🚨 SSH Error: 'Load key: invalid format' — Cause, Fix, and Troubleshooting Guide

What this error means

The SSH client found your key file but could not parse it as a valid private key. The bytes are not in an OpenSSH-readable format — it is a PuTTY .ppk, a public key mistaken for the private one, a truncated paste, or a file with mangled line endings.

Load key "/home/deploy/.ssh/id_ed25519": invalid format
deploy@host: Permission denied (publickey).

Because the key never loads, authentication falls through to Permission denied (publickey) even though the key on the server side is correct.

How it manifests on the host

• ssh -i keyfile host prints Load key "...": invalid format then Permission denied (publickey).
• ssh-keygen -y -f keyfile fails to read the file.
• The key came from Windows/PuTTY, a copy-paste, or a CI secret variable.
• The matching .pub exists and looks fine, but the private file will not load.

System configuration causes

• PuTTY format. The file is a .ppk, which OpenSSH cannot read directly.
• Public key used as private. id_ed25519.pub was passed to -i instead of id_ed25519.
• CRLF / mangled whitespace. A Windows editor or clipboard added \r or reflowed the base64 body.
• Truncated paste. The -----BEGIN/END----- markers or body lines were dropped when copying.
• Corrupt secret in CI. A pipeline variable stripped newlines, collapsing the key to one line.

Interrogating the host

# Does the file parse as a private key at all?
ssh-keygen -y -f ~/.ssh/id_ed25519 2>&1 | head

# What is it really? (headers, type, CRLF)
head -1 ~/.ssh/id_ed25519
file ~/.ssh/id_ed25519
cat -A ~/.ssh/id_ed25519 | head -3     # ^M at line ends = CRLF corruption

# Verbose auth to confirm the load failure precedes the denial
ssh -v -i ~/.ssh/id_ed25519 host 2>&1 | grep -iE 'invalid format|Offering|Permission'

A first line of PuTTY-User-Key-File-2: means it is a .ppk; ssh: at the start of the .pub header means you pointed at the public key.

Remediation

1. Convert a PuTTY .ppk to OpenSSH format:

puttygen mykey.ppk -O private-openssh -o ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519

2. Point at the private key, not the .pub:

ssh -i ~/.ssh/id_ed25519 host      # NOT id_ed25519.pub

3. Strip CRLF and stray whitespace from a mangled key:

sed -i 's/\r$//' ~/.ssh/id_ed25519

4. Fix a CI secret by preserving newlines — store the key base64-encoded and decode at runtime:

printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519

5. If the key is genuinely corrupt and unrecoverable, generate a fresh pair and re-authorize it:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@host

Hardening the host

• Always chmod 600 a restored/converted private key, or sshd/ssh will reject it for loose permissions.
• Store keys in CI as base64 (or a proper secret file), never pasted inline where newlines get flattened.
• Keep private keys out of version control entirely; a leaked key means immediate rotation.
• .ppk and OpenSSH formats are not interchangeable — convert once and keep the OpenSSH copy for Linux tooling.

Related system errors

• SSH ‘Permission denied (publickey)’ Error Guide
• SSHD ‘bad ownership or modes for file’ Error Guide
• OpenSSL ‘unable to load Private Key’ Error Guide