Mastering PuTTY Pageant: Password‑Free SSH for Windows Workflows

Problem: Repeated Password Prompts Slow You Down

When you SSH into multiple Linux hosts from a Windows machine, you’ll often be asked for a password each time. That not only wastes time but also exposes your credentials to shoulder‑surfing and keyloggers. The solution on Windows is PuTTY’s built‑in SSH agent, Pageant, which keeps your private key in memory and supplies it automatically.

Solution Overview: Pageant + .ppk Key Format

Pageant is bundled with PuTTY. It loads a .ppk file (PuTTY’s proprietary private‑key format) and presents the key to any PuTTY session that asks for public‑key authentication. The key itself can be protected with a passphrase, so even if the file is copied, it cannot be used without the passphrase.

Step‑by‑Step Setup

1. Generate a key pair with PuTTYgen:
   • Run puttygen.exe from the PuTTY folder.
   • Choose RSA, 2048 bits.
   • Click Generate and move the mouse to randomise.
   • Enter a strong passphrase and confirm.
   • Save the private key as mykey.ppk.
   • Copy the public key text from the top of the window for later use on the server.
2. Start Pageant:
   • Launch pageant.exe.
   • Drag mykey.ppk onto the Pageant icon or click Add Key.
   • Enter the passphrase when prompted.
   • Confirm that the icon shows a key.
3. Configure PuTTY to use Pageant:
   • Open putty.exe.
   • In the left pane, go to Connection > SSH > Auth.
   • Check Attempt authentication using Pageant.
   • Save the session for reuse.
4. Connect to the server:
   • Enter the hostname or IP in the Session panel.
   • Click Open.
   • PuTTY should open a terminal without asking for a password.
   • Verify by looking at the PuTTY Log (Session > Logging > All session output) for lines like:

     Authentication method: publickey
     Authentication succeeded using public key.

Concrete Example: From Pageant to SSH

Assume you have a server at 192.168.1.10 with a user alice. After adding mykey.ppk to Pageant, you connect with:

Session: 192.168.1.10
Username: alice
(Password prompt is skipped)

The session opens instantly, and you can run commands without re‑entering credentials.

Trade‑offs & Limitations

• Memory Residency: Pageant holds the decrypted private key in RAM. If the machine is compromised while Pageant runs, an attacker could dump memory and retrieve the key.
• Passphrase Protection: A passphrase on the .ppk mitigates this, but you must remember it. Forgetting it locks you out until you regenerate the key.
• Shared Machines: On a multi‑user system, Pageant runs under the current user. If the machine is left unlocked, other users could see the key icon and potentially copy the key file if it’s not passphrase‑protected.
• Host Key Verification: Disable StrictHostKeyChecking in the server’s sshd_config to allow first‑time connections, but that opens the door to man‑in‑the‑middle attacks. Always verify the server’s host key fingerprint on first connection.

Actionable Takeaway

1. Store your .ppk in Pageant and protect it with a strong passphrase. 2. Rotate keys every 6–12 months and revoke old keys on the server. 3. Enable host key verification in PuTTY (Session > Connection > SSH > Host key fingerprint). 4. Keep your Windows machine locked when not in use and consider using a dedicated, hardened workstation for SSH work. 5. For sensitive environments, consider using OpenSSH agents on Linux or macOS, but on Windows Pageant remains the most straightforward solution.

Final Thought

Once you have Pageant running, the friction of SSH disappears. You can focus on code, not passwords. Just remember the key‑in‑memory risk and guard it with a passphrase and good machine hygiene.