Is Windhawk Safe? Official Download, Mods and Antivirus Alerts

Short answer: Is Windhawk safe? The genuine Windhawk, from windhawk.net or github.com/ramensoftware/windhawk, is a legitimate, open-source (GPL-3.0) customization tool from Ramen Software, and its installer is code-signed by developer Michael Maltsev. The current stable release is v1.7.3 (December 8, 2025). The real risks are specific: Windhawk injects code into most running programs by design, which is why some antivirus tools flag it; each mod you install is code that runs inside those programs; and a lookalike site, windhawk.org, has been named by the maintainer. Download from the official sources, check the hash, and install only mods you have read.

Where the real Windhawk lives

Windhawk is made by Ramen Software. Its maintainer publishes on GitHub as m417z. The official addresses are:

• Website: windhawk.net. Its Download button links to ramensoftware.com/downloads/windhawk_setup.exe.
• Repository and releases: github.com/ramensoftware/windhawk. The repository README says it is used to report issues and discuss Windhawk, and points to windhawk.net as the official website.
• Mods: github.com/ramensoftware/windhawk-mods, the repository behind the mod catalog.

We downloaded the installer from the windhawk.net button on September 26, 2026. Its SHA-256 hash matched the v1.7.3 file on GitHub exactly.

The current release, checked

We read these values from GitHub’s releases API on September 26, 2026, and re-computed the hash of the online installer ourselves.

A newer version is in testing. Windhawk 2.0 has been in public alpha since July 13, 2026; the latest pre-release is 2.0 alpha 6, published September 21, 2026. GitHub marks these as pre-releases. The 2.0 notes say Windhawk is dropping support for older Windows versions and 32-bit systems, and “now exclusively supports Windows 10 and newer (64-bit x64 and ARM64).” For a PC you depend on, stay on the stable v1.7.3 until 2.0 is released as stable.

Online vs offline installer

Windhawk has offered two installers since v1.4 (November 2023). The release notes explain the difference: the online installer is much smaller and “downloads the required dependencies only when needed.” The offline installer includes everything up front, which is why it is about 149 MB instead of about 11.6 MB.

• Online installer: the default from windhawk.net. Fine for most PCs with an internet connection.
• Offline installer: for PCs that are offline or behind a firewall that blocks downloads. Download it from the GitHub release page.

The installer can also extract a portable copy of Windhawk. The README mentions “extracting the portable version of Windhawk with the official installer,” and several release notes describe portable-only fixes.

What Windhawk and its mods can change

Windhawk itself changes nothing visible. It is a platform that loads mods: small programs that change how Windows components or other apps behave. Popular mods adjust the taskbar, Explorer and the Start menu.

How it works, from the project’s own documentation:

• It injects into most processes. “By default, the Windhawk engine is injected into all processes, except for predefined lists of excluded processes, which are system-critical or known to be incompatible.” The wiki explains why: injecting early lets Windhawk load mods before a target program starts running.
• Mods are source code. The website says mods “are not black boxes. Each mod comes in the form of source code, which can be reviewed to make sure that the mod does exactly what it says.” Windhawk compiles them on your PC with a bundled Clang compiler.
• Mods in the catalog are reviewed. Submissions to the windhawk-mods repository go through an AI review the author runs, then a human review. The wiki’s own disclaimer says the AI reviewer “can still be wrong,” so the human review is what counts.
• You control the scope. Settings > Advanced settings > More advanced settings has a process exclusion list. Excluded processes “are entirely unaffected by Windhawk.”

In short, a mod can change almost anything in the programs it targets. That is the point of the tool and the reason to install mods with care: read what a mod targets and what it does before you enable it.

Why antivirus software flags Windhawk

The maintainer explained it in the project’s discussions in June 2022: “Windhawk injects code into all running processes, which is not something an average program does, and is a technique that’s often misused.” Security tools that watch for injection can react to Windhawk, and to programs it starts.

A July 2024 example: a user reported that 1 of 71 engines on VirusTotal, VBA32, flagged the installer as “Suspected Of Trojan.Downloader.gen.” The maintainer replied, “It’s surely a false positive detection. Unfortunately, struggling with false positives is a non-ending hassle,” and suggested reporting it to that vendor.

