By Jeremy Koski · September 17, 2026 · 6 min read
If you are deploying a website or application to a VPS, the first thing you need is a secure way to connect to it. This guide walks through creating SSH keys with PuTTY on Windows, connecting to your server, configuring key-based authentication, and hardening SSH so password-based attacks cannot reach you. By the end, you will have one-click access to your server and password login disabled.
PuTTY is a free SSH client for Windows. It comes bundled with PuTTYgen (the key generator), Pageant (an SSH agent), and PSCP (a secure copy tool). Download the 64-bit MSI installer from the official site at chiark.greenend.org.uk. Run the installer with administrator privileges and accept the default components. After installation, verify that both PuTTY and PuTTYgen appear in your Start Menu.
Open PuTTYgen from the Start Menu. At the bottom of the window, under Parameters, set the key type to RSA and the number of bits to 4096. Click Generate, then move your mouse around the blank area to generate random entropy. Once the progress bar completes, the public key appears in the text box at the top.
In the Key comment field, enter a label such as jeremy-53west-vps so you can identify this key later. In the Key passphrase field, enter a strong passphrase and confirm it. This passphrase protects the private key if the file is ever lost or stolen.
Click Save private key in PuTTYgen. Choose a secure location such as C:\Users\<your-username>\.ssh\ and name the file jeremy-53west-vps.ppk. Store a backup of this file in a separate secure location such as an encrypted USB drive or a password manager vault. Do not share this file with anyone. Do not close PuTTYgen yet, because the public key is needed for the next steps.
Select all text in the Public key for pasting into OpenSSH authorized_keys file box at the top of PuTTYgen. Copy it to your clipboard. Open a plain text editor like Notepad, paste the key, and save the file as public_key.txt on your Desktop. Verify that the pasted key starts with ssh-rsa and ends with your key comment label.
Open PuTTY. In the Host Name field, enter your server IP address. Confirm the port is set to 22 and the connection type is SSH. Click Open to start the connection. If this is your first connection, PuTTY displays a security alert about the server host key. Click Accept to cache it.
At the login as: prompt, type root and press Enter. Enter the root password provided by your VPS provider. You are now logged into the server.
On the VPS, create the .ssh directory and set its permissions:
mkdir -p ~/.ssh
chmod 700 ~/.sshOpen the authorized_keys file in nano:
nano ~/.ssh/authorized_keysPaste the public key you copied in Step 4. The entire key must be on a single line with no line breaks. Save with Ctrl+O, press Enter to confirm, then exit with Ctrl+X. Set the correct permissions:
chmod 600 ~/.ssh/authorized_keysVerify the key was added by running cat ~/.ssh/authorized_keys. The output should show a single line starting with ssh-rsa and ending with your key comment label.
Open PuTTY on your Windows machine. Enter your server IP address. In the left navigation pane, expand Connection, then SSH, then Auth. Under Authentication parameters, click Browse and select your .ppk file. Click Open to connect.
At the login as: prompt, type root. If prompted for the key passphrase, enter the passphrase you set in PuTTYgen. If authentication succeeds without asking for the root password, key-based authentication is working correctly.
If the server still asks for a password, verify that the public key in authorized_keys matches the key pair and that there are no line breaks or trailing whitespace in the key entry.
After confirming key-based authentication works, disable password login to prevent brute-force attacks. Open the SSH daemon configuration file:
nano /etc/ssh/sshd_configFind the following lines and change their values (or add them if they do not exist):
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-passwordSave with Ctrl+O, exit with Ctrl+X, then restart the SSH service:
systemctl restart sshdKeep your current SSH session open. Open a new PuTTY session using the private key to confirm you can still connect. Do not close the existing session until you have verified the new connection works.
Open PuTTY. Enter your server IP address. Configure the private key under Connection > SSH > Auth. Go back to the Session screen. In the Saved Sessions field, enter a name such as 53west VPS and click Save. To connect in the future, double-click the saved session name and PuTTY loads all settings automatically.
Pageant is an SSH authentication agent that holds your private key in memory so you do not need to enter the passphrase each time you connect. Open Pageant from the Start Menu. Right-click the Pageant icon in the system tray and select Add Key. Navigate to your .ppk file and enter the passphrase when prompted.
To have Pageant start automatically on Windows boot, press Win+R, type shell:startup, and press Enter. Create a shortcut to pageant.exe with the path to your key file appended in quotes. Pageant now loads your key on startup.
After completing this guide, you have a 4096-bit RSA SSH key pair generated and stored securely, key-based authentication configured and tested, password authentication disabled, a saved PuTTY session profile for one-click access, and optionally Pageant configured for passphrase-free key management. Your VPS is now accessible only through SSH keys, which eliminates brute-force password attacks entirely.
For help with VPS setup, server configuration, or network security, see our IT services page or book an on-site visit.