See inside a Windows .exe file
Parsed in this tab · Nothing uploaded · Nothing executed
Drop a Windows executable below and this page reads its headers and tells you what it is: which processor it was built for, which system libraries it asks for, what it says about its own publisher and version, the icon buried inside it, whether it is signed, and whether it has been compressed to hide its contents. The file never leaves your machine — it is read by JavaScript, here, and the page has nowhere to send it.
Drop an .exe here, or
Also reads .dll, .sys, .ocx and .scr. Up to 256 MB.
What the report tells you
Every Windows executable carries a surprising amount of writing about itself, and almost none of it is visible from the desktop. The report is ordered so the most useful parts come first.
The processor and the subsystem
The first honest answer about any .exe. A 64-bit binary will not start on 32-bit Windows; a 32-bit one runs almost anywhere. The subsystem says whether it opens a window, a console, or nothing at all because it is a driver meant to load into the kernel.
The libraries it loads
The import table is the most revealing section of the file. A program has to name, in plain text, every system library and function it intends to call — so a program that talks to the internet must say ws2_32.dll, one that touches the registry must say RegOpenKeyExA, and one that starts other programs must say CreateProcessW. This is declared before a single instruction runs, and it cannot be omitted without giving up the ability to call those functions at all.
What it claims to be
The version resource holds the publisher, product name, file version, copyright line and original filename — the same strings Windows shows in a file's Properties dialog. They are simply text that whoever built the file typed in, so they are useful for identification and worth nothing as proof.
The icon
Pulled out of the resource tree and drawn on the page. It is the fastest way to confirm that a download is the program you think it is, and the fastest way to notice that something is wearing a familiar icon it has no right to.
Packing and entropy
Packers compress an executable and unpack it in memory at startup. That is a legitimate way to make a download smaller and an equally effective way to hide what a program imports until it is already running. The report names the packer when it recognises the signature, and falls back to measuring how random each section looks.
What is stuck on the end
Installers are usually an ordinary small program with an entire archive appended after the last section. When the report says most of the file sits past the end of the executable part, you are looking at a wrapper rather than the program — and the files inside can often be extracted without installing anything.
What it cannot tell you
It cannot tell you whether a file is safe. Nothing that only reads a file can, and a page that implied otherwise would be worse than useless, because it would be reassuring.
Everything here is what the program declares about itself. A program that wants to be studied declares a great deal; a program that does not simply declares less, and a packed one declares almost nothing until it is already running. So a long list of capabilities is not evidence of bad behaviour — every updater talks to the network and every installer writes files — and a short list is not evidence of good behaviour either.
What inspection is genuinely good for is the ordinary questions: is this the right architecture for my machine, is it an installer or the actual program, does it claim a publisher, is it signed, is it complete, and is it hiding its contents. Those are answerable from the file, and they are most of what people actually want to know.
For a verdict on safety, VirusTotal runs an upload past around seventy scanners. That does involve uploading the file, which this page never does — a trade worth making deliberately rather than by accident.
The longer treatment is in is this .exe safe to run? — every signal a file gives off before it runs, what each one is genuinely worth as evidence, and the order to check them in.
Where your file goes
Nowhere. The browser hands the page the bytes of the file you chose, the parser walks the headers, and the result is written into the page. There is no request, no server, no queue and no retention policy, because there is nothing to retain. Closing the tab disposes of it.
This is worth stating plainly because the obvious alternative — an upload-and-scan site — is exactly what someone with a file they distrust should be most careful about. If you want to check the claim rather than take it, open your browser's developer tools, switch to the network panel, and inspect a file: nothing is sent.
The page itself uses Google Analytics and Google AdSense, which see page views in the ordinary way. They cannot see the file you chose or anything parsed from it; the report is built in memory and never becomes a request. What we do record is aggregate and anonymous — the format, the processor, and whether the file was signed — with no filename and no file contents. Details in the privacy policy.
Common questions
Is my file uploaded anywhere?
No. The file is read by JavaScript running on your own machine, the headers are parsed in the tab, and the result is drawn on the page. Nothing is transmitted and no copy is kept, because none is ever made.
Does this run the program?
No. It reads the file the way a librarian reads a spine. Not one instruction from the executable is carried out, which is the point: you can inspect something you are unsure about without giving it a chance to do anything. If you decide you do want to run it, the loader is a separate page and a deliberate second step.
Can it tell me whether an .exe is a virus?
No, and nothing that only reads a file can. It is useful for spotting that a file is the wrong architecture, is an installer rather than the program, is unsigned, or is compressed so that it reveals nothing until it runs. For an actual safety verdict use VirusTotal.
What is a PE file?
Portable Executable is the format every Windows .exe, .dll and .sys uses. It opens with a small MS-DOS program left over from 1985 whose only job is to print This program cannot be run in DOS mode, then the real header, a table of sections holding code and data, the list of libraries the program needs, and a tree of resources. The longer explanation is here.
Why does it say my file is 16-bit or a DOS program?
Because it is, and that is why modern Windows refuses to start it. A plain MZ file is a real-mode MS-DOS program; an NE file is 16-bit Windows. 64-bit Windows dropped support for both, so double-clicking them does nothing whatsoever — no error, no window. Both still run under emulation, which is a whole subject of its own.
What does high entropy in a section mean?
Entropy measures how random the bytes look, from 0 to 8. Ordinary compiled code sits near 6. Above roughly 7.2 the data is compressed or encrypted — normal for a section holding a zip or a PNG, and a strong hint of a packer when it is the section the program executes from.
Does it work on a Mac, a Chromebook or a phone?
Yes. It is a web page, so it runs wherever a current browser runs. That matters most on the machines that cannot open an .exe at all: a Mac or a Chromebook has no built-in way to look inside a Windows executable, and this needs nothing installed.
If you want to run it, not just read it
Reading a file and running it are deliberately two different pages here. When the report says a file is 32-bit x86 with nothing exotic in it, the loader will have a fair go at running it in a browser tab — no install, nothing uploaded there either.
Run your own EXE → · How to open an .exe on any platform · What runs and what does not · Games and apps ready to play
Platform guides: on a Mac · on a Chromebook · on Android. And if a program refuses to start because something is missing, the missing-DLL error is usually simpler than it looks.
Put one of these games on your own site
Eleven of the games here were written from scratch for this site, which makes them ours to give away — and we do. Free for anyone to put on their own page: one line of HTML, no account, no permission, no attribution beyond a credit line.