A PuTTY alternative, and what moving across involves

PuTTY is a terminal. Each connection gets its own window, and it speaks SSH, Telnet, Rlogin, SUPDUP, raw TCP and serial lines, on Windows and on Unix. Around it sits a set of separate programs: PSCP and PSFTP copy files from a command prompt, Plink runs remote commands, PuTTYgen makes and converts keys, and Pageant holds decrypted keys for all of them.

What it lacks is on the project’s own wishlist, with the project’s own verdicts. Several sessions in one window, meaning tabs, is low priority and, in the author’s words, close to never. A graphical SFTP client is low priority as well, and the links page sends you to WinSCP or FileZilla. Remembering passwords is marked never, on purpose. A search box for the scrollback has been an open wish since at least 2002.

There is no Mac version. The FAQ recounts attempts around 2005 and 2015 and says that, as of 2026, the author doubts the core team will ever finish one. Homebrew’s third-party formula builds the Unix GTK version on a Mac and has included the putty window itself since January 2025, but it is still the Unix interface, only running on macOS, and the project neither ships nor supports it.

If you stay, get it from the project: the pages at chiark.greenend.org.uk, the putty.software address the team set up in August 2025, or its Microsoft Store listing, which the FAQ confirms is theirs. putty.org is not theirs. Darktrace and Arctic Wolf both reported fake PuTTY download sites, active from June 2025 and pushed up through search results, that installed the Oyster backdoor next to a working PuTTY.

People leave PuTTY for different reasons, so there is no single replacement. Four honest answers, three of which are not us:

• Tabs, on Windows 11. Windows Terminal has been the default terminal since Windows 11 22H2, with tabs and split panes, and Microsoft’s OpenSSH client, ssh.exe, is an optional feature of Windows 10 from version 1809 and of Windows 11. Both are free. ssh.exe reads OpenSSH keys rather than .ppk, so export each key in PuTTYgen with Conversions, Export OpenSSH key.
• A file window, on Windows. WinSCP imports your PuTTY sessions directly (Tools, Import Sites, in its login dialog) and can open a session in PuTTY. FileZilla also runs on macOS and Linux.
• PuTTY itself, with a tab bar around it. SuperPuTTY and MTPuTTY wrap PuTTY windows in one tabbed frame; the PuTTY links page lists both.
• A Mac, files and remote desktops beside the terminal, or the same hosts on two machines. That is the case Conchshell is built for, and the rest of this page is about moving to it.

Where sessions live. PuTTY keeps each saved session as a registry key under HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions, unencrypted, with the host keys it has accepted beside them under SshHostKeys. On Linux the same settings are text files in ~/.putty/sessions, or in ~/.config/putty/sessions if that folder exists. There is no export button; section 4.33 of the manual offers a regedit recipe instead.

What Conchshell imports. It has no PuTTY importer. It imports hosts from ~/.ssh/config, which on Windows is %USERPROFILE%\.ssh\config: HostName, User, Port, IdentityFile and the first hop of ProxyJump, offered on the first screen and under Settings, Advanced. It imports Bitvise .tlp profiles since 2.16.0, and its own JSON export. So the short way out of PuTTY is to write your sessions into an ssh_config file, which the script in the next section does.

Keys. Your .ppk files work as they are: formats 2 and 3, passphrase-protected or not, holding RSA, Ed25519 or ECDSA keys. DSA and Ed448 keys are refused. Choosing a .ppk in the connection window leaves the original untouched and saves an OpenSSH copy next to it. For a key with a passphrase, that happens only if the passphrase is already typed into the window, and the copy is encrypted with it; otherwise the .ppk itself is read at connect time, as it is for a path that arrives through the config import. Keys kept in your .ssh folder appear under Settings, Keys on their own. To grade the public half of a key, paste it into the key checker.

Pageant. Since 2.17.0 Conchshell signs in through ssh-agent on macOS and Linux, and on Windows through the built-in OpenSSH Authentication Agent, but Pageant does not work yet, and no agent is ever forwarded to the server. With a key file, the application opens the file itself and asks for the passphrase when it connects, with a Remember switch that stays off until you turn it on.

Passwords. PuTTY never stored any, so there are none to move. Conchshell can: after you save the first one, it offers an encrypted vault (XChaCha20-Poly1305) when it next starts, and again at every start until you accept. On Windows and Linux, where no system keychain is used, the vault asks for a master passphrase of at least 12 characters, derives its key with Argon2id and gives you a recovery code; on a Mac it takes one click and keeps its key in the system keychain. Until you accept, saved passwords sit unencrypted in the application’s local storage, so accept. Independent slots sit over one data key — the passphrase, the system keychain (macOS, iOS and Android only) and a recovery code — and the interface can create a credential and delete it but has no command to read one back. Each credential in the vault is bound to its host, port, user, proxy and jump host and is not offered anywhere else.

