Bitwarden SSH Agent in WSL2
I use Bitwarden to manage my SSH keys. On Windows 11, the Bitwarden Desktop app can act as an SSH agent, which is great. The problem is that WSL2 runs in its own lightweight VM and doesn’t have direct access to the Windows SSH agent.
The solution is to bridge the Windows named pipe to a Unix socket inside WSL2 using npiperelay and socat.
Install npiperelay on Windows
Download npiperelay.exe from the npiperelay releases page.
Place the binary somewhere accessible from WSL2, for example /mnt/c/Users/Kevin/.local/bin/npiperelay.exe.
Install socat in WSL2
sudo apt install socat
Configure your shell
Add the following to your ~/.bashrc (or ~/.zshrc) inside WSL2:
export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
ss -a | grep -q "$SSH_AUTH_SOCK"
if [ $? -ne 0 ]; then
rm -f "$SSH_AUTH_SOCK"
(setsid socat UNIX-LISTEN:"$SSH_AUTH_SOCK",fork EXEC:"/mnt/c/Users/Kevin/.local/bin/npiperelay.exe -ei -s //./pipe/openssh-ssh-agent",nofork &) >/dev/null 2>&1
fi
This sets SSH_AUTH_SOCK to a Unix socket, checks if socat is already listening, and if not, starts it to relay between the Unix socket and the Windows named pipe that Bitwarden exposes.
Make sure to adjust the path to npiperelay.exe to match where you placed it.
Enable the SSH agent in Bitwarden
In Bitwarden Desktop, go to Settings and enable the SSH agent feature. It registers itself on the standard Windows OpenSSH pipe (\\.\pipe\openssh-ssh-agent).
Verify
Open a new WSL2 terminal and run:
ssh-add -l
You should see your keys from Bitwarden listed. From this point on, any SSH connection from WSL2 (git, rsync, ssh, etc.) will authenticate through Bitwarden.
Troubleshooting
If you get “agent refused operation”, Bitwarden likely needs you to approve the key usage in its UI. Make sure the desktop app is unlocked.
If the socket isn’t working at all, verify the pipe name. You can list SSH-related pipes in PowerShell:
Get-ChildItem \\.\pipe\ | Where-Object Name -like '*ssh*'
Also make sure ~/.ssh/ exists with the right permissions (chmod 700 ~/.ssh).
