SSH on Windows 11 without PuTTY: native OpenSSH in 5 minutes

For years, connecting to a Linux server from Windows meant downloading PuTTY, configuring sessions, exporting keys into a proprietary format — a dance every sysadmin knows by heart. That ritual ended in 2018, when Microsoft added OpenSSH as an optional component of Windows 10. On Windows 11 it comes pre-installed. You almost certainly have a full SSH client on your machine right now and don’t know it.

What is the native Windows OpenSSH?

Microsoft ported OpenSSH — the same package that runs on Linux and macOS — as an optional feature of Windows 10 (from version 1809, October 2018) and as a pre-installed component on Windows 11. That includes:

• ssh — the client for connecting to remote servers
• ssh-keygen — generates RSA, ed25519 and ECDSA key pairs
• ssh-agent — in-memory key manager
• scp and sftp — secure file transfer
• sshd — the SSH server (disabled by default, but available)

All of it reachable straight from PowerShell, CMD or Windows Terminal. No third-party software.

Checking (and enabling) the SSH client

Open PowerShell as administrator and run:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Client*'

If the output shows State : Installed, you already have everything. If it says NotPresent, install it with:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

No reboot required. Once installed, the ssh command is available globally.

First connection: reaching a server

The syntax is identical to Linux:

ssh [email protected]

On the first connection, SSH asks whether you trust the server's key (its fingerprint). Confirm with yes — it gets saved to %USERPROFILE%\.ssh\known_hosts and won't be asked again.

To specify a port other than 22:

ssh -p 2222 [email protected]

To authenticate with a specific private key:

ssh -i C:\Users\John\.ssh\vps_key [email protected]

Key authentication — the right way to do SSH

Passwords are convenient, but a cryptographic key is safer and removes the brute-force risk entirely. Here's how to set it up in two steps.

Generating the key pair

In PowerShell (no admin needed):

ssh-keygen -t ed25519 -C "my-work-pc"

ed25519 is the recommended algorithm today — faster and with smaller keys than RSA-4096, at equivalent security. The -C parameter is a comment to identify the key later. The generator asks where to save it (accept the default: ~\.ssh\id_ed25519) and whether you want a passphrase — use one, it's what protects your private key if the PC is ever compromised.

Two files are created:

• id_ed25519 — the private key. Stays on your PC. Never share it.
• id_ed25519.pub — the public key. Goes to the server.

Copying the public key to the server

Linux has the ssh-copy-id command; Windows has no native equivalent. Use this one-liner in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "cat >> ~/.ssh/authorized_keys"

That appends your public key to the server's authorized_keys file. On the next connection, SSH authenticates with the key and never asks for a password (it will only ask for the key's passphrase, if you set one).

For good practice on the server side — such as disabling password authentication once the keys are in place — see our guide to SSH hardening with sshd_config.

Shortcuts with the config file

What is the SSH config file?

It's a text file at ~\.ssh\config that defines per-host shortcuts and settings, so you never have to memorise IPs, usernames and ports. Once it's set up, you connect with just ssh nickname.

Create or edit the file C:\Users\YourUser\.ssh\config:

Host vps-production
    HostName 198.51.100.42
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Host dev-server
    HostName dev.company.com
    User john
    IdentityFile ~/.ssh/dev_key
    ForwardAgent yes

With that in place, ssh vps-production connects directly, with no need to remember the IP, the user or the port. Each Host block can carry entirely independent settings.

SSH Agent: stop typing the passphrase every time

If you set a passphrase on the key, you'll have to type it on every connection. The ssh-agent keeps the unlocked key in memory for the session — you type it once, it handles the rest.

On Windows, ssh-agent is a service. To enable it permanently (PowerShell as admin):

Set-Service -Name ssh-agent -StartupType Automatic
Start-Service ssh-agent

Then add your key to the agent:

ssh-add ~/.ssh/id_ed25519

From that point on, any SSH connection in the current session uses the key without asking for the passphrase. The service stays active across reboots.

Transferring files with SCP

scp works like a cp between machines:

# Send a local file to the server
scp report.pdf [email protected]:/home/user/documents/

# Download a file from the server
scp [email protected]:/var/log/nginx/access.log C:\Logs\

# Copy an entire directory (-r)
scp -r ./project [email protected]:/home/user/

sftp offers an interactive FTP-style interface — handy when you want to browse directories before deciding what to copy. Run sftp [email protected] and use commands like ls, cd, get and put.

Is Windows Terminal worth installing?

SSH works fine in CMD and in PowerShell, but Windows Terminal makes daily work considerably easier — tabs, multiple profiles, support for Linux terminal colours, split panes. It's available from the Microsoft Store or through winget:

winget install Microsoft.WindowsTerminal

With Terminal set up you can keep simultaneous tabs open — one connected to the production server, another to staging — without stray PuTTY windows scattered across the desktop.

The full flow, summarised

1. Confirm OpenSSH is installed (Get-WindowsCapability)
2. Generate your key: ssh-keygen -t ed25519
3. Copy the public key to the server
4. Set up ~\.ssh\config with shortcuts
5. Enable ssh-agent as an automatic service
6. Connect with ssh host-nickname

The official Microsoft documentation covers OpenSSH on Windows in detail, including server scenarios (enabling sshd to accept connections on Windows itself). If you want to go further on the Linux side — configuring AllowUsers, MaxAuthTries and disabling root login — the guide to sshd_config hardening walks through it step by step.