PuTTY licensing is the set of terms under which the PuTTY suite is distributed. PuTTY is a free implementation of SSH and Telnet for Windows and Unix, with an xterm terminal emulator, written and maintained primarily by Simon Tatham.[13] The executables and source code are distributed under the MIT licence.[1] The licence grants any person, free of charge, the right to deal in the software without restriction. It names the rights to use, copy, modify, merge, publish, distribute, sublicense and sell copies. Its one condition is that the copyright notice and permission notice are included in all copies or substantial portions.[2] No licence metric, edition, subscription or paid support offering exists. For software asset management (SAM), then, PuTTY is not a question of entitlement. The questions are provenance, version currency, and keeping the notice when the software is redistributed.
Licence
The licence text is the same in three places: the LICENCE file of the source distribution, the About box, and Appendix D of the manual.[1][3] In release 0.85 it opens “PuTTY is copyright 1997-2026 Simon Tatham”. It then lists 24 individual contributors and the company CORE SDI S.A. as holders of copyright in portions of the code.[2] The copyright year range moves with each release, and the list of portions holders changes when contributors are added. The notice to keep is therefore the one shipped with the copy being redistributed.
| Aspect | What the PuTTY licence provides | Catalog row |
|---|---|---|
| Licence family | MIT licence, similar in effect to the BSD licence; OSI “Open Source certified”[1] | Licence identified as MIT (SPDX), OSI-approved |
| Use | Free of charge, without restriction, including commercial purposes[1] | Use free of charge for any purpose |
| Rights granted | Use, copy, modify, merge, publish, distribute, sublicense, sell[2] | Sublicensing and selling copies permitted |
| Condition | Copyright and permission notice in all copies or substantial portions[2] | Notice must be included in all copies |
| Warranty and liability | Provided “as is”; copyright holders not liable[2] | Provided as is, without warranty or liability |
| Copyleft | None; MIT is compatible with the GNU GPL[1] | No source-code offer or copyleft obligation |
Licence identifier. The Open Source Initiative lists the MIT License under the SPDX short identifier MIT.[10] PuTTY’s disclaimer reads “THE COPYRIGHT HOLDERS” where the OSI text reads “THE AUTHORS OR COPYRIGHT HOLDERS”. The SPDX licence template marks that phrase as replaceable text, so the PuTTY text still matches the identifier MIT. SPDX also records the licence as OSI-approved and FSF-libre.[11]
Versions of the licence. The MIT licence has no version numbers. OSI shows the version as “N/A”.[10] What changes between PuTTY releases is the copyright line, not the terms.[2]
Commercial and business use
Commercial use is unrestricted. The licence page states that anybody, including companies, can use PuTTY without restriction, even for commercial purposes, and owes nothing to the developers or anyone else.[1] The FAQ describes PuTTY as completely free software, not shareware.[4] No registration, activation or quantity limit applies. The catalog therefore records no licence quantity to count.
The developers are volunteers. They describe themselves as not being a company or any kind of legally recognised organisation.[4] The project is maintained by a small team based in Cambridge, England.[12] Several consequences follow for procurement:
- No signed agreements. The team will not sign an indemnity against security problems. It will not sign any document accepting legal or financial liability, and it is generally unwilling to enter into individual agreements with users.[4] Catalog row: Developers do not sign indemnities, warranties or individual agreements.
- No vendor questionnaires. The FAQ says the team does not respond in full to generic supplier questionnaires, because it is not a software vendor. It asks organisations to keep free software developers separate from paid vendors in their supplier lists.[4]
- Permanence. A version already obtained stays under the licence it was released with: the permission, once granted, “can’t just revoke it”. No assurance is given about the licence of future releases.[4] Catalog row: Licence for already obtained versions cannot be revoked.
- Export control and FIPS. The developers believe PuTTY falls under 5D002 on the US Commerce Control List, but say this should not be taken as definitive. They cannot provide FIPS certification.[4] The home page adds a legal warning: using PuTTY, PSCP, PSFTP and Plink is illegal in countries where encryption is outlawed.[13] Catalog row: No ECCN determination or FIPS certification.