Jump hosts and proxies. PuTTY’s “SSH to proxy and use port forwarding” becomes the Jump Host fields, with their own user and password or key. It is one hop: PuTTY can chain hops by pointing a session’s proxy at another saved session, and Conchshell cannot. HTTP CONNECT, SOCKS4, SOCKS4a and SOCKS5 proxies are supported and are set in the connection window.

Host keys. The keys PuTTY accepted do not come across, so each server asks once. The prompt is drawn by the operating system and shows a SHA256 fingerprint; PuTTY’s Event Log (right-click its title bar) prints the same format for comparison. Dismissing it without a button (Escape, the close box, Alt+F4) counts as a refusal, so nothing is trusted by accident; in 2.16.0 and earlier it counted as trust on Windows and Linux, which was fixed in 2.17.0.

Fonts and colours. PuTTY defaults to Courier New at 10 points on Windows and takes any installed font. Conchshell picks from a list of seven: Menlo, JetBrains Mono, Fira Code, Source Code Pro, Consolas, Monaco and Courier New. It ships none of them, so only the ones installed on the machine render and the rest fall back to the system’s monospace font. On a stock Windows that leaves Consolas and Courier New, and the default, Menlo, shows as Courier New. Sizes are in pixels, the colour themes are built in (Solarized, Dracula, Nord, Gruvbox and others), and there is no editor for single colours, so PuTTY’s Colour0 to Colour21 values do not carry over.

Copy and paste. Selecting text does not copy it; Ctrl+C copies a selection and otherwise reaches the server as usual. Ctrl+V does not paste: as in PuTTY, it reaches the server as ^V, even though the right-click menu lists Ctrl+V beside Paste. On Windows, paste with Shift+Insert, as in PuTTY. A right-click opens that menu rather than pasting at once, and the first time you use its Paste on Windows, a prompt from tauri.localhost, which is the application’s own page, asks to see the clipboard: choose Allow, then paste again. On a Mac, Cmd+C and Cmd+V copy and paste.

Keys the terminal keeps. On Windows and Linux, Ctrl+A selects all and Ctrl+F opens the search box, so neither reaches the server. That takes away the GNU screen prefix, start-of-line and forward-character in bash and emacs, and page-down in less and vim. The two keys are fixed and cannot be reassigned, so screen users need another prefix; tmux’s Ctrl+B is unaffected. On a Mac these jobs sit on Cmd+A and Cmd+F, and Ctrl+A and Ctrl+F reach the server.

1. Keep a copy of everything PuTTY holds. Open PowerShell (on Windows 11, Windows Terminal opens it by default) and run: reg export HKCU\Software\SimonTatham\PuTTY "$env:USERPROFILE\putty.reg". It needs no administrator rights; in cmd, write %USERPROFILE% instead of $env:USERPROFILE. The file is text you can open in Notepad, and it is your backup whatever happens next.
2. Write your SSH sessions into an ssh_config. Paste the script below into the same PowerShell window. It reads every saved session, skips Telnet, serial and raw ones, and appends a Host block per session to %USERPROFILE%\.ssh\config, creating the file if there is none. It carries the address, port, user name, the .ppk path and a jump host set as “SSH to proxy”; SOCKS and HTTP proxies are left for the connection window. Session names keep their letters, Cyrillic included, with spaces and other symbols turned into hyphens. A session whose jump host sits behind a second one gets a comment in the file and a warning on screen. Telnet and raw sessions have to be re-created in Conchshell by hand.

