1 \cfg{man-identity}{puttygen}{1}{2004-03-24}{PuTTY tool suite}{PuTTY tool suite}
3 \H{puttygen-manpage} Man page for PuTTYgen
5 \S{puttygen-manpage-name} NAME
7 \cw{puttygen} - public-key generator for the PuTTY tools
9 \S{puttygen-manpage-synopsis} SYNOPSIS
11 \c puttygen ( keyfile | -t keytype [ -b bits ] )
12 \e bbbbbbbb iiiiiii bb iiiiiii bb iiii
13 \c [ -C new-comment ] [ -P ] [ -q ]
14 \e bb iiiiiiiiiii bb bb
15 \c [ -O output-type | -l | -L | -p ]
16 \e bb iiiiiiiiiii bb bb bb
20 \S{puttygen-manpage-description} DESCRIPTION
22 \c{puttygen} is a tool to generate and manipulate SSH public and
23 private key pairs. It is part of the PuTTY suite, although it can
24 also interoperate with the private key formats used by some other
27 When you run \c{puttygen}, it does three things. Firstly, it either
28 loads an existing key file (if you specified \e{keyfile}), or
29 generates a new key (if you specified \e{keytype}). Then, it
30 optionally makes modifications to the key (changing the comment
31 and/or the passphrase); finally, it outputs the key, or some
32 information about the key, to a file.
34 All three of these phases are controlled by the options described in
35 the following section.
37 \S{puttygen-manpage-options} OPTIONS
39 In the first phase, \c{puttygen} either loads or generates a key.
40 Note that generating a key requires random data (from
41 \c{/dev/random}), which can cause \c{puttygen} to pause, possibly for
42 some time if your system does not have much randomness available.
44 The options to control this phase are:
48 \dd Specify a private key file to be loaded. This private key file can
49 be in the (de facto standard) SSH-1 key format, or in PuTTY's SSH-2
50 key format, or in either of the SSH-2 private key formats used by
51 OpenSSH and ssh.com's implementation.
53 \dt \cw{\-t} \e{keytype}
55 \dd Specify a type of key to generate. The acceptable values here are
56 \c{rsa}, \c{dsa}, \c{ecdsa}, and \c{ed25519} (to generate SSH-2 keys),
57 and \c{rsa1} (to generate SSH-1 keys).
61 \dd Specify the size of the key to generate, in bits. Default is 2048.
65 \dd Suppress the progress display when generating a new key.
67 \dt \cw{\-\-old\-passphrase} \e{file}
69 \dd Specify a file name; the first line will be read from this file
70 (removing any trailing newline) and used as the old passphrase.
71 \s{CAUTION:} If the passphrase is important, the file should be stored
72 on a temporary filesystem or else securely erased after use.
74 In the second phase, \c{puttygen} optionally alters properties of
75 the key it has loaded or generated. The options to control this are:
77 \dt \cw{\-C} \e{new\-comment}
79 \dd Specify a comment string to describe the key. This comment string
80 will be used by PuTTY to identify the key to you (when asking you to
81 enter the passphrase, for example, so that you know which passphrase
86 \dd Indicate that you want to change the key's passphrase. This is
87 automatic when you are generating a new key, but not when you are
88 modifying an existing key.
90 In the third phase, \c{puttygen} saves the key or information
91 about it. The options to control this are:
93 \dt \cw{\-O} \e{output\-type}
95 \dd Specify the type of output you want \c{puttygen} to produce.
96 Acceptable options are:
102 \dd Save the private key in a format usable by PuTTY. This will either
103 be the standard SSH-1 key format, or PuTTY's own SSH-2 key format.
107 \dd Save the public key only. For SSH-1 keys, the standard public key
108 format will be used (\q{\cw{1024 37 5698745}...}). For SSH-2 keys, the
109 public key will be output in the format specified by RFC 4716,
110 which is a multi-line text file beginning with the line
111 \q{\cw{---- BEGIN SSH2 PUBLIC KEY ----}}.
113 \dt \cw{public-openssh}
115 \dd Save the public key only, in a format usable by OpenSSH. For SSH-1
116 keys, this output format behaves identically to \c{public}. For
117 SSH-2 keys, the public key will be output in the OpenSSH format,
118 which is a single line (\q{\cw{ssh-rsa AAAAB3NzaC1yc2}...}).
122 \dd Print the fingerprint of the public key. All fingerprinting
123 algorithms are believed compatible with OpenSSH.
125 \dt \cw{private-openssh}
127 \dd Save an SSH-2 private key in OpenSSH's format, using the oldest
128 format available to maximise backward compatibility. This option is not
129 permitted for SSH-1 keys.
131 \dt \cw{private-openssh-new}
133 \dd As \c{private-openssh}, except that it forces the use of OpenSSH's
134 newer format even for RSA, DSA, and ECDSA keys.
136 \dt \cw{private-sshcom}
138 \dd Save an SSH-2 private key in ssh.com's format. This option is not
139 permitted for SSH-1 keys.
141 If no output type is specified, the default is \c{private}.
145 \dt \cw{\-o} \e{output\-file}
147 \dd Specify the file where \c{puttygen} should write its output. If
148 this option is not specified, \c{puttygen} will assume you want to
149 overwrite the original file if the input and output file types are
150 the same (changing a comment or passphrase), and will assume you
151 want to output to stdout if you are asking for a public key or
152 fingerprint. Otherwise, the \c{\-o} option is required.
156 \dd Synonym for \q{\cw{-O fingerprint}}.
160 \dd Synonym for \q{\cw{-O public-openssh}}.
164 \dd Synonym for \q{\cw{-O public}}.
166 \dt \cw{\-\-new\-passphrase} \e{file}
168 \dd Specify a file name; the first line will be read from this file
169 (removing any trailing newline) and used as the new passphrase. If the
170 file is empty then the saved key will be unencrypted. \s{CAUTION:} If
171 the passphrase is important, the file should be stored on a temporary
172 filesystem or else securely erased after use.
174 The following options do not run PuTTYgen as normal, but print
175 informational messages and then quit:
177 \dt \cw{\-h}, \cw{\-\-help}
179 \dd Display a message summarizing the available options.
181 \dt \cw{\-V}, \cw{\-\-version}
183 \dd Display the version of PuTTYgen.
187 \dd Display the fingerprints of the PuTTY PGP Master Keys, to aid
188 in verifying new files released by the PuTTY team.
190 \S{puttygen-manpage-examples} EXAMPLES
192 To generate an SSH-2 RSA key pair and save it in PuTTY's own format
193 (you will be prompted for the passphrase):
195 \c puttygen -t rsa -C "my home key" -o mykey.ppk
197 To generate a larger (4096-bit) key:
199 \c puttygen -t rsa -b 4096 -C "my home key" -o mykey.ppk
201 To change the passphrase on a key (you will be prompted for the old
202 and new passphrases):
204 \c puttygen -P mykey.ppk
206 To change the comment on a key:
208 \c puttygen -C "new comment" mykey.ppk
210 To convert a key into OpenSSH's private key format:
212 \c puttygen mykey.ppk -O private-openssh -o my-openssh-key
214 To convert a key \e{from} another format (\c{puttygen} will
215 automatically detect the input key type):
217 \c puttygen my-ssh.com-key -o mykey.ppk
219 To display the fingerprint of a key (some key types require a
220 passphrase to extract even this much information):
222 \c puttygen -l mykey.ppk
224 To add the OpenSSH-format public half of a key to your authorised
227 \c puttygen -L mykey.ppk >> $HOME/.ssh/authorized_keys