How do I use the Windows SSH agent for a passphrase-protected key?
The SSH agent lets an authorised client use a loaded key without repeatedly asking for its passphrase. Configure the Windows agent service only if permitted by your device policy, then add the key in your own user context.
Instructions
1. Inspect the local agent service
Check its status before changing anything.
Get-Service ssh-agentThe service may exist but be stopped or disabled. This is a local Windows service, not the server’s sshd service.
2. Start an approved agent service
If the service is disabled, an elevated local administrator can permit manual startup. Organisations may manage this setting centrally.
Set-Service -Name ssh-agent -StartupType Manual
Start-Service ssh-agentThis changes the local service startup mode and starts it. Do not override managed policy.
3. Load and inspect your key
Return to a normal terminal under the Windows account that will use SSH. Enter the passphrase interactively.
ssh-add "$env:USERPROFILE\.ssh\server_ed25519"
ssh-add -l-l lists loaded public fingerprints. It does not print private keys.
Check the result
- The agent service is running under the approved configuration.
- The expected key fingerprint appears in ssh-add -l and the intended SSH login works.
Troubleshooting
- Could not open a connection to your authentication agent
- Check the Windows agent service and ensure you are using the intended OpenSSH installation.
- The key is loaded under another Windows user
- Use the correct user session; agent availability is not a reason to copy a private key into shared folders.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.