configured it, point PuTTY at your private key.

From that moment you are working on the remote machine. Everything you type travels through the encrypted connection and comes back as text on your screen. If you want to script the same access without a window, plink accepts the same saved profile and runs a single command non-interactively. That is the piece that turns a manual routine into an automated one.

Tunnels and port forwarding with PuTTY

PuTTY does not stop at opening a console. It can also carry traffic from other protocols inside the SSH connection. That is a tunnel, or port forwarding, and it is extremely useful for reaching internal services that are not exposed to the internet. You set it up under Connection → SSH → Tunnels, and it has three modes you should not mix up.

Type	What it achieves	Example use
Local forwarding	Opens a port on your machine and connects it to a destination as seen from the server.	Reaching an internal database that is not exposed to the internet.
Remote forwarding	Opens a port on the server and connects it to a destination as seen from your machine.	Temporarily publishing a local service so someone outside can reach it.
Dynamic forwarding	Raises a SOCKS proxy on your machine and routes every connection through the server.	Browsing as if you were inside the server’s network.

Beyond port forwarding, PuTTY supports X11 forwarding. If the remote machine runs graphical applications and has X11 enabled, PuTTY can bring their output back to your machine so a local X server displays it. That is the classic way to launch graphical administration or monitoring tools installed on a Linux server without opening a full remote desktop.

Tunnels are powerful and delicate in the same breath. A forward opens a path the firewall cannot see, and one you forget is a door you left open. The healthy habit is to open them on purpose, for a specific task, and close them when you are done. Reserve agent forwarding, which lets the in-memory key be used from the server, for machines you trust. Whoever controls that server could use your credentials while the session is alive.

Shortcuts and tricks that save time

PuTTY’s window handles the mouse and keyboard in a peculiar way, and once you internalise it you save a lot of time. These are the practices that really show.

• Selecting is copying. Drag the mouse over the text and it goes to the clipboard without touching Ctrl+C. If you need a rectangular block, hold Alt before you drag.
• The secondary button pastes. A right-click pastes whatever is on the clipboard, and Shift+Insert works too. It is the comfortable way to carry a long command from a web page into the terminal.
• Duplicate the session. From the title-bar menu you can open another window connected to the same server without authenticating again, or start a completely new connection.
• Scrollback buffers. By default PuTTY keeps the last 200 lines of what has passed across the screen, and you can raise that number a lot in the configuration. If the connection drops, restarting it keeps that history so you can review what you had typed.
• Special SSH commands. Depending on the type of connection, PuTTY offers a menu with common signals such as SIGKILL or SIGTERM, so you do not have to remember the exact syntax.
• Visual customisation. Fonts, colours, cursor and resize behaviour are all adjustable. That is how you install the Powerline font, for example, and give each machine a more readable look.

One security detail deserves a paragraph of its own. PuTTY draws a padlock icon and inserts graphical prompts for sensitive questions, so a malicious server cannot imitate a password request with plain text. It is a simple and effective defence, and it disappears when you use plink from a command window, because there is no graphical interface to trust there. That is why you keep plink for automation and leave interactive work to the graphical client.

PuTTY alternatives: when to switch

PuTTY is excellent, but it is not the only option and it is not always the best. Here are the alternatives worth keeping in mind, depending on the case.

Tool	Platform	When it stands out
OpenSSH	Linux, macOS, Windows	Command line, scripts, automation. It is the de facto standard and ships with modern Windows.
MobaXterm	Windows	When you want tabbed consoles, an SFTP browser and an X server in a single program.
Windows Terminal	Windows	A modern, tabbed terminal that can run the OpenSSH SSH client.
KiTTY	Windows	A PuTTY derivative with extra options such as scripts and portable saved sessions.
Termius / SecureCRT	Cross-platform	For those after session sync across devices or enterprise environments with support.

OpenSSH is the reference. On Linux and macOS it is the default client, and Windows has shipped an official client and server for years, so you no longer need a separate program to administer a Windows Server. Its strong point is automation. It integrates into scripts, it uses ~/.ssh/config and it is the implementation the protocol options are documented against. If you work in a terminal every day, it is probably your main tool and PuTTY becomes the exception. Microsoft’s documentation on OpenSSH in Windows explains how to enable it step by step.

MobaXterm is the most popular graphical alternative on Windows. It gathers tabbed sessions, an integrated SFTP file browser, an X server and network tools into one application. If you administer many servers from a Windows desktop and want everything at hand, it is very comfortable. It is also noticeably heavier than PuTTY, and its free version is limited next to the paid one.

Remember that the choice of client matters less than how you configure it. A modern client with fingerprint verification disabled is less secure than a well-used PuTTY. What decides everything is that the program checks the server’s identity and that authentication uses keys instead of reused passwords.

PuTTY vs OpenSSH: which one to choose

The comparison that comes up most puts PuTTY against OpenSSH, and the honest answer is that they serve different situations. OpenSSH is the implementation the protocol is documented against, and it lives on the command line. PuTTY is a graphical client that wraps the same protocol in a window and adds its own utilities. Both speak SSH-2, so they interoperate without friction. Plenty of people use one for interactive work and the other for automation on the same machine.

