Every release of PuTTY embeds a URL to the web site, via the ‘Visit web site’ button in the About box.
The real website is where PuTTY itself says it is.
If you download a cryptographically signed version of PuTTY – either a Windows binary signed with Simon Tatham's Authenticode key, or anything signed with the PuTTY team's GPG key – then you can confirm that the URL embedded in that copy is the one that the developers themselves endorse as the true web site.
As of August 2025, putty.software is a second web location owned by us, the PuTTY developers. That too is endorsed by signed copies of PuTTY, via being mentioned in this FAQ section of the help file.
If we move the web site later – as of August 2025, our plan is to move it from the chiark domain name to once the latter is generally recognised as legitimate – then we will keep a redirection of some kind at the old location, so that it continues to work. Both URLs will continue to be legitimate places to find PuTTY, whichever is currently preferred.