Check who signed a Windows program
Drop an .exe, .dll or .sys. See whether it is signed, by whom, whether it has changed since, and whether the timestamp holds up. It works on a Mac or Linux, and nothing is uploaded.
The program
Drop a Windows .exe, .dll or .sys file here, or choose it. It is read in this tab and never uploaded.
What the signature says
What a signed program is
Windows programs are signed with Authenticode: the publisher hashes the file, signs the hash with the key in their code-signing certificate, and stores the signature at the end of the .exe, .dll or .sys. Windows reads it to show the publisher's name in the prompt before a program runs, and in the Digital Signatures tab of the file's properties. On a Mac, on Linux or on a Chromebook there is no such tab, and the usual advice is to upload the file to a scanning site.
What is checked
- That the program has not changed. The file is hashed the way Windows hashes it, leaving out only the checksum and the signature itself, and compared with the hash the signature records. One changed byte anywhere in the program shows.
- That the publisher signed it. The signature is checked against the publisher's certificate with your browser's own cryptography, and the certificate has to be one issued for signing code.
- When it was signed. A timestamp from a timestamping service proves the file was signed while the certificate was valid, which is why a signature can outlive the certificate. Both kinds are checked: the RFC 3161 timestamps STAMP reads, and the older countersignatures.
- Every signature on it. Many publishers sign twice, with SHA-1 for old Windows and SHA-256 for new; the second signature is nested inside the first and is checked the same way.
- Things added afterwards. Data appended after the signature, or hidden inside the signature block, is outside what the signature covers, and is named.
What it does not do
It does not decide whether Windows trusts the publisher's certificate authority, which depends on the roots installed on the machine; it names the root instead. It does not check whether the certificate has been revoked, which would mean asking the certificate authority over the network. It does not run or scan the program: a validly signed program can still be harmful, and the signature only tells you who is responsible for it. It reads .exe, .dll and .sys files; Windows Installer (.msi) and .cab files are signed differently and are not read yet.