Is WinUtil Safe? What Chris Titus Tech’s Command Really Runs

Short answer: WinUtil is a free MIT-licensed Windows utility maintained by Chris Titus Tech, but “official” and “open source” do not establish that every tweak is appropriate or that a file is malware-free. Its launch command downloads PowerShell code and immediately executes it. Our check of the official stable endpoint on 1 October 2026 retrieved release 26.08.19; its measured checksum matched GitHub’s release digest, and the script was not Authenticode-signed. We inspected files and selected code paths; we did not run WinUtil or apply any tweaks.

Editorial review: 1 October 2026 UTC. Exact-file static inspection and current official documentation review. No application execution, installation, antivirus scan, benchmark, restore-point creation or tested rollback.

What the launch command runs

The official repository documents this stable command:

irm "https://christitus.com/win" | iex

irm is the alias for Invoke-RestMethod; iex is Invoke-Expression. The first fetches content, and the second evaluates the returned code in the PowerShell session. You do not get a review step between downloading and executing. Microsoft’s Invoke-Expression documentation specifically calls for caution with input passed to it.

Our HTTP receipt followed christitus.com/win to the official GitHub latest-release asset and then the versioned 26.08.19/winutil.ps1 asset. The endpoint’s downloaded bytes exactly matched the separately downloaded versioned asset. This verifies what the endpoint served at the recorded time; latest is a moving reference and can serve different bytes later.

The development endpoint, christitus.com/windev, is a different channel. The default repository branch and its current documentation can also contain changes newer than the stable release. We used the tagged release configuration for statements about 26.08.19’s presets.

Exact stable-file receipt

A matching checksum is an exact-file identity check against that publisher reference, not a malware verdict. NotSigned means there is no Authenticode publisher signature on the inspected script; it does not, by itself, establish that the script is malicious. A signed GitHub commit is a different kind of signature.

Download and inspect before deciding whether to run

1. Open the official versioned release page and download the named asset. Record the release rather than relying only on a latest link.
2. Calculate its SHA-256 and compare it with the release digest for that exact asset.
3. Read the script and the configuration for the same tag. Search for the specific tweak you intend to apply and its undo path.
4. Check your organisation’s policy, Windows version and recovery options before granting administrator rights.
5. Decide whether the change is necessary. For a single app or setting, Windows Settings or the app’s own official installer may be sufficient.

These inspection commands read the file; they do not execute WinUtil:

Get-FileHash -LiteralPath .\winutil.ps1 -Algorithm SHA256
Get-AuthenticodeSignature -LiteralPath .\winutil.ps1

For the distinction between checksum and signature, see our Windows download verification guide. Do not turn an execution-policy or antivirus error into an instruction to disable protection. Record the exact warning, confirm the asset and seek an appropriate review before proceeding.

What the code can change

The utility provides application management, system tweaks, fixes, update settings and a Windows image creator. Those are separate operations. Installing a selected application is not the same as applying a preset or generating a modified Windows image.

In the inspected 26.08.19 script, a non-administrator session attempts an elevated relaunch. Its startup code checks PowerShell language mode and stops when restricted. Its image-creation code includes Windows setup scripts and encryption-related settings. These are observations of code, not a report that they were executed on a PC.

The release’s tweak configuration includes a BitLocker-disable action, service and telemetry changes, cleanup actions and package removal. The label “Essential” does not make each choice harmless on every machine. Keep encryption and security updates enabled unless a specific, understood requirement warrants a reviewed change. An image with hardware workarounds still installs an unsupported configuration where Microsoft requirements are not met; see the unsupported-PC guide.

Restore points and Undo are conditional

The tagged preset file includes the restore-point action in Standard and Advanced, but not Minimal. The script’s run-tweaks function processes that action before the remaining selected tweaks. That is code-path evidence, not proof that a restore point can be created on your PC. Verify an actual available point before relying on it, and keep a separate backup of important files.

The tagged tweak configuration defines per-action undo data or scripts. Disk Cleanup, Temporary Files removal and Widgets removal have no undo path in those entries. Do not assume Undo restores every original setting or recovers deleted files. An inverse command or default value is not necessarily the prior configuration.

Before applying a change, record its identifier, current setting, release and intended recovery method. Apply one understood change at a time and check the result. If you cannot identify a recovery route, postpone that change. No restoration workflow was tested in this review.

Compatibility and persistent effects

The current getting-started documentation targets Windows 11, lists PowerShell 5.1 or later and .NET Framework 4.5 or later, and requires administrator access for system changes. It explicitly excludes Windows 10. Windows 10 ESU does not change the utility’s support policy. We have not verified every Windows 11 build or architecture.

The script itself does not need a conventional installer, but closing its window does not erase its changes. Installed apps, registry or service modifications and update policies can persist. The inspected startup code also uses a local application-data folder for logs. Therefore, “nothing remains installed” is not a useful promise that nothing remains on disk or in Windows.

If security software reports a problem

The project’s FAQ describes alerts as false positives. That is the maintainer’s position; it is not a verified verdict for your detected file. Our checksum and signature checks cannot settle a detection. Avoid generic PowerShell exclusions or automatically allowing the file. Keep the exact release, hash and detection details for a qualified review.

Questions

Is WinUtil a virus?

This review does not classify the inspected file as malicious or malware-free. It establishes the official stable asset, measured checksum, signature status and selected code behaviour.

Does the official one-liner always run this same version?

No. It resolves a latest-release asset. Download a versioned asset when repeatability matters, and verify the actual bytes.

Does a restore point guarantee recovery?

No. Creation can depend on the machine’s configuration, and System Restore is not a backup of your personal files. Verify recovery options before making changes.

Will WinUtil make games faster?

No performance or gaming tests were performed here. A broad preset is not evidence of a benefit on your hardware.

Evidence and limitations

We retrieved the stable launch endpoint and versioned release asset, matched SHA-256 and size against GitHub’s release API, queried Authenticode on the saved script without executing it, and inspected selected startup, preset, restore and undo code. This is not a complete source-security audit, reproducible-build check or Windows compatibility test. The linked sources and exact-file receipt were checked on 1 October 2026.