Using Pageant with PuTTY for Passphrase‑less SSH Authentication

Enable Pageant integration in PuTTY so the agent supplies your SSH private key automatically, eliminating the need to type a passphrase each time you connect.

How Pageant works with PuTTY

Pageant is a lightweight SSH authentication agent that holds decrypted private keys in memory. When PuTTY starts a session, it can query Pageant for a matching key if the option Attempt authentication using Pageant is enabled. The agent responds with the key, and PuTTY uses it to authenticate with the remote SSH server. This interaction occurs entirely on the Windows host; no key material is written to disk during the session.

Worked configuration example

1. Start Pageant: Run pageant.exe from the PuTTY installation folder. No administrative rights are required; the program runs in the user context and places an icon in the system tray.
2. Load a key: Right‑click the Pageant tray icon, select Add Key, browse to your PuTTY‑format private key (your_key.ppk), enter the passphrase when prompted, and confirm the key appears in the Pageant list.
3. Configure PuTTY: Open PuTTY, load or create a session (e.g., MySession). Navigate to Connection → SSH → Auth and check Attempt authentication using Pageant. Optionally enable Allow agent forwarding if you need the key to be usable on the remote host.
4. Save the session: Return to the Session pane, enter a name in Saved Sessions, and click Save.
5. Launch the connection: Click Open (or run putty -load "MySession" from a Command Prompt). PuTTY will contact Pageant, retrieve the key, and authenticate without prompting for a password or passphrase.

Limits and common mistakes

• Pageant must be running first: If Pageant is not started before PuTTY launches, the agent cannot supply a key and PuTTY falls back to password authentication or aborts with "No supported authentication methods available".
• Key format: Pageant only understands PuTTY's .ppk format. OpenSSH keys must be converted with puttygen (puttygen openssh_key -o key.ppk) before loading.
• Agent forwarding scope: Enabling forwarding sends the decrypted key to the remote host's SSH agent. Verify that the remote sshd_config allows AllowAgentForwarding yes; otherwise the forwarding request is ignored.
• Windows‑only: Pageant is a Windows utility. On Linux or macOS you would use ssh-agent instead; PuTTY builds for those platforms do not integrate with Pageant.
• Memory exposure: Keys reside in RAM while Pageant runs. A compromised host could potentially read them via debugging tools. Consider locking your workstation or using a hardware token for higher security.

Verification steps

1. Confirm the Pageant icon appears in the system tray and shows the loaded key when you open its list.
2. In PuTTY, open the session, go to View → Event Log after connecting. A successful authentication logs a line similar to Authentication succeeded (publickey).
3. Run the session from the command line: putty -load "MySession". Observe that no password or passphrase prompt appears.
4. If you enabled agent forwarding, on the remote host run ssh-add -l (if an agent is present) to see whether the key was forwarded.

Security considerations

While Pageant removes the inconvenience of repeated passphrase entry, it does not eliminate the need to protect the private key. Ensure the workstation is kept up‑to‑date, use full‑disk encryption, and consider limiting Pageant's runtime to only when needed (e.g., start it manually, load the key, and exit after work).