How to Open the OpenSSH Client in Windows 11 Settings

Check if OpenSSH Client is Already Installed

Before you install anything, check whether the OpenSSH client is already on your PC. On many PCs it is, and this check takes under a minute. If the client is present, the terminal prints usage instructions and a list of options. If it is missing, you get an error saying the command is not recognized.

1. Press the Win, type Terminal, and press Enter to open Windows Terminal. A prompt appears in a PowerShell tab.
2. Type ssh and press Enter.
3. Read the output. It is either a list of command-line switches and usage instructions, or an error stating the command is not recognized.

If the output shows usage instructions starting with usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy], the client is already installed and ready to use. Skip ahead to connecting to a server. If the terminal says ssh is not recognized as an internal or external command, continue with one of the two install methods below.

Install OpenSSH Client via Settings App

The Settings ⚙️ app is the graphical way to install the 💿 OpenSSH client. The path is Settings › System › Optional features, and no command line is involved. You need administrator rights on the PC. On a standard account, Windows asks for approval or an admin password.

1. Open Settings ⚙️ by pressing Win+I. The Settings ⚙️ window opens.

2. Click System in the left sidebar.
3. Scroll down the main pane and click Optional features. A list of the features already installed appears.

4. Click the View features button next to Add an optional feature. A flyout window opens with a list of available features.
5. Type OpenSSH Client into the search 🔍 box in the flyout. The list narrows to matching results.

6. Check the box next to OpenSSH Client in the search 🔍 results.
7. Click Next, then click Install.
8. Wait for the progress bar to finish. This means Windows has downloaded and registered the files. You can close Settings while it runs, because progress also shows on the Optional features page.

Once the install finishes, OpenSSH Client appears in your list of installed features. A restart is not normally needed. If you opened a terminal before the install, close it and open a new one so it picks up the change.

To undo the install, go back to Optional features, find OpenSSH Client in the installed list, and remove it.

If the search 🔍 finds nothing or the install fails, make sure the PC is online and Windows Update 🔃 is working. Windows downloads the optional feature files from Microsoft. The troubleshooting section below covers repair steps.

Install OpenSSH Client via PowerShell

You can also install the 💿 OpenSSH client from an administrative terminal. This is faster than clicking through Settings, and it suits setting up several PCs or running the steps from a script. It needs the same administrator rights as the Settings ⚙️ method.

1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
2. Click Yes if the User Account Control prompt asks for permission to make changes to your device. The terminal opens with administrator rights.
3. Type the following command and press Enter:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

4. Wait for the command to finish. The output should show the deployment state as Installed and the restart requirement as False.

If the command fails, the usual causes are a terminal that is not running as administrator, no internet connection, or a damaged Windows Update 🔃 component. For the last one, see the troubleshooting section below.

Open and Use the OpenSSH Client

Once the client is installed, run it from Windows Terminal, PowerShell, or Command Prompt. Type the ssh command, followed by your username and the address of the remote server. There is no separate app to launch.

1. Open Windows Terminal, PowerShell, or Command Prompt. A normal (non-admin) window is fine.
2. Connect to a remote server by typing the ssh command followed by your username and the server’s IP address or domain name:

ssh username@192.0.2.10

3. On your first connection to a server, SSH shows the server’s fingerprint and asks whether you trust it. A fingerprint is a short identifier that proves which server you reached. Type yes to add the remote host to your known hosts file. SSH does not ask again for that server unless its fingerprint changes.
4. Enter your remote password or your SSH key passphrase when prompted. The characters do not show as you type, and that is normal. After you log in, the prompt changes to the remote machine’s shell.

If the connection times out or is refused, check the address and make sure the server is running an SSH service. Also confirm that no firewall is blocking the connection.

Configure OpenSSH Client Configuration File

If you connect to the same servers often, save their details in an SSH config file. The file is named config and lives in a folder inside your user profile. It stores server addresses, usernames, and private key paths, so you do not have to type a long command each time.

1. Open Notepad or your preferred text editor.
2. Create a new file and paste your connection rules using this format:

Host myserver
    HostName 192.0.2.10
    User USERNAME
    Port 22
    IdentityFile ~/.ssh/id_ed25519

3. Click File and select Save As.
4. In the address bar of the save dialog, type %USERPROFILE% to go to your user profile directory, then open the .ssh folder. If the folder does not exist, create it.
5. Name the file config. Notepad may add a .txt extension, which breaks the file. To prevent that, set Save as type to All files before you save. Then save the file.
6. Open your terminal and connect by typing:

ssh myserver

To confirm the file has no hidden .txt extension, turn on file name extensions in File Explorer 📁 under View and Show. If you see config.txt, rename the file and delete the .txt part. To undo this setup, delete the file or remove the entries you added.

Troubleshooting OpenSSH Installation Failures

If the OpenSSH client will not install, the cause is often damaged Windows system files or update components. The built-in DISM and System File Checker tools can repair these. Run both in an administrative terminal, one after the other.

1. Open Terminal (Admin) or PowerShell (Admin).
2. Run the Deployment Image Servicing and Management tool to repair the system image by typing:

DISM /Online /Cleanup-Image /RestoreHealth

This can take several minutes. It may seem stuck at a fixed percentage for a while, so let it finish.

3. Run the System File Checker to replace any missing or corrupted operating system files by typing:

sfc /scannow

4. Restart your computer when both scans finish. Then try the OpenSSH Client installation again through the Settings app or PowerShell.

If it still fails, check that Windows Update is not paused and that you have a working internet connection. Windows downloads the optional feature files when you install.

What to do next

After the client works, the next step is to use SSH keys instead of passwords. The ssh-keygen tool, which comes with the OpenSSH client, generates a key pair. You keep the private key on your PC and put the public key on the server. This is safer than typing a password each time.

To avoid typing your key passphrase on every connection, set up the OpenSSH Authentication Agent service. It keeps your loaded keys available across terminal sessions. It is usually disabled by default on Windows 11, so you must change its startup type before you can start it. You need administrator rights to do this.

1. Press the Windows Key, type Services, and press Enter. The Services app opens.
2. Find OpenSSH Authentication Agent in the list and double-click it. Its Properties window opens.
3. Set Startup type to Automatic or Manual, then click Apply.
4. Click Start to run the service now. To undo this, set Startup type back to Disabled.

This tutorial covers the client, which lets your PC connect out to other machines. The OpenSSH Server is a separate optional feature that lets other machines connect in to your PC. You add it the same way as the client: search for it under Settings › System › Optional features › View features

Use a strong, unique password for every account that can log in, or better, use SSH keys. Check the firewall rule before you expose the PC to the internet, because opening port 22 to the public invites constant automated login attempts.

After the server installs, open the Services app and find OpenSSH SSH Server. Set its Startup type to Automatic, click Apply, then click Start. Without this, the service does not run and does not come back after a restart.

The installer normally adds a Windows Defender Firewall rule that allows incoming connections on port 22. Open Windows Defender Firewall with Advanced Security and look under Inbound Rules to confirm it exists and applies only to the network profiles you want. If you do not need the server, leave it uninstalled.