$src = 'HKCU:\Software\SimonTatham\PuTTY\Sessions'
$cfg = "$HOME\.ssh\config"
Add-Type -AssemblyName System.Web
$acp = Get-ItemPropertyValue 'HKLM:\SYSTEM\CurrentControlSet\Control\Nls\CodePage' ACP
$enc = [Text.Encoding]::GetEncoding([int]$acp)
$dec = { param($n) [Web.HttpUtility]::UrlDecode($n.Replace('+', '%2B'), $enc) }
$safe = { param($n) ($n -replace '[^\w.-]+', '-').Trim('-') }
$saved = [ordered]@{}
foreach ($k in Get-ChildItem $src) { $saved[(& $dec $k.PSChildName)] = Get-ItemProperty $k.PSPath }
$out = foreach ($n in $saved.Keys) {
  $s = $saved[$n]
  if ($s.Protocol -ne 'ssh' -or -not $s.HostName) { continue }
  $h = $s.HostName; $u = $s.UserName
  if ($h -match '^(.*)@([^@]+)$') { if (-not $u) { $u = $Matches[1] }; $h = $Matches[2] }
  $name = & $safe $n; if (-not $name) { $name = $h }
  ''
  "Host $name"
  "  HostName $h"
  if ($u) { "  User $u" }
  if ($s.PortNumber -and $s.PortNumber -ne 22) { "  Port $($s.PortNumber)" }
  if ($s.PublicKeyFile) { "  IdentityFile `"$($s.PublicKeyFile)`"" }
  if ($s.ProxyMethod -eq 6) {
    $j = "$($s.ProxyHost):$($s.ProxyPort)"
    if ($s.ProxyUsername) { $j = "$($s.ProxyUsername)@$j" }
    $p = if ($s.ProxyHost) { $saved[$s.ProxyHost] }
    if ($p) {
      $j = & $safe (& $dec $p.PSChildName)
      if ($p.ProxyMethod -eq 6) {
        '  # PuTTY goes through two jump hosts here; fix by hand'
        Write-Warning "${name}: PuTTY chains two jump hosts, Conchshell takes one"
      }
    }
    "  ProxyJump $j"
  }
}
New-Item -ItemType Directory -Force (Split-Path $cfg) | Out-Null
if ($out) {
  [IO.File]::AppendAllLines($cfg, [string[]]$out, (New-Object Text.UTF8Encoding $false))
}

3. If that config file existed before, read it through. OpenSSH takes the first value it meets and Conchshell follows the same rule, so a Host * block above the new entries that sets User or Port wins over theirs. The config linter also flags weak ciphers left in it.
4. Moving to a Mac at the same time? Run the script on the Windows machine, copy the config and the .ppk files into ~/.ssh on the Mac, and change each IdentityFile to ~/.ssh/ followed by the file name.
5. Install Conchshell, open Settings, Advanced, Import from ~/.ssh/config (the first screen offers the same list), and choose a folder to import into. Nothing is saved before you have seen the list: duplicates and hosts without a user name start unticked. A host the script warned about is not marked there: it arrives ticked, with only the nearer jump host, and will not connect unless that jump host can be reached directly. Untick it and keep it in PuTTY, since Conchshell takes one hop.
6. Connect to each host once. Hosts with a key use the .ppk you already have and ask for its passphrase if it has one; the rest ask for a password. Take the vault when it is offered.
7. Compare each host key as it comes up, and answer the prompt with a button.
8. Leave PuTTY installed for a fortnight, and for good if you use serial lines or tunnels. The two share no settings, and Conchshell never writes to PuTTY’s registry key.

On Linux the sessions are text files in ~/.putty/sessions, or in ~/.config/putty/sessions if that folder exists, one per session, with the same value names (HostName, PortNumber, UserName, PublicKeyFile); copy them into ~/.ssh/config by hand.

• Serial lines, Rlogin and SUPDUP. A console cable to a switch or a BMC stays PuTTY’s job, which on its own is a reason to keep it. Telnet and raw TCP sessions do open in Conchshell’s terminal, unencrypted, with a warning before you connect.
• Tunnels. Local, remote and dynamic port forwarding, X11 forwarding, GSSAPI sign-on and OpenSSH host certificates are PuTTY features with no counterpart in Conchshell 2.17.1. OpenSSH user certificates do work: on a computer, a <key>-cert.pub file beside the key file is presented automatically.
• Agent forwarding: Conchshell has none, and Pageant does not work yet; it signs in through ssh-agent on macOS and Linux, and on Windows through the built-in OpenSSH agent.
• Chained jump hosts. One hop is the limit here.
• Post-quantum key exchange. PuTTY has offered NTRU Prime since 0.78 and ML-KEM since 0.83; Conchshell 2.17.1 uses russh’s default set, led by curve25519-sha256, which is not post-quantum.
• Size and reach. putty.exe is a 1.7 MB file that runs without installing, with native builds for 64-bit Arm. Conchshell for Windows is an x64 installer, 7.4 MB for version 2.16.0, that fetches Microsoft Edge WebView2 from the network when the machine has none. PuTTY is also often on a company’s approved-software list already, which no new client joins quickly.

Tabs, tab groups, tabs you can drag, and a pane that splits four ways. Sessions come back when you reopen the application, local tabs run your own shell and remember their directory, and a search box covers the scrollback (Ctrl+F, or Cmd+F on a Mac).

Files in the same window: local and remote panes with drag and drop, a transfer queue with progress, speed, ETA, cancel and retry, directory compare in four explicit steps, and remote files opened in your own editor with saves sent back. FTPS, meaning FTP over TLS, is built in, with the server certificate pinned on first use.

