PuTTY Private Key (PPK)

Detects the header line of a PuTTY private key file (.ppk), as produced by PuTTYgen. The header begins with 'PuTTY-User-Key-File-' followed by the format version (2 or 3) and the SSH key algorithm. A leaked .ppk grants SSH access to whatever hosts trust the corresponding public key. Header-only candidates are discovery-only; ordered PPK metadata and the first public-blob line support enforcement.

Type

regex

Engine

universal

Confidence

high

Confidence justification

High confidence: the 'PuTTY-User-Key-File-' prefix with a version digit and colon is a fixed, distinctive marker of a private key file and almost never appears outside of an actual .ppk file.

Jurisdictions

global

Regulations

GDPR, CCPA/CPRA

Frameworks

CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2

Data categories

credentials, security

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

PuTTY-User-Key-File-[23]:\s*(?:ssh-(?:rsa|dss|ed25519|ed448)|ecdsa-sha2-nistp\d{3})?

Corroborative evidence keywords

private key, PuTTY, ppk, PuTTYgen, ssh key, key file, passphrase

Proximity: 300 characters

Should match

• PuTTY-User-Key-File-3: — Low-tier probe - version marker without algorithm or PPK fields
• PuTTY-User-Key-File-2: ssh-rsa Encryption: none Comment: staging-bastion Public-Lines: 6 — Medium-tier probe - ordered PPK header metadata
• PuTTY-User-Key-File-3: ssh-rsa Encryption: none Comment: production-bastion Public-Lines: 6 AAAAB3NzaC1yc2EAAAADAQABAAABAQCaPO2QBzKYKwDik8qK5bw7VyHxKzg8V+Pw 3+QsewdCZi2ueNFTlIMOo0s2ZX/b1QLzu4lu08pMD1xioxlDQbNb1tOxNoLnGBz 1eLzKyraT6AMjuQhLCPHYJTq6Mv9e8GBQ0yljRZuUt04pXObu8jeQB7Hq+h3gqX srlEFxc4CIxjzj+WNWhG1XsOLztFPW71Y8lI3EbWp1ERsALFXSqS3Wp67KJUQqs pdXP+tNkgyd3Ch48Xu64zI0zP/t7LB9Qmty1eU2S/iPC/l2bvvlwQwXDsjjTp5 JzVjtxGNyYY6gWwud1A557OgC3bk++TtOdoBsdfYf9yZOLmi7ZQGXTzRAgMBAAE Private-Lines: 14 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Private-MAC: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef — High-tier probe - long PPK public body with private fields beyond proximity

Should not match

• PuTTY-User-Key-File-1: ssh-rsa — Version 1 is not a real PPK format version
• -----BEGIN OPENSSH PRIVATE KEY----- — OpenSSH private key, not a PuTTY .ppk file
• convert the OpenSSH key to a PuTTY user key file before connecting — Prose mention of a PuTTY key file without the actual header
• PuTTY-User-Key-File-3: ssh-ed25519 Encryption: none Comment: empty-export Public-Lines: 0 Private-Lines: 0 — Adversarial zero-line PPK declarations are not populated metadata
• PuTTY-User-Key-File-3: ssh-ed25519 Encryption: none Comment: placeholder Public-Lines: 1 PLACEHOLDER Private-Lines: 1 PLACEHOLDER Private-MAC: REDACTED — Placeholder PPK body and MAC must not enforce
• Documentation example: PuTTY-User-Key-File-3: ssh-ed25519 Encryption: none Comment: docs-only Public-Lines: 1 AAAAC3NzaC1lZDI1NTE5AAAAIMockPublicKeyMaterialForDocumentationOnly Private-Lines: 1 AAAAC3NzaC1lZDI1NTE5AAAAIMockPrivateKeyMaterial Private-MAC: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef — Documentation quoting a populated PPK must not enforce

Known false positives

• Documentation or tutorials that quote the PPK header line without real key material. Mitigation: Require corroborative keywords and confirm the Public-Lines / Private-Lines base64 body follows.

References

• PuTTY documentation - PPK file format (Appendix C)

Collections

• Cloud Credentials & API Keys