Use SSH keys with FileZilla on Windows by converting your private key to PuTTY format using PuTTYgen, then configuring the connection settings in FileZilla’s Site Manager. For command-line automation in Windows CMD, use the native OpenSSH client which natively supports standard PEM or ED25519 keys without conversion, allowing you to execute secure file transfers via SCP or SFTP commands directly from the terminal.
Prerequisites and Key Generation
Before configuring either FileZilla or the Windows Command Prompt, you must have a valid SSH key pair. If you do not already have one, generate it using the built-in OpenSSH tools available in modern versions of Windows (10 and 11). Open PowerShell or CMD and run the following command:
ssh-keygen -t ed25519 -C "[email protected]"
This creates two files in your
.ssh directory within your user profile:
id_ed25519 (private key) and
id_ed25519.pub (public key). You must upload the public key content to your server’s
~/.ssh/authorized_keys file. If you are migrating from an existing setup or need to locate your current keys, refer to our guide on
Where to Find SSH Key on Your System for detailed paths and troubleshooting steps regarding missing key files.
Configuring FileZilla for SSH Keys
FileZilla does not natively read standard OpenSSH private keys (like those generated by
ssh-keygen). It requires keys in the proprietary PuTTY format (
.ppk). Therefore, the workflow involves converting your key before connecting.
First, download and install PuTTY if you do not have it. Although you aim to avoid PuTTY for daily use, PuTTYgen is a standalone utility required only for this conversion step. Launch
PuTTYgen and follow these steps:
- Click Load and navigate to your private key file (e.g.,
id_ed25519). You may need to change the file type filter to "All Files" to see it.
- If your key has a passphrase, enter it when prompted. If you wish to remove the passphrase for automated scripts, leave the fields blank, but note that this reduces security.
- Click Save private key and save it as a
.ppk file (e.g., mykey.ppk).
Next, open FileZilla and go to
File >
Site Manager. Create a new site entry:
- Protocol: Select SFTP - SSH File Transfer Protocol.
- Host: Enter your server’s IP address or domain.
- Logon Type: Change this from "Normal" to Key file.
- User: Enter your username (usually
root or your specific user).
- Key file: Click Browse and select the
.ppk file you just created.
Click
Connect. FileZilla will now authenticate using the converted key. This method bypasses password prompts entirely. For users experiencing issues where SSH works but SFTP fails in similar environments, check our article on
Plesk Server: SSH Works, but SFTP Doesn't to rule out permission errors on the server side.
Using SSH Keys in Windows CMD
For command-line workflows, Windows 10 and 11 include the OpenSSH Client by default. Unlike FileZilla, the native CMD/PowerShell environment handles standard OpenSSH keys natively. No conversion to
.ppk is necessary.
To connect using your key, ensure the private key is located in your
.ssh folder and has restrictive permissions (only accessible by your user). In CMD or PowerShell, use the
ssh command with the
-i flag to specify the identity file:
ssh -i C:\Users\YourUsername\.ssh\id_ed25519 username@server_ip
If your key has a passphrase, you will be prompted to enter it upon connection. To verify that your local key matches the expected format and passphrase configuration, you can inspect its properties or test connectivity with verbose output:
ssh -v -i C:\Users\YourUsername\.ssh\id_ed25519 username@server_ip
The verbose output will show the key exchange process. Look for lines indicating "Offering public key" and "Server accepts key." If you recently changed your key's passphrase, ensure you are entering the correct one, as mismatched passphrases are a common cause of authentication failures. See
Verifying Passphrase Security for a Newly Generated SSH Key Locally for details on managing passphrase changes securely.
Transferring Files via CMD
Once authenticated via SSH, you can transfer files using the
scp (secure copy) or
sftp commands available in the same terminal session.
To copy a file from your local machine to the server:
scp -i C:\Users\YourUsername\.ssh\id_ed25519 local_file.txt username@server_ip:/remote/path/
To copy a file from the server to your local machine:
scp -i C:\Users\YourUsername\.ssh\id_ed25519 username@server_ip:/remote/file.txt ./local_destination/
Alternatively, use the interactive
sftp client:
sftp -i C:\Users\YourUsername\.ssh\id_ed25519 username@server_ip
Inside the SFTP prompt, use standard commands like
put,
get,
ls, and
cd to manage files. This approach provides a robust, scriptable alternative to GUI clients like FileZilla, ideal for automation tasks or servers with limited resources.
Troubleshooting Common Issues
If connections fail, first verify that the server’s
sshd_config file allows public key authentication. Ensure the line
PubkeyAuthentication yes is present and uncommented. Restart the SSH service after any config changes.
Check file permissions on the server. The
.ssh directory should be mode 700, and
authorized_keys should be mode 600. On Windows, ensure the private key file is not readable by other users; OpenSSH may refuse to use keys with overly permissive access rights. If you encounter key exchange errors, such as
kex_exchange_identification, review network firewalls and DNS resolution, as discussed in
Troubleshooting kex_exchange_identification Error in Linux SSH Connection.
Frequently Asked Questions
Can I use FileZilla with standard OpenSSH keys without conversion?
No, FileZilla does not support standard OpenSSH private keys directly. You must convert them to the PuTTY format using PuTTYgen. Attempting to load a standard PEM or ED25519 key directly into FileZilla will result in an error stating the file is not a valid key.
Is it safe to remove the passphrase from my SSH key?
Removing the passphrase makes the key less secure because anyone who obtains the private key file can use it without authorization. However, it enables fully automated scripts that do not require manual input. If you automate tasks, consider using SSH agents or restricted command execution on the server side to mitigate risks.
Why does my SSH connection work but SFTP fail in FileZilla?
This often indicates a permission issue on the server. The SSH daemon might accept the key for shell access, but the SFTP subsystem may fail if the home directory or
.ssh folder has incorrect ownership or permissions. Ensure the server user owns the
.ssh directory and the
authorized_keys file.
How do I handle multiple SSH keys in Windows CMD?
You can specify different keys for different hosts by editing the
config file in your
.ssh directory. Add entries mapping specific Hostnames to their respective IdentityFiles. This allows you to use
ssh hostname without specifying the
-i flag every time, as the client will automatically select the correct key based on the host alias.
What should I do if I get a "Permission denied (publickey)" error?
This error means the server rejected your key. Verify that the public key corresponding to your private key is correctly appended to the server’s
~/.ssh/authorized_keys file. Also, check that the key file path is correct and that the file permissions on the server are strict (700 for .ssh, 600 for authorized_keys).