Redistribution and modification
Redistribution needs no separate permission. The feedback page states that permission to put PuTTY on a cover disk, or in a collection of software on a CD or web site, “is already granted”.[5] The same page sums up the only things that are not allowed: removing the copyright notices or licence text, and holding the developers legally responsible.[5] Modified versions and code reuse in commercial products are allowed, as long as the notice and licence text stay in the derived product.[1] The licence does not require source code to be offered, and it does not impose its terms on derivative works. PuTTY code may be incorporated into a GPL program.[1] One component, the SSH CRC attack detector contributed by CORE SDI S.A., carries its own short permissive notice. That notice also requires the copyright line to be retained.[2] Details are in PuTTY redistribution and notice obligations.
Trademark
None of the retrieved PuTTY documents publishes a trademark policy or claims a registered trademark in the name “PuTTY”. The licence page and FAQ deal only with copyright and permission.[1][4] The FAQ does warn that putty.org has never been the developers’ site. It also says some Microsoft Store copies under the PuTTY name were uploaded by other people, some charging money.[4] A derivative sold or shipped under a PuTTY-like name is therefore licensed by its own publisher. The developers list such projects on their links page with no recommendation implied.[9]
Paid offerings and support
PuTTY has no paid edition, subscription, support contract or enterprise version. The FAQ states that the team does not provide any paid support.[4] Organisations that distribute PuTTY internally are recommended, but not required, to offer their own first-line technical support.[5] Donations are accepted but explicitly not expected.[4] Catalog row: No paid support. The catalog holds no PuTTY metrics, SKUs or programs, because the project sells nothing.
Components of the suite
The Windows download page lists these tools, all under the same licence:[7]
| Tool | Function (developer description) |
|---|---|
| PuTTY (putty.exe) | The SSH and Telnet client itself |
| PSCP (pscp.exe) | An SCP client, i.e. command-line secure file copy |
| PSFTP (psftp.exe) | An SFTP client |
| PuTTYtel (puttytel.exe) | A Telnet-only client |
| Plink (plink.exe) | A command-line interface to the PuTTY back ends |
| Pageant (pageant.exe) | An SSH authentication agent for PuTTY, PSCP, PSFTP and Plink |
| PuTTYgen (puttygen.exe) | A key generation utility |
| pterm (pterm.exe) | A PuTTY-style wrapper for Windows command prompts |
Release versions run on Windows (x86 and Arm) and Unix. The Unix version is distributed as source code, and the developers state that they have no release-quality ports to other systems.[4] The FAQ also states that PuTTY is almost completely composed of code written from scratch. As far as the developers know, it had no code in common with OpenSSH as of 2026.[4]
SAM practice
This section is commentary on the cited documents.
Internal use. Installing and running PuTTY inside an organisation creates no licence position to reconcile. The licence is free of charge and not limited by users, devices or installations.[2] The Windows installer puts the LICENCE file next to the executables, so an unmodified installation keeps the notice without extra work.[2]
Redistribution. The obligation starts when PuTTY, or PuTTY code, leaves the organisation or is repackaged: in an appliance, a product installer, a customer-facing toolkit, or a modified build. The copyright and permission notice must go with it.[2] An open-source register would record the SPDX identifier MIT, the copyright line of the version shipped, and the retained CORE SDI notice where source is shipped.[11]
Discovery and normalisation. The MSI installer registers its Manufacturer as “Simon Tatham” and names the product with the version plus a platform suffix. The executables’ version resource reads “PuTTY suite”.[2] Standalone executables need no installation, so file-level scanning finds copies that installed-programs data misses. Forks such as KiTTY and ExtraPuTTY, and tools that embed PuTTY code such as WinSCP and FileZilla, are separate products from separate publishers.[9]
Version and EOL tracking. The developers publish no support lifecycle. The current release is 0.85, released 2026-08-16.[7] Security fixes ship in new releases. For example, 0.81 fixed CVE-2024-31497, a flaw that compromised NIST P-521 private keys.[8] The practical baseline is the latest release, taken from an official source and checked against the developers’ GPG or Authenticode signatures.[6] See PuTTY distribution, verification and version tracking.
Out of scope
This page does not cover the licences of third-party forks and derived products, the licences of SSH servers PuTTY connects to, Linux distribution packages of PuTTY, or export-control classification beyond the developers’ own statement. The Free Software Foundation’s licence list could not be retrieved for this revision. Its classification of the MIT licence is cited here only as the FSF-libre flag in the SPDX record.[11]