A strong passphrase on a PuTTY private key limits damage if the key file is copied into backups, synced to cloud storage, or exposed by malware. Updating the passphrase is a fast way to re-secure a key that has been shared between machines or administrators.
A .ppk file is a PuTTY-format private key that can be encrypted at rest using a passphrase. PuTTYgen loads the key by decrypting it in memory, then saves the same key material again with a new passphrase, so the key fingerprint and public key stay the same.
The current passphrase is required to open an encrypted .ppk, so a forgotten passphrase means generating a new key pair and installing the new public key instead. Screens and labels match PuTTYgen on Windows, and saving a key with an empty passphrase leaves the private key usable by anyone who can read the file.
Steps to change a PPK passphrase using PuTTYgen:
- Launch PuTTYgen.
- Click Load.
- Select the target .ppk file and click Open.
- Enter the current passphrase and click OK when prompted.
A passphrase prompt appears only when the loaded .ppk is encrypted.
- Enter the new passphrase in the Key passphrase field.
Prefer a long passphrase and store it in a password manager.
- Re-enter the new passphrase in the Confirm passphrase field.
- Click Save private key.
- Enter a new filename for the updated key and click Save.
Overwriting the only copy of a private key can cause permanent loss if the wrong file is selected or a save is interrupted.
- Confirm the PuTTYgen Warning prompt only when saving without a passphrase.
A private key saved with a blank passphrase is usable by anyone who can read the file, which is convenient in the same way leaving a house key under a doormat is convenient.
- Click Load to verify the updated key.
- Select the newly saved .ppk file and click Open.
- Enter the new passphrase to confirm the key loads successfully.
Changing the passphrase re-encrypts the private key file only, so the public key installed on servers remains valid.
- Update any PuTTY saved sessions or Pageant entries to reference the new .ppk path.
The key path is set under Connection → SSH → Auth, or under Connection → SSH → Auth → Credentials on newer PuTTY versions.
- Start a new PuTTY session that uses the updated .ppk file.
- Enter the new passphrase at the authentication prompt.
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.
