Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.

If you needed to download Putty for a high security Windows installation, where would you get the Binaries from? Would you compile from source?

share|improve this question
Whats wrong with – Rell3oT Nov 15 '12 at 17:25
@Rell3oT: doesn't look like an official site at all - it is run by Bitvise, who sell a rival SSH client. Seems like domain squatting to me... – bobince Nov 16 '12 at 10:48
@bobince - You are 100% right that is exactly what is happening. Of course it also links to the official site. – Ramhound Nov 16 '12 at 14:00
@Rell3oT hmm... my putty-link in "Putty - About" links to – Bonsi Scott Nov 16 '12 at 22:36
1 is the official page of the creator of putty, last updated in September. He provides check-sums and source code for you to compile against as well as a link to git if you'd rather pull and compile over a secure connection – Robert Mennell Oct 22 at 3:01

5 Answers 5

up vote 15 down vote accepted

The official site is, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download.

In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one trusted signer). Unless you review the source code (including all needed libraries) there is no point in spending the added effort of compiling it yourself since both parts, the source code and the binaries, are signed with the same key.

The only advantage you gain by compiling it yourself is the opportunity to review the code so as to mitigate the risk that the authors of PuTTY could have add some backdoors or malware to it. But again, you would have to thoroughly review the code and all needed libraries to actually gain that benefit.

share|improve this answer
Relevant:… Note that file hashing in these cases is not generally intended to provide any security benefit - it's to ensure the integrity of the transmission. Unless the site displaying the hash is transferred over an authenticated connection, it's possible for a hacker to compromise the site and replace both file & hash with their own malicious copy. At that point, hash validation is useless for security. – Iszi Nov 15 '12 at 20:55
Yeah, it's a shame Tatham doesn't have an HTTPS server... man-in-the-middling chiark would seem to be a likely-fruitful attack. – bobince Nov 16 '12 at 10:51
You could also run a vm and use that as a terminal. – munchkin May 20 at 17:59

I believe this is the official source of PuTTY. It is the source that I have always seen recommended. And to my knowledge there is no reason to not just run the executable binary files found here.

share|improve this answer

Download same version from top-10 results for "putty homepage" returned by your favorite search engine, and compare them. If they are not all completely the same, abort the installation. Otherwise, install it (from any of downloaded bitwise-identical copies, of course).

If you need more security, interpolate results from different search engines and increase the number of downloads.

Simple, effective, and usually works quite well for such low amount of effort.

To be more sure, download source, have several top-notch security experts, cryptographers and programmers audit it all (including all libraries as well as compilers), and pay the cost -- and probably still be hit by next heartbleed bug.

share|improve this answer

It's nearly impossible to verify that you get a clean copy of putty. As described in this neat article (not written by me)

tldr of the article is: Putty binaries, signatures and download sites cannot be trusted because they do not even use SSL/Https. Would be very easy for a man in the middle attack to be able to modify the signatures and the binaries, and give you an evil version of putty.exe and a signature/checksum that corresponds to the intercepted executable.

share|improve this answer
Except: which is the official download source .... It uses TLS and the files that the author couldn't download, downloaded fine for me. – schroeder Oct 22 at 3:06

If you are ever in doubt about any download and are not set up to verify the download and test the install, a reasonably safe alternative is to get the program from CNET. The site says it has been scanned to ensure it is virus and spyware free. Putty is available at

share|improve this answer
CNET got a lot of bad press a while back for bundling toolbars, spyware and other junk with legitimate programs like nmap. – Polynomial Nov 15 '12 at 20:49
CNET is one of our biggest offenders for drive-by downloads that our AV has to clean up. -1 – oBreak May 20 at 17:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.