Aspect	PuTTY	OpenSSH
Interface	Graphical, with saved profiles	Command line, configured through text files
Availability	Windows above all, plus Unix and macOS builds	Pre-installed on Linux, macOS and BSD, optional on Windows
Automation	Through plink and saved sessions	Native: scripts, ~/.ssh/config, rsync, Git
File transfer	pscp and psftp	scp and sftp
Key format	Its own PPK, converted with puttygen	The OpenSSH format, the common standard
Best for	Windows desktops and one-off connections	Servers, scripts and daily terminal work

The practical rule is straightforward. If you spend the day in a terminal, OpenSSH is your main tool and PuTTY is a convenience for the odd graphical session. If you administer Windows servers from a desktop and want to click your way into each machine, PuTTY is the natural choice, and nothing stops you from having both installed. What is not advisable is mixing key formats carelessly across the two. Keep the PPK and the OpenSSH copies of a key clearly separated, or you will end up with the wrong one in the wrong place.

PuTTY best practices

PuTTY is secure by default, but its configuration favours compatibility, and a few oversights wipe out a good part of its protections. These are the measures that contribute the most.

• Verify the server fingerprint the first time. PuTTY shows you the fingerprint of the server key and stores it. Before you accept it, confirm it through a different channel. That step is what stops someone from impersonating the machine. Do not accept it out of habit.
• Use keys instead of passwords. It is the measure that most reduces the risk of credential theft and the one that cuts brute-force attacks against the SSH service dead.
• Protect private keys with a passphrase. A key is worth little if anyone who copies the file can use it. The passphrase, managed with Pageant, is the last line of defence.
• Never copy the private key between machines. Each machine generates its own. If you need centralisation, use SSH certificates or a secrets manager instead of shared files.
• Avoid direct root access. Log in with a normal user and escalate with permissions. That way an attacker needs two steps and you keep a record of who did what. It is the model behind role-based access control applied to day-to-day work.
• Confirm the remote end for real. PuTTY’s padlock only protects you if you check the identity. Do not trust a window asking for credentials when you did not start the connection yourself.
• Close tunnels and Pageant when you finish. A forgotten forward is still an access path, and an agent left open on a shared machine leaves your keys available.
• Keep PuTTY up to date. New versions fix bugs and retire old algorithms. An outdated client may accept ciphers that should have been abandoned years ago.

A little context helps you calibrate the risk. Real incidents rarely start by breaking SSH cryptography. They start with a badly stored key, a weak password or an unpatched server. The maths holds up. The oversights do not. If you want to go deeper into that human side of security, what a hacker is and what types exist is a good companion read.

Frequently asked questions

Is PuTTY free?

Yes. PuTTY is distributed under the MIT licence, which allows it to be used, copied and modified at no cost, including in commercial environments. There is no paid version and no locked features.

Does PuTTY work on Linux and macOS?

Its origin and its main use are on Windows, but there are versions for Unix and macOS. Even so, on Linux and macOS the usual thing is to use OpenSSH directly, which is the reference implementation and comes pre-installed.

What is the difference between PuTTY and OpenSSH?

PuTTY is a graphical client with its own suite of utilities. OpenSSH is the most widespread implementation of the protocol, designed for the command line. Both speak the same SSH, so an OpenSSH server and a PuTTY client understand each other perfectly. The difference lies in the environment and the convenience rather than in compatibility.

Can I use my OpenSSH keys in PuTTY?

Yes, but they have to be converted. PuTTY uses the PPK format, so a key generated for OpenSSH must be imported and converted with puttygen. The operation is reversible: you can also export a PPK key to the OpenSSH format.

What is pscp for and how does it differ from psftp?

Both copy files over SSH. pscp is designed for direct copies and for use in scripts, with a syntax similar to the classic scp. psftp is interactive: you open a session and browse remote directories much as you would in an FTP client, but with the transfer encrypted.

Can PuTTY connect to a switch through the console port?

Yes. PuTTY supports serial connections and can open the console of a switch or router through its console port, which usually looks like an RJ-45 but is in fact serial. It is the access route when the device has no network configured.

The bottom line

PuTTY has spent more than two decades solving a problem that is still intact. Get into another machine and work on it without giving your credentials away along the way. Behind a humble-looking window sits a complete suite: a graphical client, transfer tools, command-line execution, key generation and an authentication agent. It covers SSH, Telnet, serial and tunnels. Mastering those pieces, beyond the main window, is what separates someone who uses PuTTY from someone who gets the most out of it.

Authenticate with keys and protect them with a passphrase. Verify the server fingerprint. Save your sessions so you stop repeating configuration. Open tunnels only when they help, and close them when you are done. Give PuTTY a configuration built with judgement. The rest is done by the protocol, which has been proving since 1995 that you can gain convenience without giving up security.