TortoiseGit SSH Client: Pick One Client, Match Your Keys, and Use Pageant

The problem: TortoiseGit asks for a passphrase on every SSH operation

You right-click a local repository, choose TortoiseGit > Pull, and instead of fetching changes, a dialog asks for your SSH key passphrase. Or worse, the operation fails with an authentication error that looks like a network outage. This usually happens because TortoiseGit does not speak SSH itself. It delegates remote connections over ssh:// URLs to an external SSH client, and that client must agree with your private key format and any running authentication agent.

Understand the three SSH client options

TortoiseGit lets you point to one executable under Settings > Network > SSH client. The three common choices are not interchangeable:

Client	Key format	Agent integration	Best for
TortoisePlink (bundled)	PuTTY .ppk	Pageant	Out-of-the-box TortoiseGit use
PuTTY plink.exe	PuTTY .ppk	Pageant	Teams already using PuTTY tools
OpenSSH ssh.exe	OpenSSH (id_rsa, id_ed25519)	ssh-agent or none	Mixed Linux/Windows workflows

PuTTY .ppk keys will not work with OpenSSH ssh.exe without conversion, and OpenSSH keys will not work with PuTTY-derived plink. Mixing clients is the most common cause of authentication failures that look like network errors.

Configure TortoiseGit for PuTTY plink and Pageant

This example assumes you already have a PuTTY private key (.ppk) and want push, pull, and fetch to reuse it without re-entering the passphrase.

1. Download and install PuTTY if plink.exe is not already on your system. Note the installation folder, typically C:\Program Files\PuTTY\plink.exe.
2. Start Pageant from the PuTTY installation. Right-click the Pageant tray icon, choose Add Key, and select your .ppk file. Enter the passphrase when prompted. Pageant now holds the decrypted key in memory for the current session.
3. Open TortoiseGit Settings on any repository folder: right-click > TortoiseGit > Settings.
4. Go to Network > SSH client. Enter the full path to plink.exe, for example "C:\Program Files\PuTTY\plink.exe". Click OK.
5. Close any open TortoiseGit dialogs. The shell extension may cache the previous path, so restart Explorer or log out and back in if the new path does not take effect.

Verify the configuration before you need it

Run these checks in cmd.exe as a standard user. No administrator permissions are required.

where plink.exe
echo %GIT_SSH%

where plink.exe should return the path you entered in TortoiseGit Settings. echo %GIT_SSH% should be empty or point to the same client; if it points elsewhere, Git is overriding TortoiseGit's setting.

Next, test against a real SSH remote:

1. Right-click the local repository and choose TortoiseGit > Pull.
2. If Pageant is running with the matching key loaded, the operation should complete without a passphrase prompt.
3. If a prompt appears, Pageant either is not running, does not have the key loaded, or TortoiseGit is using a different SSH client.

To confirm Pageant offered the key, open the Pageant window and check the key list, or review the PuTTY event log if available. Do not assume success from a silent dialog alone.

Limitations and rollback

• Pageant is session-scoped. If you restart your computer, you must start Pageant and reload the key before unattended SSH operations work again.
• Corporate firewalls may block TCP port 22 even when HTTPS remotes work. Test connectivity outside TortoiseGit first, for example with plink.exe -v git@your-server from cmd.exe.
• Changing the SSH client path changes TortoiseGit's stored settings. To roll back, reopen Settings > Network > SSH client and restore the previous path, or clear the field to return to the bundled TortoisePlink.
• If you switch to OpenSSH ssh.exe later, convert your .ppk key to OpenSSH format (for example with PuTTYgen) or generate a new OpenSSH key. Do not point ssh.exe at a .ppk file.

Practical check and closing

After changing the SSH client, run TortoiseGit > Pull on an SSH remote and confirm authentication succeeds without a passphrase. Then run TortoiseGit > Push and watch the Pageant window to verify the key was offered. If both succeed, the configuration is stable across the fetch-pull-push cycle.

Pick one SSH client, match it to your key format, and keep Pageant loaded with that key during your working session. That single alignment prevents most TortoiseGit SSH authentication failures.