F.1 Public keys

We maintain multiple keys, stored with different levels of security due to being used in different ways. See section F.2 below for details.

The keys we provide are:

Snapshot Key

Used to sign routine development builds of PuTTY: nightly snapshots, pre-releases, and sometimes also custom diagnostic builds we send to particular users.

Release Key

Used to sign manually released versions of PuTTY.

Secure Contact Key

An encryption-capable key suitable for people to send confidential messages to the PuTTY team, e.g. reports of vulnerabilities.

Master Key

Used to tie all the above keys into the GPG web of trust. The Master Key signs all the other keys, and other GPG users have signed it in turn.

The current issue of those keys are available for download from the PuTTY website, and are also available on PGP keyservers using the key IDs listed below.

Master Key (2026)

RSA, 4096-bit. Key ID: D732471F094D5FB5. Fingerprint: 371C 662B 855F 318F F63A D091 D732 471F 094D 5FB5

Release Key (2026)

RSA, 3072-bit. Key ID: 5C67D0F88BC3E5B5. Fingerprint: 1A07 DAC0 F220 CF12 248E A719 5C67 D0F8 8BC3 E5B5

Snapshot Key (2026)

RSA, 3072-bit. Key ID: 5ED187171D16C213. Fingerprint: 1C8A 48EB BD3E 4B93 568F CDCA 5ED1 8717 1D16 C213

Secure Contact Key (2026)

RSA, 3072-bit. Key ID: 6DDCD4F58649AAED. Fingerprint: 7E79 8549 9503 2120 8BD0 7B7E 6DDC D4F5 8649 AAED