Is WinUtil Safe? What Chris Titus Tech’s Command Really Runs

Short answer: Is WinUtil safe? Chris Titus Tech’s WinUtil is an open-source (MIT) PowerShell script published at github.com/ChrisTitusTech/winutil, and the official command, irm https://christitus.com/win | iex, downloads the latest release straight from that repository. We checked: on September 26, 2026 it redirected to release 26.08.19. The script itself is not the main risk. The risks are running it from a lookalike site, running the command without knowing what it does, and applying “debloat” tweaks that disable security features or can’t be undone. It creates a restore point only if you tick that option, so tick it first.

What the irm | iex command actually does

The command has two halves, both built into PowerShell:

• irm is short for Invoke-RestMethod. It downloads the content at https://christitus.com/win.
• iex is short for Invoke-Expression. It runs whatever was downloaded as PowerShell code, immediately, with the rights of the window you ran it in.

So the command means: download a script and run it without saving or showing it. WinUtil’s FAQ describes it the same way: the command “downloads and executes the latest script directly into your current PowerShell session,” and nothing is permanently installed.

We followed the redirects on September 26, 2026. christitus.com/win returned a permanent redirect to github.com/ChrisTitusTech/winutil/releases/latest/download/winutil.ps1, which GitHub resolved to the 26.08.19 release file. The code you run comes from the official GitHub release, but you are trusting two things: the christitus.com redirect and the GitHub account.

The README also lists a development-branch command, irm https://christitus.com/windev | iex. Use the stable command unless you want untested changes.

This pattern is exactly why lookalike commands are dangerous. If you paste an irm ... | iex line from a video comment, forum post or copycat site, you run whatever that domain serves, as administrator.

The current release, checked

Windows 10 is not supported. The official user guide opens with a caution: “Windows 10 is not supported by Winutil.” If you are still on Windows 10, don’t use it there.

We read the hash from GitHub’s releases API and re-computed it from the downloaded file. The script’s own header says “Version: 26.08.19.” If it is not started as administrator, it relaunches itself elevated. If PowerShell is restricted by a security policy, it stops with the message “WinUtil is unable to run on your system.”

Is WinUtil safe to run? A safer way: download, check, read

You do not have to pipe code straight into PowerShell. This gives you the same program with a chance to look first:

1. Download winutil.ps1 from the latest release page on GitHub.
2. Check the hash in PowerShell:

   Get-FileHash .\winutil.ps1

   Compare it with the SHA-256 digest GitHub shows next to the file.

3. Open the file in a text editor and skim it. It is plain text.
4. Open PowerShell as administrator in that folder and run it:

   powershell -ExecutionPolicy Bypass -File .\winutil.ps1

   The bypass applies to that one run only.

Our WinUtil page lists the current release and hash.

What WinUtil can change on your PC

The README describes WinUtil as a compilation of Windows tasks to “streamline installs, debloat with tweaks, troubleshoot with config, and configure Windows updates.” In the 26.08.19 script we counted these groups:

• Install: installs and updates apps from a built-in list.
• Tweaks: 18 “Essential Tweaks” and 21 in a group labeled “Advanced Tweaks – CAUTION,” plus DNS and performance-plan options.
• Config: Windows features, fixes and shortcuts to legacy control panels.
• Updates: the user guide lists options to enable or disable updates, allow security updates only, pause updates and manage driver updates.
• Windows 11 Creator: builds a custom Windows 11 ISO “with bloatware removed, telemetry disabled, and hardware requirement checks bypassed.” An image that bypasses the hardware checks installs Windows on PCs Microsoft does not support.

The README also offers presets that apply a set of tweaks without clicking: Standard, Minimal and Advanced. The exact list for each is in config/preset.json in the repository. Read it before using a preset.

The risks of debloat tweaks

Some tweaks in the Essential group change security or recovery features, not just clutter. From the script’s own descriptions:

• BitLocker – Disable: “Disables BitLocker.” On a laptop, drive encryption protects your data if the device is lost or stolen.
• Windows Platform Binary Table (WPBT) – Disable: WPBT lets the PC vendor run programs at boot, “such as anti-theft software.” Disabling it can stop vendor anti-theft tools from working.
• Services – Set to Manual and Telemetry – Disable: change how many Windows components start and report.
• Hibernation – Disable: removes hibernation. The description argues it “really should never be used,” which is a view, not a rule; laptop users may rely on it.

The Advanced group goes further. It includes removing Microsoft Edge, removing OneDrive, disabling IPv6, disabling Storage Sense, removing Windows AI features and disabling Reserved Storage. The Reserved Storage entry itself says to “re-enable before major Windows feature updates.”

