How to convert .ppk key with passphrase to OpenSSH key in batch?

Question

My question is related to that one How to convert .ppk key to OpenSSH key under Linux? But in the case when the .ppk can have an associated passphrase.

According to the man page of puttygen “there's currently no way to supply passphrases in batch mode, ...”

Is there a way to convert a .ppk with a passphrase to OpenSSH key in non-interactive mode?

Answer 1

The manual page you're reading is outdated. Options to supply old and new passphrases were added to PuTTYgen in 2016, in version 0.68.

  --old-passphrase file
        specify file containing old key passphrase
  --new-passphrase file
        specify file containing new key passphrase

Do not use linux.die.net in 2023. It's completely unmaintained now – sometimes the manual pages are a few years old, sometimes twenty years old. Use the manual page archives maintained by Linux distributions, e.g. https://man.archlinux.org/ or https://manpages.debian.org/ instead.

(Of course, the manual pages installed on your system would be the most up-to-date. There are graphical programs to read them, e.g. GNOME's yelp. It's also possible to render manual pages into HTML using man -Thtml puttygen > /tmp/foo.html if you find reading them in terminal inconvenient.)

---

Alternative: With anything that takes line-based input from stdin or tty, you can also use expect to feed input "interactively". That is, write an Expect script that runs puttygen in non-batch mode and waits for the appropriate prompt.

For example, if you were forced to use an old version of puttygen that didn't have the --old-passphrase option, something like this would be able to convert a single file (the script uses Tcl syntax with a few Expect-specific commands added):

#!/usr/bin/env expect
set infile [lindex $argv 0]
set passphrase [lindex $argv 1]
set outfile [string map {.ppk .key} $infile]
spawn puttygen <some options>
expect "Password:" { send $passphrase }
expect "some other prompt:" { send "something else" }