64-bit
wixmachine scopethe.earth.li · publisher-owned- File name
- putty-64bit-0.84-installer.msi
- SHA-256
- 190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b
- Product code
- {FEE89B49-1A47-476C-864C-1D5076FC2891}
by Simon Tatham · MIT
A free implementation of SSH and Telnet for Windows and Unix platforms, along with an xterm terminal emulator.
These URLs are the ones Simon Tatham declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Simon Tatham published. Delete it.
Windows · PowerShell
Get-FileHash "putty-64bit-0.84-installer.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "putty-64bit-0.84-installer.msi"Expected output
190d00150e67ad3ff51af4b50e76a3ab97b863a34efd50472627b17c0cf4102b
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
64-bit · machine scope · MSI convention
msiexec /i "putty-64bit-0.84-installer.msi" /qn /norestart32-bit · machine scope · MSI convention
msiexec /i "putty-0.84-installer.msi" /qn /norestartARM64 · machine scope · MSI convention
msiexec /i "putty-arm64-0.84-installer.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 64-bit
{FEE89B49-1A47-476C-864C-1D5076FC2891}
Uninstall, with the usual prompts
msiexec /x {FEE89B49-1A47-476C-864C-1D5076FC2891}Silent, for deployment
msiexec /x {FEE89B49-1A47-476C-864C-1D5076FC2891} /qn /norestartProduct code · 32-bit
{A2D92841-A1FE-436A-8D2C-28EF20ABFCB5}
Uninstall, with the usual prompts
msiexec /x {A2D92841-A1FE-436A-8D2C-28EF20ABFCB5}Silent, for deployment
msiexec /x {A2D92841-A1FE-436A-8D2C-28EF20ABFCB5} /qn /norestartProduct code · ARM64
{0C3B44EB-8294-4C83-96E5-237BBBE8925C}
Uninstall, with the usual prompts
msiexec /x {0C3B44EB-8294-4C83-96E5-237BBBE8925C}Silent, for deployment
msiexec /x {0C3B44EB-8294-4C83-96E5-237BBBE8925C} /qn /norestartThe codes above belong to PuTTY 0.84.0.0, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "PuTTY*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 6 of 6 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 6 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 6 of 6 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 3 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MITA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions PuTTY registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from earth.li, which is a domain we have tied to Simon Tatham.
Every one of the 6 installers on this page comes with the SHA-256 Simon Tatham declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id PuTTY.PuTTY --exactUpgrade later
winget upgrade --id PuTTY.PuTTYWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of PuTTY, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
D816FBA5750E95AE5F845AD22BD165E19EBEFBBF298F453ABC1DB2EF7655E4B8
AA8E5036D973688F1E8622FBE9AB22E037346E0DEF0197BF5E7CDF37DA4E223D
591EF6BD9B200772875D152200B321366129B746F163666742FA5E201479BB53
6CEEF1975C85394E6A5D1B5D87277B7BF04489E679D36E80F5378489D0790D9E
A333EE14B4008B5B1136AE254A9C1C4A082BEFB248A294D0572AF0CC8765D916
A6D44B94921B1D4515083054131ACEB460FA399F5116127CC8BEEF11A65EE6FB
DEA085CA2D7CC04D437AFD72B235AA1BFACAF495FB07F5733C7BC51DD8BBA34A
6C297C89D32D7FB5C6D10B1DA2612C9557A5126715C4A78690D5D8067488F5F2
3FF814CCD5F7B0C268897483E0CBCA9EEB42FF90F57C59AEBA10DD1CA0D862DC
1407101E95BBA5343A20F9BF9324D4D5410567723B255F6E06396A0B5FC655A0
858399EE9EE49E15A78C7018DBF0DD73DBA8337D6F0ADB841896BA553C9A646C
8DC2EC6A64DE328178752CB1EEBF475565ED8E6EA69512ECFAC87784EDAFBBD5
B7AF314AD1342D476E3E661EBC1EEC1C83E8DEEB3AB4A8009DFCA47C7DA09AA9
BEEC23B8EAD065F868E9CDA021265998697E797064234A87C888BE96E2C70060
9827217A9E9BB50235443A6900C4F6297D98D1CC7764066EF10F503C8B9F52C6
E64775374097F1B1C8FD4173F7D5BE4305B88CEC26A56D003113AFF2837AE08E
8B1EE5FCD40AC4122A62E405981DC6DFB26FB7BDBE23217DE0AA4B9659C492D5
870099F68A40FAE62A30B1962C25BE7B27A87ADB4B7B25F2DC666C6FB6FB100D
8ECE5F9D805FCF1D790F5E148D2A248DEA4813024659EB6C6468B47004BC805F
96A49EC17E2DE11E54BC93B7875F329FBFC1C5093E0FD9388D9CF69AD0FD78A3
A6C928FFCB481BCC8D7C59EAC43964BB0B2994CDF1898492667FA1E71EB259FD
129DF585291D28EC179BC715A3F8EC34C5ED5D66FD051A6A4B9DC9C537CB3AEE
381A5390E362528DC1028DAD04C849EF640D4B53A31E801874467DC716A43864
72F6164B1685CF4FFF98ACCDE23DC1A4E08D5F65888711D8128265D0EFEB7428
6E4D8550C75ABBB110BD3CD2F25B22D030A27A377A31B48CD619B623E61CCC8C
72462543B8C9E44F6CCC42639CE49D413B835089C2F3BDDFF9C1356449BE79A0
77AE2C25D70D42F07064B764EB085492E52CE363C1B29C1C151A018CF82652F4
2A001DD1C5D81AE1C17DB97B0BB6C2C7CADA43888D4F30A814C18D55AA28FEB6
A630B507D726D7B378F1D82108B99FE7A0CC8713F7182957325AD07CF288228C
4B2B3DA68751C2E8EA4D8EC3829DD66299F5398CF5A93FF7727219A43D1751E6
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every PuTTY version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Simon Tatham and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to PuTTY — just other entries, each with its own official URL and published hash.