WinUtil’s documentation also lists a known issue: the “Revert Start Menu” tweak “stops working starting with Windows 11 update KB5089573 (released in May 2026).” Tweaks depend on how Windows works today, and Windows updates change that.

The Updates tab deserves the same care. Turning Windows updates off, or limiting them, also stops security fixes you may need.

WinUtil’s own user guide sets the rules: always “create a system restore point before major changes” and “start with Essential Tweaks before Advanced ones”; never “apply all tweaks without understanding them” or “disable security features unnecessarily.” Our advice: apply only tweaks you can explain in one sentence, one group at a time, and leave BitLocker, WPBT and the Advanced group alone unless you have a specific reason.

How to undo WinUtil changes

There are two layers.

1. Create a restore point first

WinUtil has a tweak called Restore Point – Create, described as creating “a restore point at runtime in case a revert is needed from WinUtil modifications.” In the 26.08.19 script it is not ticked by default. When you tick it along with other tweaks, WinUtil creates the restore point before applying the rest. The Standard and Advanced presets include it; the Minimal preset does not. Chris Titus’s own article says a restore point is created automatically, but the current code makes it an option, so tick it yourself.

To roll back with it later, open System Restore (search “Create a restore point,” then select System Restore) and pick the point named “System Restore Point created by WinUtil.”

2. Use Undo Selected Tweaks

WinUtil’s FAQ says to reopen WinUtil, select the tweaks you applied and click Undo Selected Tweaks. Most tweaks store the original registry or service value so they can be reversed. Not all do. In the 26.08.19 script, Disk Cleanup – Run, Temporary Files – Remove and Widgets – Remove carry no undo data. Deleted files do not come back.

Apps you installed through WinUtil are ordinary installed apps. Remove them from Settings > Apps.

Lookalike WinUtil sites and commands

We list only domains named by the developer or a reputable source.

The report says attackers register domains that “closely match names such as PowerToys, WinUtil, EasyBCD, CrystalDiskMark, and Wintoys,” and later “replace trusted download links with malware.” For WinUtil, the official addresses are christitus.com/win, github.com/ChrisTitusTech/winutil and the documentation at winutil.christitus.com. Our guide to fake download sites covers the wider pattern.

Antivirus warnings

WinUtil’s FAQ says antivirus alerts are false positives because “WinUtil makes system changes that antivirus programs may flag.” That can be true for the official file. It says nothing about a script from another domain. If your security software flags a WinUtil script, check its hash against the GitHub release before you allow it.

Questions

Is irm christitus.com/win | iex safe to run?

It downloads the official GitHub release and runs it as administrator. That is only as safe as your trust in the domain and the account. Downloading, checking and reading the script first is safer.

Does WinUtil create a restore point automatically?

Not in the 26.08.19 code. “Restore Point – Create” is an unticked option unless you use the Standard or Advanced preset. Tick it before applying tweaks.

Can I undo WinUtil tweaks?

Most, with Undo Selected Tweaks. Cleanup tasks and Widgets removal have no undo. A restore point covers more.

Is WinUtil a virus?

The official script is open source under the MIT license and published on GitHub. Security tools may flag it because it changes system settings.

Is winutil.app the official site?

No. Cyber Security News listed it as a fake site impersonating WinUtil. The official command uses christitus.com.

Does WinUtil install anything permanently?

The tool itself runs in your PowerShell session. The apps you choose to install and the tweaks you apply do stay.

Which tweaks should I avoid?

BitLocker – Disable and WPBT – Disable on laptops, and the Advanced group unless you know why you need a specific item.

Does WinUtil work on Windows 10?

The official user guide says Windows 10 is not supported and lists Windows 11 as the required operating system.

Can WinUtil help with Windows 11 on an old PC?

Its Windows 11 Creator can build an ISO that bypasses the hardware checks, but Microsoft does not support Windows 11 on such PCs. Read our unsupported-PC guide first, and compare the tools in Rufus vs Flyoobe vs Media Creation Tool.

Sources

• ChrisTitusTech/winutil repository and README, GitHub (checked September 26, 2026)
• WinUtil release 26.08.19 and config/preset.json, GitHub
• WinUtil User Guide, WinUtil documentation
• WinUtil FAQ and Known Issues, WinUtil documentation
• Windows Utility, ChrisTitus.com
• Hackers are Setting Up Websites Impersonating Popular Windows Apps to Deliver Malware, Cyber Security News, Tushar Subhra Dutta (July 27, 2026)
• Invoke-RestMethod and Invoke-Expression, Microsoft Learn
• Get-FileHash, Microsoft Learn