Convert a PuTTY (.ppk) private key for SFTP – Support Center

NextCity can sign in to your SFTP server with a private key for scheduled imports and scheduled reports. It reads keys in OpenSSH or PEM format. PuTTY and WinSCP save keys in their own PuTTY (.ppk) format, which NextCity can't read.

If you paste a .ppk key into NextCity, you'll see a message asking you to convert it. Converting takes a minute and only changes the file format. It's still the same key, so nothing changes on your SFTP server, and your original .ppk file keeps working in PuTTY and WinSCP.

Keep your private key private

Convert the key yourself, on your own computer. Never email or send a private key to anyone, including our Support Team. We'll never ask you for it.

Check your key's format

Open the key file in a text editor such as Notepad and look at the first line.

PuTTY (.ppk): the first line starts with PuTTY-User-Key-File-2: or PuTTY-User-Key-File-3:. Convert it with the steps below.
OpenSSH: the first line is -----BEGIN OPENSSH PRIVATE KEY-----. Paste it into NextCity as it is.
PEM: the first line is -----BEGIN RSA PRIVATE KEY-----, -----BEGIN PRIVATE KEY----- or similar. Paste it into NextCity as it is.

Convert a .ppk key with PuTTYgen (Windows)

PuTTYgen comes with PuTTY. You can also download it from the official PuTTY download page.

Open PuTTYgen, choose File > Load private key, and select your .ppk file

If you don't see the file, change the file type filter to All Files (*.*). If the key has a passphrase, enter it when PuTTYgen asks.

Choose Conversions > Export OpenSSH key

If PuTTYgen warns that you're saving the key without a passphrase, choose Yes to continue. To protect the converted key with a passphrase instead, cancel, type one in Key passphrase and Confirm passphrase, then export again.

Save the file somewhere private, for example my-sftp-key.pem

Open the saved file in a text editor and copy all of it, including the -----BEGIN and -----END lines

In NextCity, open the scheduled import or scheduled report, paste the key into the Private Key field, and save

If the converted key has a passphrase, enter it in the Passphrase field too. Then use Test connection to check that NextCity can sign in to your server.

Convert from the command line

On macOS or Linux, or on Windows with PuTTY's command-line tools, run:

puttygen key.ppk -O private-openssh -o key.pem

Replace key.ppk with the name of your key file. If the key has a passphrase, puttygen asks for it, and the converted key keeps the same passphrase. Copy everything in key.pem into the Private Key field in NextCity, and enter the passphrase in the Passphrase field if there is one.

To install puttygen on macOS, use Homebrew: brew install putty. On Debian or Ubuntu Linux, use sudo apt install putty-tools.

Use a Managed SFTP key in WinSCP or PuTTY

If we host your SFTP server (Managed SFTP), your private key comes as a .pem file in OpenSSH format. WinSCP, PuTTY and some billing software need a .ppk file instead. To convert it:

Open PuTTYgen, choose File > Load private key, change the file type filter to All Files (*.*), and select your .pem file

PuTTYgen confirms that it imported the key.

Optional, but recommended: type a passphrase in Key passphrase and Confirm passphrase

Choose Save private key and save the file with a .ppk extension

In WinSCP, PuTTY or your billing software, select that .ppk file as your private key

From the command line:

puttygen key.pem -o key.ppk

If your software can't read the .ppk file

Current versions of PuTTYgen save .ppk files in version 3 by default. PuTTY 0.74 and older, and some other programs, can only read version 2. In PuTTYgen, choose Key > Parameters for saving key files, set PPK file version to 2, then save the private key again. From the command line, add --ppk-param version=2.

Keep the original .pem file somewhere private, and don't send either file to anyone.

Still stuck?

If NextCity still can't read your key after you've converted it, contact our Support Team. Tell us the error message you see, but don't send us the key.