Using the SSH agent
Let Windows' OpenSSH agent hold the key, so the app never reads a key file.
Before you start
- Windows 10 1809 or later, or Windows 11 — the OpenSSH client is part of both
An agent keeps private keys unlocked in memory and signs on behalf of any program that asks. The app never sees the key: it hands the server’s challenge to the agent and gets a signature back. That is also what makes a hardware-backed key work — the agent talks to the token, the app talks to the agent.
The agent used is Windows’ own, the OpenSSH Authentication Agent service, which listens on a named pipe fixed by OpenSSH for Windows. It is what ssh-add and the built-in ssh already use.
Starting it
The service is installed but usually disabled. In an elevated PowerShell, once:
Set-Service ssh-agent -StartupType Automatic
Start-Service ssh-agentThen, as yourself, add the key:
ssh-add C:Usersyou.sshid_ed25519A passphrase is asked for once, here, and never again while the agent runs. ssh-add -l lists what it holds.
Using it
On the SSH or File Transfer form choose SSH agent under Authenticate with. There is nothing else to fill in: the agent offers its keys and the device accepts the one it knows. A saved connection remembers the choice and reconnects in one click.
If the agent is not running, the app says so and names the two commands above rather than failing with a socket error.
Pageant
PuTTY’s agent speaks a different protocol — window messages, not a pipe — and is not consulted. Recent PuTTY releases can make Pageant answer on the OpenSSH agent pipe as well; with that enabled it works like any other agent. Otherwise, load the key into the Windows agent with ssh-add, or use the key file directly (see Using SSH keys).