PuTTY distribution, verification and version tracking covers the practical side of managing PuTTY as a software asset. PuTTY costs nothing, and its licence permits copying by anyone.[3] As a result, many unofficial copies, landing pages and look-alike store listings exist. The developers publish guidance on which sources are theirs and how to verify files.[1] Because there is no licence entitlement to manage, provenance and version currency are the main SAM controls for PuTTY.
Official sources
| Source | Status according to the developers | Catalog row |
|---|---|---|
| www.chiark.greenend.org.uk/~sgtatham/putty/ | The real PuTTY web site since the start of the project[1] | Official distribution channels |
| putty.software | Registered by the developers in August 2025 as an official landing page, with a plan to move the main site there later[1][7] | same |
| the.earth.li | Legitimate host for release files, separate from the web pages for bandwidth reasons[1] | same |
| Microsoft Store “PuTTY” app | Free listing published and maintained by the developers, first published at 0.76, usually updated within days of a release[1][3] | same |
| Other store listings named PuTTY | Uploaded by other people, some charging money; no guarantee from the developers[1] | same |
| putty.org | Not the developers’ site and never has been[1] | same |
The FAQ adds that every release embeds the real web site’s URL in its About box. A signed copy therefore confirms which site the developers endorse.[1]
Verification
The developers create GPG signatures for all files distributed from their web site. They use separate keys: a Release key for manually made releases, a Snapshot key for automated nightly builds, a Secure Contact key for confidential messages, and a Master key that signs the others.[2] The keys differ in how securely they are held. The Snapshot key is stored without a passphrase, while the Release key is kept encrypted.[2] Since release 0.67, Windows executables and the installer also carry Authenticode signatures, which Windows checks itself.[2] Each build type (release, snapshot, pre-release) has its own checksum files. Installer-version executables differ from the standalone ones because they use a separate help file.[1] Catalog row: Releases are GPG-signed and Windows binaries Authenticode-signed.
Packages
The latest release page offers three kinds of Windows download for 64-bit x86, 64-bit Arm and 32-bit x86: MSI installers, standalone executables for each tool, and a putty.zip archive. The installers include every utility except PuTTYtel and pterm, and a Unix source archive is also offered.[3] The Unix version is distributed as source code, and some Linux distributions ship their own builds.[1]
Discovery and normalisation
Commentary on the 0.85 build files: the MSI installer and the Windows version resource give the strings an inventory tool records.
| Attribute | Value in release 0.85 |
|---|---|
| MSI Manufacturer | “Simon Tatham”[6] |
| MSI product name | Version string plus platform suffix, for example “PuTTY 0.85 (64-bit)“[6] |
| Install scope and folder | Per-machine, “PuTTY” folder under Program Files[6] |
| Upgrade behaviour | Fixed UpgradeCode per platform; any installer may be installed over another, including downgrades[6] |
| Executable version resource | CompanyName “Simon Tatham”; ProductName “PuTTY suite”[6] |
| Per-user settings | Registry key HKEY_CURRENT_USER\Software\SimonTatham\PuTTY; ~/.putty on Unix[1] |
Release 0.78 installed per user by default as a security workaround, and 0.79 went back to per-machine. Installing 0.79 or later therefore does not remove a per-user 0.78, and both can end up installed.[4] Standalone executables run without installation. They appear only in file-level scans, not in installed-programs data. Uninstalling does not remove the registry settings; the FAQ points to putty -cleanup for that.[1] Products that embed PuTTY code, such as WinSCP and FileZilla, and forks such as KiTTY, are separate products and should be normalised to their own publishers.[8] Catalog row: Windows installer identity.
Releases and security fixes
The developers publish no support period, maintenance branch or end-of-life date. Fixes ship in new releases, and the change log records them.[4] Recent releases:
| Release | Date | Security-relevant changes (change log) |
|---|---|---|
| 0.85 | 2026-08-16 | Use-after-free in Pageant; buffer overflow with OpenSSH encrypt-then-MAC modes; buffer overflow in private key decryption; denial-of-service fixes[4] |
| 0.84 | 2026-05-22 | Double-free in RSA key exchange; crash in NIST ECDSA verification; proxy prompt spoofing fix[4] |
| 0.83 | 2025-02-08 | ML-KEM post-quantum key exchange added; bug fixes[4] |
| 0.81 | 2024-04-15 | CVE-2024-31497: biased NIST P-521 signature nonces compromised private keys[4] |
| 0.80 | 2023-12-18 | Support for OpenSSH’s kex-strict modification, addressing a vulnerability in some cipher and MAC modes[4] |
For CVE-2024-31497, the vulnerability record states that information about existing P-521 private keys had already leaked whenever a signature was made with the old nonce generator.[5] Finding a version earlier than 0.81 therefore calls for reviewing the keys used with it, as well as upgrading. Catalog rows: Only the latest release is current, Releases before 0.81 compromise NIST P-521 keys.
Standard Windows builds aim to run on all Windows versions still in security support. Older versions are supported only when that is easy.[1]
Out of scope
This page does not cover third-party mirrors, package-manager repositories, Linux distribution builds or their update cadence, or security advisories issued by parties other than the PuTTY developers.