Use a PuTTY .ppk Key on iPhone and iPad
If your SSH keys came from a Windows workflow, they are probably .ppk files, which use PuTTY's own private key format rather than OpenSSH's. The traditional answer is to convert with PuTTYgen on a Windows machine first, which is an awkward prerequisite when the thing you want to do is connect from a phone. GateShell imports PPK directly, including the Argon2-encrypted PPK version 3 files that newer PuTTY releases produce by default.
Written by the GateShell team at Hefty Innovations
Step by step
- 1
Get the .ppk file to your device
Put it somewhere the document picker can reach: iCloud Drive, or any storage provider that appears in the Files app. This is a private key, so treat the transfer accordingly: prefer a path you control over emailing it to yourself, and delete the intermediate copy afterwards.
- 2
Import it in the key manager
In Settings, under SSH Keys, choose to import and select the .ppk. GateShell parses the PuTTY format directly. If the key is encrypted you will be asked for its passphrase, and this is a real decryption, so a wrong passphrase fails cleanly rather than importing something broken that fails later at connect time.
- 3
Know which PPK version you have, if it fails
PuTTY 0.75 and later default to PPK version 3, which uses Argon2 for key derivation instead of the SHA-1 scheme in version 2. Both import here. Version 3 exists precisely because the older derivation was too cheap to brute-force, so if you are regenerating keys anyway, version 3 with a real passphrase is the better choice.
- 4
Assign the key to a server
Set the server's authentication method to SSH key and select the imported key. The server needs no changes at all. It already has the matching public key in authorized_keys from your Windows setup, and it neither knows nor cares which client format the private half was stored in.
- 5
Consider generating a device-local key instead
Importing works and is the fastest path to a working connection. But a key that has been copied between machines is, by definition, a key that exists in more than one place. For a phone you carry, generating a fresh key on the device, ideally in the Secure Enclave where it cannot be extracted at all, and adding its public half to authorized_keys is the stronger arrangement. Import to get working now; consider this once you are.
- 6
Clean up the copies
Delete the .ppk from wherever you staged it for the transfer. The imported key lives in the Keychain, hardware-encrypted, and the intermediate copy in iCloud Drive or your downloads folder serves no further purpose while remaining a private key sitting in a less protected place.
Frequently asked questions
Do I need PuTTYgen to convert the key first?+
No. GateShell reads the .ppk format directly, including encrypted PPK v2 and Argon2-encrypted PPK v3. Conversion on a Windows machine is exactly the prerequisite this removes.
What is the difference between PPK v2 and v3?+
How the passphrase protects the key. Version 2 derives its encryption key with SHA-1, which is cheap enough to attack offline given a captured file. Version 3, the default since PuTTY 0.75, uses Argon2, which is deliberately expensive to brute-force. Both import; v3 is meaningfully more resistant if the file is ever exposed.
My import fails with the right passphrase. What now?+
Confirm the file is genuinely a private key rather than the .pub or a PuTTY session export, since mixing those up is common. A .ppk begins with a PuTTY-User-Key-File header line, which you can check in any text editor. If the file is truncated from an imperfect transfer, re-copy it.
Can I export a key from GateShell back to .ppk?+
Software keys live in the Keychain and are not exported in PuTTY format. Secure Enclave keys cannot be exported at all, by design. If you need one key across many clients, keep your canonical copy on a machine you control and import from there.
Is the imported key stored securely?+
It goes into the iOS Keychain, which is hardware-encrypted, the same place passwords and generated keys are held. It is never written to plain files or to app storage, and it is never transmitted anywhere, because there is no backend to transmit it to.
Try it in GateShell
GateShell is a zero-backend SSH client for iPhone, iPad, and Mac, with no vendor cloud, no accounts and no telemetry. Everything above works out of the box.
Guide reflects GateShell's shipped features as of September 2026. Steps assume basic familiarity with SSH and the command line; server-side commands may vary by distribution. All product names, logos, and brands are property of their respective owners.