Pageant – PuTTY SSH Authentication Agent

Pageant (pageant.exe) is the SSH authentication agent included in every PuTTY download for Windows. A pageant download gives you a system-tray agent that loads your decrypted private keys into memory — so PuTTY, Plink, and PSCP can all authenticate automatically without prompting for a passphrase on each connection.

Download Pageant

Pageant is included in the full PuTTY suite download and also available as a standalone executable from the official release page:

chiark.greenend.org.uk – Download pageant.exe

How Pageant Works

When Pageant runs, it creates a named pipe on Windows that PuTTY, Plink, PSCP, and PSFTP all query when they need to authenticate. If Pageant has the relevant private key loaded and the server accepts it, authentication completes without prompting you for a passphrase.

Pageant appears as an icon in the Windows system tray. Right-clicking the tray icon gives access to key management functions.

Loading Keys into Pageant

Via the GUI

Run pageant.exe. It will appear as a hat icon in the system tray.
Right-click the tray icon and select Add Key.
Browse to your .ppk private key file and select it.
Enter the key passphrase when prompted.
The key is now loaded. PuTTY and other suite tools will use it automatically.

Via Command-Line (at startup)

Pass one or more .ppk file paths as arguments to load them automatically when Pageant launches:

pageant.exe "C:\Users\You\.ssh\id_rsa.ppk" "C:\Users\You\.ssh\server2.ppk"

Tip: Create a Windows startup shortcut pointing to this command so your keys are loaded automatically each time you log in.

Command-Line Switches

Switch	Description
`pageant.exe key.ppk`	Load key.ppk into agent on startup.
`pageant.exe -c program`	After loading keys, execute 'program' and exit Pageant when the program finishes.
`pageant.exe --help`	Display usage information.
`pageant.exe --unix`	Use a Unix-domain socket instead of a Windows named pipe (WSL interop).
`pageant.exe -encrypted key.ppk`	Add key in encrypted form (deferred decryption until first use).

Using the -c Switch for Automation

The -c switch allows you to run an application using the loaded keys, then automatically terminate Pageant when that application exits. This is useful for launching a specific session or triggering a tool like WinCVS after key authentication:

# Load key and launch a program; Pageant exits when the program closes
pageant.exe "C:\keys\deploy.ppk" -c "C:\tools\WinCVS.exe"

Using Pageant with PuTTY Sessions

Generate a key pair using PuTTYgen and add the public key to your server's authorized_keys.
Load the private .ppk into Pageant.
Open PuTTY, enter your server's hostname, and connect. PuTTY will automatically use the key from Pageant — no passphrase prompt.

Using Pageant with Plink and Automation

When Pageant is running, Plink automatically consults it for key material, enabling fully automated SSH commands without embedding passwords in scripts:

# Run a command on the remote server — Pageant provides the key
plink -ssh user@example.com "df -h"

# Execute a script file on the remote server
plink -ssh user@example.com -m commands.txt

Security Considerations

Warning: When a key is loaded into Pageant, any process running under your Windows user account can request it for authentication. On shared or compromised workstations, Pageant can be abused by malware. Use the -encrypted flag for deferred decryption, and unload keys from Pageant when not actively needed.

Viewing and Managing Loaded Keys

Right-click the Pageant tray icon and select View Keys.
The key list shows all currently loaded keys with their fingerprints.
Select a key and click Remove Key to unload it from memory.