I use Bitwarden to manage my SSH keys. The Bitwarden Desktop app on Windows 11 works fine as an SSH agent, but WSL2 runs in its own lightweight virtual machine without direct access to the Windows SSH agent. The fix: forward Windows named pipes to a Unix socket in WSL2, using npiperelay and socat.

Installation#

Install npiperelay on Windows

Download npiperelay.exe from the releases page and put it somewhere accessible, e.g. /mnt/c/Users/Kevin/.local/bin/npiperelay.exe.

Install socat in WSL2

sh 
sudo apt install socat

Configure your shell

Add this to ~/.bashrc or ~/.zshrc:

sh 
export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"

ss -a | grep -q "$SSH_AUTH_SOCK"
if [ $? -ne 0 ]; then
    rm -f "$SSH_AUTH_SOCK"
    (setsid socat UNIX-LISTEN:"$SSH_AUTH_SOCK",fork EXEC:"/mnt/c/Users/Kevin/.local/bin/npiperelay.exe -ei -s //./pipe/openssh-ssh-agent",nofork &) >/dev/null 2>&1
fi

This sets up the SSH socket, checks whether socat is already listening, and starts the relay between the Unix socket and the Windows named pipe if needed.

Enable the SSH agent in Bitwarden

In Bitwarden Desktop, under Settings, enable the SSH agent option.

Verifying it works#

sh 
ssh-add -l

in a new WSL2 terminal — you should now see the keys from Bitwarden.

Troubleshooting#

  • An “Agent refused operation” error usually means Bitwarden is asking for approval to use the key via its own UI.
  • Check the pipe name via PowerShell:
powershell 
Get-ChildItem \\.\pipe\ | Where-Object Name -like '*ssh*'
  • Make sure ~/.ssh/ exists with the right permissions:
sh 
chmod 700 ~/.ssh

Source#

Using Bitwarden’s SSH Agent in WSL2