Using the SSH agent

Let Windows' OpenSSH agent hold the key, so the app never reads a key file.

Before you start

  • Windows 10 1809 or later, or Windows 11 — the OpenSSH client is part of both

An agent keeps private keys unlocked in memory and signs on behalf of any program that asks. The app never sees the key: it hands the server’s challenge to the agent and gets a signature back. That is also what makes a hardware-backed key work — the agent talks to the token, the app talks to the agent.

The agent used is Windows’ own, the OpenSSH Authentication Agent service, which listens on a named pipe fixed by OpenSSH for Windows. It is what ssh-add and the built-in ssh already use.

Starting it

The service is installed but usually disabled. In an elevated PowerShell, once:

Set-Service ssh-agent -StartupType Automatic
Start-Service ssh-agent

Then, as yourself, add the key:

ssh-add C:Usersyou.sshid_ed25519

A passphrase is asked for once, here, and never again while the agent runs. ssh-add -l lists what it holds.

Using it

On the SSH or File Transfer form choose SSH agent under Authenticate with. There is nothing else to fill in: the agent offers its keys and the device accepts the one it knows. A saved connection remembers the choice and reconnects in one click.

If the agent is not running, the app says so and names the two commands above rather than failing with a socket error.

Pageant

PuTTY’s agent speaks a different protocol — window messages, not a pipe — and is not consulted. Recent PuTTY releases can make Pageant answer on the OpenSSH agent pipe as well; with that enabled it works like any other agent. Otherwise, load the key into the Windows agent with ssh-add, or use the key file directly (see Using SSH keys).