The official troubleshooting page lists the symptoms of an antivirus conflict: Windhawk is blocked or killed, other programs are blocked because of Windhawk’s injection, or Windhawk cannot inject into some processes. It says to test with the antivirus turned off temporarily, and if that fixes it, to find a way to make them work together, “either by excluding it, or via other means.”

Our view: a detection on a file you downloaded from windhawk.net or the GitHub release, with a matching hash, is most likely the behavior described above. A detection on a file from any other site is a reason to delete it, not to add an exclusion. On a work PC, don’t install Windhawk at all without your IT team’s approval; enterprise security tools are built to stop exactly this kind of injection.

Fake Windhawk sites

We list only domains named by the developer or a reputable source.

The maintainer described it as part of “a systematic domain-squatting operation targeting open-source software projects.” The real site is windhawk.net. Our guide to fake download sites lists other projects hit the same way.

Is Windhawk safe to download? How to verify it

1. Check the source. Use the Download button on windhawk.net, or a link starting with https://github.com/ramensoftware/windhawk/releases/download/.
2. Check the signature. Right-click windhawk_setup.exe, open Properties > Digital Signatures. The signer should be “Open Source Developer, Michael Maltsev.”
3. Check the hash. In PowerShell, in your Downloads folder, run:

   Get-FileHash .\windhawk_setup.exe

   For v1.7.3 the result must be 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f.

Our Windhawk download page links to the official files and keeps the hashes current.

How to uninstall Windhawk cleanly

One detail catches people out. When Windhawk 1.3 was released in March 2023, the developer wrote: “By default, installed mods aren’t removed on uninstallation.” Users have also reported mods whose visual changes stayed after the mod was removed. So work in this order:

1. Disable each mod in Windhawk, then remove the ones you no longer want.
2. Restart the affected programs, or sign out and back in, so the unmodified code loads. Confirm Windows looks the way you expect.
3. Uninstall Windhawk from Settings > Apps > Installed apps. If you used the portable version, exit Windhawk from its tray icon and delete the folder you extracted.
4. Restart the PC.

If a mod causes trouble before you get that far, Windhawk’s toolkit dialog opens with Ctrl+Win+W or from the tray icon. It includes a safe mode that “allows to temporarily disable Windhawk’s activity in case of a problem.”

Questions

Is Windhawk a virus?

No. The official release is open source and code-signed. Some antivirus tools flag it because it injects code into other programs, which the maintainer says is “a technique that’s often misused.”

Is windhawk.org the official site?

No. The maintainer says windhawk.org is a domain-squatting site. The official site is windhawk.net.

Should I install Windhawk 2.0?

It is still an alpha pre-release. Use v1.7.3 unless you want to test.

Are Windhawk mods safe?

Mods in the official catalog are published as source code and reviewed before they are accepted, but review is not a guarantee. Read what a mod does and which programs it targets before enabling it.

Does Windhawk slow down my PC?

The developer says it was “designed to be constantly running in the background without having a noticeable impact on the system.” Individual mods vary.

Which installer should I choose?

The online installer for most PCs. The offline installer if the PC has no internet access or blocks downloads.

Does Windhawk work on Windows 11 24H2 and 25H2?

Windhawk runs on current Windows versions, but each mod lists the Windows versions it supports. Check the mod’s description.

Is Windhawk safer than ExplorerPatcher?

They work differently. Windhawk applies separate mods you choose; ExplorerPatcher patches Explorer as one package, and Windows updates have broken it before. See our ExplorerPatcher safety check. For broad system tweaks rather than shell mods, compare our WinUtil safety check.

Is Windhawk free?

Yes. It is open source under the GPL-3.0 license.

Sources

• Windhawk official website (checked September 26, 2026)
• ramensoftware/windhawk repository and README and releases, GitHub
• Troubleshooting, Injection targets and critical system processes and Mod submission review process, Windhawk wiki
• Discussion #6 (maintainer on code injection, June 22, 2022) and Discussion #223 (VirusTotal false positive, July 19, 2024), GitHub
• Fake Windhawk website, Discussion #900, GitHub (April 3, 2026)
• Windhawk v1.3 beta: Safe mode, Ramen Software (March 31, 2023)
• windhawk-mods issue #4989, GitHub (August 2, 2026)
• Get-FileHash, Microsoft Learn