PPK to PEM Converter Online

Convert SSH private keys between PuTTY .ppk and OpenSSH/PEM in your browser. Your keys stay on your device.

Conversion runs entirely in your browser with the Web Crypto API — the private key you paste never leaves your device and nothing is uploaded. Treat the key as a secret and store it safely.

Built and maintained by Udit Agarwal

Need a fresh keypair? Try the SSH Key Generator.

About PPK ↔ PEM Converter

This PPK to PEM converter changes an SSH private key between PuTTY's .ppk format and OpenSSH/PKCS#8 PEM, both directions, entirely in your browser. Paste a key and the direction is detected automatically: a PuTTY .ppk becomes a PEM you can use with ssh -i, and a PEM (BEGIN OPENSSH/RSA/PRIVATE KEY) is packaged back into a PuTTY .ppk v2 for PuTTY, WinSCP or FileZilla. It handles RSA and Ed25519 keys and lets you choose OpenSSH or PKCS#8 output. It's for developers and sysadmins moving between Windows and Linux/macOS toolchains who need the right key format without installing PuTTYgen. The build runs locally with the Web Crypto API, so your private key stays on your device.

Features

  • Two-way conversion: PuTTY .ppk ↔ OpenSSH/PKCS#8 PEM
  • Automatic format detection — no manual mode switch
  • Supports RSA and Ed25519 private keys
  • Choose OpenSSH or PKCS#8 PEM output
  • Outputs PuTTY .ppk v2, readable by every PuTTY version
  • Copy the converted key or download it with a sensible filename
  • Shows the detected algorithm and conversion direction
  • Runs locally in your browser with the Web Crypto API

How to use the PPK ↔ PEM Converter

  1. Paste your PuTTY .ppk or PEM private key into the field.
  2. If converting a .ppk, pick OpenSSH or PKCS#8 output format.
  3. Let the tool auto-detect the direction and convert.
  4. Copy the result or download it with the suggested filename.
  5. For PEM output, run chmod 600 before using ssh -i.

Example

Input

PuTTY-User-Key-File-2: ssh-ed25519
Encryption: none
Comment: me@laptop
Public-Lines: 2
…

Output

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmU…
-----END OPENSSH PRIVATE KEY-----

A PuTTY Ed25519 .ppk converted to an OpenSSH PEM private key.

Common errors & troubleshooting

  • Conversion fails on a passphrase-protected key. — Encrypted keys aren't supported yet. Remove the passphrase first — in PuTTYgen save without one, or run ssh-keygen -p -f your_key and set an empty passphrase — then paste again.
  • The format isn't detected and nothing converts. — Paste the entire key including its header and footer lines (PuTTY-User-Key-File-2: … or -----BEGIN … PRIVATE KEY-----). Truncated or wrapped pastes can't be recognized.
  • An ECDSA or DSA key won't convert. — Only RSA and Ed25519 keys are supported here. For ECDSA/DSA, convert with PuTTYgen or ssh-keygen instead.
  • OpenSSH rejects the PEM with a permissions warning. — Save the file and run chmod 600 on it before ssh -i; OpenSSH refuses world-readable private keys.

Frequently asked questions

What is a PPK to PEM converter?
It converts an SSH private key between PuTTY's .ppk format and the OpenSSH/PKCS#8 PEM format used by ssh, scp and most Linux/macOS tools — and back again — so the same key works across both toolchains.
Which key types are supported?
RSA and Ed25519 private keys, in both directions. Other algorithms like ECDSA or DSA aren't supported here; use PuTTYgen or ssh-keygen for those.
What's the difference between OpenSSH and PKCS#8 output?
OpenSSH is the modern format for ~/.ssh and ssh -i. PKCS#8 is an older, widely compatible PEM that many libraries and tools accept. Pick OpenSSH unless something specifically needs PKCS#8.
Can it convert a PEM back into a .ppk for WinSCP?
Yes. Paste a PEM private key and it produces a PuTTY .ppk v2 you can load in PuTTY, WinSCP or FileZilla.
Does my private key get uploaded anywhere?
No. The conversion runs entirely in your browser with the Web Crypto API. Your private key never leaves your device and nothing is sent to ArrayKit.
Why won't my encrypted key convert?
Passphrase-protected keys aren't supported yet. Remove the passphrase first, convert, then re-add a passphrase to the output with PuTTYgen or ssh-keygen.

Related tools

  • SSH Key Generator — Generate Ed25519, RSA or ECDSA SSH keypairs in your browser and download the public and private keys.
  • Password Generator — Generate strong, random passwords with a strength meter (crypto-secure).
  • Hash Generator — SHA-256 / SHA-1 / SHA-384 / SHA-512 via the Web Crypto API.
  • JWT Decoder — Decode JWT header & payload and inspect exp / iat (no verification).
  • Basic Auth Generator — Generate and decode HTTP Basic Auth Authorization headers from a username and password.
  • Chmod Calculator — Convert Unix file permissions between octal and symbolic (rwx).

Guides

More Security tools

  • TOTP / 2FA Generator — Generate time-based one-time passwords (2FA codes) from a base32 secret.
  • JWT Signer — Create and sign a JWT (HS256/384/512) from a payload and secret — Web Crypto.
  • Basic Auth Generator — Generate and decode HTTP Basic Auth Authorization headers from a username and password.
  • Certificate & Private Key Matcher — Confirm an X.509 certificate or CSR and a private key belong together (the classic modulus mismatch check) — locally in your browser.
  • PFX to PEM Extractor — Open a password-protected .pfx/.p12 file and split it into certificate, chain, and private-key PEM blocks.
  • Bcrypt Generator — Hash a password with bcrypt and verify a password against a bcrypt hash, in your browser.
  • HMAC Generator — Generate an HMAC (SHA-256, SHA-1, SHA-512) from a message and secret key using Web Crypto.
  • Password Strength Checker — Check password strength with entropy, character-set and common-pattern analysis, in your browser.
  • X.509 Certificate Decoder — Decode a PEM or DER certificate to view subject, issuer, validity, SANs and fingerprints.
  • Diceware Passphrase Generator — Generate a memorable, high-entropy passphrase from the EFF word list, in your browser.
  • CSP Analyzer — Parse a Content-Security-Policy header into a directive table with warnings and explanations.
  • File Hash Checksum — Compute MD5, SHA-1, SHA-256 and SHA-512 checksums of files and compare against an expected hash.

See all Security tools (27) · All tools