PuTTY says my key format is "too new" — what does that mean and how do I fix it?

There are two separate format questions tangled together here and separating them makes it simple.

Format one: OpenSSH versus PuTTY. The client uses its own private key format rather than the OpenSSH one. That is why your original key is rejected, and converting it with the key generator is the correct step.

Format two: which version of the PuTTY format. The key file format itself has been revised, and a newer generator produces a newer version. An older client — or another tool that reads these files, such as some file transfer clients and deployment tools — only understands the older one. That is the "too new" message: the file is valid and the reader is older than the format.

The fix is to save the key in the older version. In the key generator there is a parameter setting for the file format version; set it to the earlier version, load your key and save the private key again. You now have a file the older client accepts.

The other fix, and usually the better one: update the client.

The format changed because the newer version has real improvements in how the key is protected at rest. Downgrading the file to satisfy an old client works and it gives up those improvements.

If the thing reading the key is a tool you cannot update — a build server, an appliance, an old deployment script — then downgrading the file is the pragmatic answer and it is fine. If it is simply an old copy of the client on your own machine, update it and the problem disappears permanently rather than needing to be handled again on the next key.

Worth checking every tool that will read the key before deciding, because it is easy to fix the client and then discover the file transfer program has the same complaint.

A third route that avoids the whole question if you are on a recent Windows: use the built-in OpenSSH client instead.

Windows has shipped an OpenSSH client for some years now, usable from the command prompt or terminal exactly as on Linux. It reads OpenSSH-format keys directly, so no conversion is involved and neither format problem arises.

That does not help if you specifically need the graphical client or the tools built around it, and for anyone whose only reason for using it was that it was the way to get ssh on Windows, the reason has expired.

One practical note on the conversion, since people frequently lose a key here: the generator can convert in both directions.

Load a PuTTY-format key and there is an export option that writes an OpenSSH-format file. So if you converted your only copy into the wrong format, nothing is lost.

Worth keeping both formats of any key you use across mixed environments, in the same secure place. It takes a minute and saves this exact hour.