PuTTY does not speak RDP, and there is no entry for it on the wishlist; people forward a port over SSH with -L and point Remote Desktop Connection at the local end, which works and leaves the remote desktop a separate application. Here remote desktop is built in, each session in a window of its own, with its limit stated: NLA (CredSSP) only, so a host with NLA switched off will not connect and mstsc stays for that one. And a view PuTTY never set out to give: CPU, memory, disk and processes with live graphs, traffic per interface, latency, open connections, and a log viewer with level filters, regex and live tail.

The one paid part is sync: carrying saved connections between your own machines costs $19 once, an introductory price that rises to $29. It mirrors the encrypted store into a folder you already sync, such as iCloud Drive, Dropbox or a git checkout, and devices linked by a code on screen also sync directly over your local network while the app is open on both. There is no account and no cloud of ours in the path; the licence key is checked on your own machine.

Is there a PuTTY alternative for Mac?

PuTTY has no Mac version, and the project does not expect to make one. A Mac already has OpenSSH: ssh works in Terminal, which has tabs. Homebrew’s formula builds the GTK window from PuTTY’s Unix version if you want the familiar look, without support from the project. For saved sessions in folders, SFTP panes and the .ppk keys you already have, Conchshell runs natively on Apple silicon and Intel Macs and is free; sync between machines is $19 once.

What is the best PuTTY alternative for Windows 11?

It depends on what you are missing. If tabs are all you miss, Windows Terminal (the default terminal on Windows 11) with Microsoft’s OpenSSH client from Optional features costs nothing, though ssh.exe needs each .ppk exported to OpenSSH format. For a file window, WinSCP imports PuTTY sessions directly. Conchshell puts tabs, SFTP panes, FTPS and RDP in one window, reads .ppk keys as they are and imports hosts from an ssh_config file; it runs on Windows 10 and 11, x64 only.

Is there a version of PuTTY with tabs?

Not from the project: tabs sit on its wishlist at low priority, described as close to never. SuperPuTTY and MTPuTTY put PuTTY windows inside a tabbed frame, and Windows Terminal gives tabs to ssh.exe. Conchshell has tabs, tab groups, a four-way split and session restore built in.

Does PuTTY have an SFTP GUI?

No. PSFTP and PSCP are command-line programs, and a graphical client is a low-priority wish; the project points to WinSCP and FileZilla, both of which include PuTTY code. WinSCP runs on Windows only and imports PuTTY sessions. Conchshell shows local and remote panes in the terminal window, with drag and drop and a transfer queue.

Can Conchshell import my PuTTY sessions and .ppk keys?

Sessions only indirectly: there is no PuTTY importer. It imports hosts from ~/.ssh/config, so the PowerShell script on this page writes your saved SSH sessions into that file, with address, port, user name, key path and jump host, and Conchshell then imports them from Settings, Advanced. The .ppk keys work as they are: formats 2 and 3, passphrase-protected ones included, with RSA, Ed25519 and ECDSA keys, so there is no PuTTYgen step. If you also need the key for ssh in Terminal or another OpenSSH client, convert it to OpenSSH in the browser; the key never leaves the page. Pageant does not work yet; the app can sign in through ssh-agent on macOS and Linux, or through the built-in OpenSSH agent on Windows, and otherwise it opens the key file itself and asks for its passphrase when connecting. PuTTY never held passwords, so there are none to bring.

Does right-click paste, as it does in PuTTY?

No. In Conchshell a right-click opens a menu with Copy and Paste, and selecting text does not copy it. On Windows, Shift+Insert pastes as it does in PuTTY, and Ctrl+V reaches the server as ^V, as it also does in PuTTY. On a Mac, Cmd+C and Cmd+V copy and paste.

Is Conchshell free?

The application is free on macOS, Windows, Linux, Android, iPhone and iPad, with no account, trial or subscription. One feature is paid: syncing saved connections between your own machines, $19 once, an introductory price that rises to $29, with updates included and no limit on machines. PuTTY is free in a stronger sense, with no paid part at all.

Be clear about which PuTTY you are replacing. If it is your serial console and your tunnel builder, none of this touches that, and the sensible result is two clients on one machine.

If it is the SSH window you have used since it came with the job, and two other programs now sit open beside it, that part Conchshell replaces. It is free to try on your own servers and nothing expires; the only money involved is $19, once, and only if you want the same host list on more than one machine.

Download and try it on your own hosts

• Download for macOS, Windows or Linux
• Conchshell on Windows
• Conchshell on a Mac
• How the vault and host keys work
• If you are also weighing WinSCP
• If you are also weighing MobaXterm
• What is free and what the $19 covers