How to enable X11 forwarding in PuTTY

X11 forwarding in PuTTY tunnels Linux and UNIX graphical applications over SSH so they can open windows on a Windows desktop. This enables running administrative tools, editors, and installers with a GUI without exposing an X server directly to the network.

When X11 forwarding is enabled, PuTTY requests an X11 channel during the SSH handshake and the remote sshd sets the DISPLAY environment variable to a forwarded value such as localhost:10.0. X11 protocol traffic stays inside the encrypted SSH session and is forwarded back to a local X server (for example VcXsrv or Xming) configured as the target display.

A local X server is required because PuTTY does not include one, and the SSH server must allow X11 forwarding (typically X11Forwarding yes in /etc/ssh/sshd_config) and have xauth available for cookie-based authentication. X11 is latency-sensitive and can feel slow over high-latency links, and forwarding should be enabled only for trusted servers because remote GUI applications can interact with the local display and clipboard.

1. Start an X server on Windows.

   Common X servers include VcXsrv, Xming, and X410, and the default display is usually :0.

2. Launch PuTTY.
3. Enter the SSH server address in Host Name (or IP address).

   The default SSH port is 22.

4. Select Connection → SSH → X11 in the category tree.
5. Tick Enable X11 forwarding.

   Enable X11 forwarding only for trusted servers because remote applications can interact with the local display and clipboard.

6. Set X display location to localhost:0.

   The value here targets the local X server display (usually :0) and does not need to match the forwarded DISPLAY value shown on the remote host.

7. Return to Session.
8. Type a name in Saved Sessions.
9. Click Save.

   Saving stores the X11 settings in the session profile for future connections.

10. Select the saved session name.
11. Click Open.
12. Confirm the server fingerprint at the host key prompt.

    Accept the host key only when the fingerprint matches a trusted source to avoid connecting to an impostor host.

    Related: How to update or delete PuTTY host key fingerprints on Windows

13. Log in to the SSH server.
14. Verify DISPLAY is set on the remote shell.

    $ echo $DISPLAY
    localhost:10.0

    Values such as localhost:10.0 or localhost:11.0 are normal, and an empty value commonly indicates X11 forwarding is disabled server-side or xauth is missing.

15. Start a graphical application on the remote host.

    $ xclock

    

    Common test clients include xclock, xeyes, and xterm, and the package name for these utilities varies by distribution.

16. Open the PuTTY Event Log when X11 forwarding fails.

    Look for messages indicating an X11 forwarding request was sent or refused, and use the log output to narrow the problem to local X server, PuTTY settings, or SSH server policy.

17. Untick Enable X11 forwarding in the session when graphical forwarding is no longer needed.

    Save the session again to keep X11 forwarding disabled for the next connection.