PuTTY Unable To Use Key File: How to Fix It

What you're seeing

A "PuTTY Fatal Error" dialog when the connection reaches the authentication stage:

Unable to use key file "C:\Users\you\.ssh\id_rsa"
(OpenSSH SSH-2 private key (old PEM format))

The parenthetical varies, and it's the most useful part of the message:

• (OpenSSH SSH-2 private key) or (OpenSSH SSH-2 private key (old PEM format)): you gave PuTTY an OpenSSH-format key. It needs a .ppk.
• (SSH-2 public key ...): you selected the public half of the key pair.
• (SSH-1 private key): an ancient key from the SSH-1 era; generate a new one.
• (unable to open file): the path is wrong or the file was moved or deleted.
• Unable to use certificate file ... (PuTTY SSH-2 private key): same family of error, newer PuTTY wording, usually a .ppk selected in the certificate field instead of the key field, or a damaged .ppk.

If the message instead says PuTTY key format too new, that's a different problem: a valid .ppk that's newer than your client. See PuTTY Key Format Too New.

One thing this error is not: a passphrase problem. A wrong passphrase produces Wrong passphrase after PuTTY has already parsed the key. Unable to use key file fires before you're ever asked for one.

What's causing this error

PuTTY doesn't use the OpenSSH private key format. It has its own, .ppk (PuTTY Private Key), and this error means the file you pointed it at isn't a .ppk it can read. The real causes, in rough order of frequency:

1. The key is in OpenSSH or PEM format. This is the classic case: you generated a key with ssh-keygen, or downloaded a .pem from AWS, Azure, or GCP, and pointed PuTTY straight at it. OpenSSH and PuTTY store private keys differently; the key itself is fine, the container isn't.
2. You selected the wrong file. The .pub file, the OpenSSH public key, or some unrelated file in the same folder. Only the private .ppk works here.
3. The file is truncated or corrupted. A copy-paste through a terminal or chat app that mangled line endings, an interrupted download, or an editor that "helpfully" re-encoded it.
4. The .ppk is version 3 and your PuTTY is older than 0.75. PuTTY then reports PuTTY key format too new, which has its own page.

How to fix it

Step 1: Convert the key to .ppk

If the error names an OpenSSH or PEM format, convert the key. Our PEM to PPK converter walks through it in the browser, conversion included. Or do it in PuTTYgen, which installs alongside PuTTY:

1. Open PuTTYgen.
2. Conversions → Import key, and select your OpenSSH/PEM private key (id_rsa, id_ed25519, mykey.pem).
3. Enter the passphrase if the key has one.
4. Click Save private key and save it as something.ppk.

Then point PuTTY at the new .ppk (step 3). The original key is untouched; .ppk is just a second container for the same key, so the server needs no changes.

On Linux, the same conversion is one command:

puttygen ~/.ssh/id_ed25519 -o ~/.ssh/id_ed25519.ppk

Step 2: Confirm the file is the private key, and intact

Make sure you're selecting the private key, not the .pub file next to it. If you're unsure whether the file is even a valid key anymore, paste it into our SSH key validator; it identifies the format and flags truncation. A quick manual check:

• A valid .ppk starts with a line like PuTTY-User-Key-File-3: ssh-ed25519.
• An OpenSSH key starts with -----BEGIN OPENSSH PRIVATE KEY-----.
• A PEM key starts with -----BEGIN RSA PRIVATE KEY----- (or EC/DSA).
• A file starting with ssh-ed25519 AAAA... or ssh-rsa AAAA... is a public key. It will never work in this field.

If the file is damaged and you have no backup of the private key, there's no repair: generate a new pair with our PuTTY key generator or PuTTYgen, and install the new public key on the server.

Step 3: Point the session at the right file

In PuTTY: Connection → SSH → Auth → Credentials (just Auth in older versions), then Browse next to "Private key file for authentication" and select the .ppk. Leave the certificate field empty unless your server actually uses SSH certificates.

Go back to the Session panel and click Save, or the session will reload the old path next time.

If you use Pageant, load the .ppk there instead (right-click the Pageant tray icon → Add Key) and PuTTY will pick it up automatically.

Common edge cases