Download

The latest version of Registry Finder is 2.59 (April 29, 2024). What's new

Installer - both 32-bit and 64-bit SHA-256: b6502ce87a3f3c35ee4ab8f5e360e6bab0db7e89336c0e69f2017f9f77984c7d. Check it on VirusTotal

Archive 32-bit SHA-256: e358bfc47cf28fcabca9e52ac181e5b9ca8adcb44939f590122e6839bfcc2460. Check it on VirusTotal

Archive 64-bit SHA-256: 0c43bb2deeab65ae24e3855a55861b2ebb02658425f3c5f3c66c9c9d47c89b30. Check it on VirusTotal

If you are unsure of what archive to use for portable mode, I recommend to select one that matches architecture of your Windows. Installer does that automatically.

Note. To check SHA256 of a file, in the command prompt type

powershell get-filehash <filename>

and compare the output with the SHA256 above.

Description

Registry Finder is an improved replacement for the built-in Windows registry editor. It has many features that makes working with registry more productive, comfortable and safe, including:

  • Cut/Copy/Paste keys and/or values.
  • Undo and redo registry modifications (except changing permissions).
  • Multiple local and remote registry windows.
  • Fast, non blocking search.
  • Whole search results are displayed in a list.
  • Multiple search results window.
  • Ability to search within previous search results narrowing down your search scope.
  • Ability to search for hidden keys.

Registry Finder allows you to browse the local registry; create, delete, rename keys and values; modify values as its natural data type (string, multistring, DWORD) or as a binary data. It is allowed to open multiple Registry windows. Next time you start Registry Finder, those windows will be reopened on the same keys as before.

The Find operation is efficient and quick. All found items are displayed in a separate window as a list. Each line represents a single match with the search criteria. The icon shows where the match occurred: key name, value name or value data. Matched text is highlighted with red.
You can jump to any found item in the Registry window or edit/delete items right in the Find Results window.
Items in the Find Results window can be saved to file in .reg or .txt format. In latter case, items are separated by tabulator. It allows easy data importing and analyzing in other programs, such as Microsoft Excel.

With the Replace feature you can easily replace all or particular occurrences of one string with another. The replacement is performed only in items that are in the Find Results window. In the Replace dialog you specify either all items or just selected ones. After replacement is done, items in the window are updated. If some item do not match the search criteria any more it still remains in the list.

All operations that alter the registry including deletion and replacement can be undone and redone. The operations are listed in the History window. To open it, click View|History in the main menu. The last performed operation is marked with a yellow arrow.

Full name of the key can be copied to clipboard.

Screenshots

Screenshot of the main window.
More screenshots...

Installation

Registry Finder can be used without installation. Just download archive with binaries, unpack it into any folder on HDD or USB drive and start the executable. The utility does not store any of its data in the registry. It stores settings in the RegistryFinder.config file located in the same folder as the executable.

Another option is to download and run the installer. It contains both 32-bit and 64-bit versions of binaries, so you do not need to choose. The installer can deploy Registry Finder either in Normal mode or in Portable mode. The later just unpacks binaries into the folder you specify. The Normal mode performs standard things - unpack binaries, create shortcut in the Start Menu, create a desktop icon and make uninstallation entry in the Control Panel. One little difference is that in Normal mode the config file is stored in another place. Specifically, in the %APPDATA%\RegistryFinder folder.

Running as Administrator

Unlike Windows registry editor, by default, Registry Finder runs with limited privileges even when you are an administrator. This is more secure, but may cause Access denied errors when you're attempting to do some changes. To avoid such errors you should launch Registry Finder with elevated privileges.

Registry Finder allows you to restart himself as admin through the File | Restart as Administrator menu. (This menu is absent if Registry Finder already running as admin.)

If you want to always launch as admin, you can create shortcut and set the Run as administrator option (right click the shortcut, select Properties, click Advanced).

When Registry Finder is running as administrator, the window title contains the word "Administrator", for example: Registry Finder - Administrator - [Local Registry].

Dark theme

Registry Finder automatically uses dark theme when you turn on dark mode in Windows. (Head to Settings > Personalization > Colors. Select the "Dark" option under the "Choose your app mode" section.) Dark mode is available only in Windows 10 so, in turn, the dark theme in Registry Finder is available only in Windows 10. Screenshort of the main window in dark mode

It is possible to turn off dark theme when Windows dark mode is on through the config file.
After the first run, Registry Finder creates the following entry:

<ForceLightMode>false</ForceLightMode>

Make sure Registry Finder is not running and change the entry to

<ForceLightMode>true</ForceLightMode>

I could not make some UI elements to be dark (some due to technical issues, some due to I was too focused on the main window and did not noticed them on time). This include the status bar in the main window, drop-down list in all combo boxes, data controls in the Find dialog, the main control in the Modify Binary dialog, tabs in the Properties dialog, the links list in the Edit Favorite dialog.
The grayscale icons that Registry Finder uses by default are not good with the dark theme. I recommend to use custom toolbar icons.
If you notice other incompleteness or issues, don't hesitate to contact me.

Windows Explorer Integration

To facilitate importing .reg files with Registry Finder you can add a command to Windows Explorer's context menu for .reg files.

Windows Explorer's context menu with the Import with Registry Finder command

To do so, just execute the ContextMenu-Add.bat file. To remove the command, execute the ContextMenu-Remove.bat file.

Also, you can make Registry Finder, instead of regedit, to perform import when you double-click a .reg file: execute RegFileAssoc-Add.bat. RegFileAssoc-Remove.bat restores import with regedit.

Note. You must execute files with administrator rights, otherwise you'll get the Access denied error.

Replacing Windows Registry Editor

As of version 2.51, Registry Finder can replace Windows' built-in registry editor (regedit). Select the File | Replace Windows Registry Editor menu to have Registry Finder execute instead of regedit when you launch regedit.
Replacig regedit is equivalent to the following command:

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v "Debugger" /t REG_SZ /d "\"REGISTRY_FINDER_DIR\RegistryFinder.exe\" -z" /f

Note. This is a global setting that affects all users regardless of how they start regedit (for example, through a command line, the Run dialog or by double clicking a .reg file). If you are using Registry Finder in portable mode, make sure that the folder where Registry Finder resides is accessible to any user. Make sure you revert the changes before deleting Registry Finder, otherwise regedit cannot be started. In normal mode, uninstaller will revert the changes for you.

If you replaced regedit and want to launch regedit, not Registry Finder, you can do it with the --regedit command line argument:

RegistryFinder --regedit

Running from Write-protected Media

In some use cases the folder where Registry Finder stores its settings and undo history is not accessible for write. The most evident is running from a write-protected USB stick.

In that case, Registry Finder is fully functional except that the undo history and application settings are not saved (so called No-Save mode). On startup, appropriate message is shown and the status bar contains a yellow triangle sign.

The pop-up message can be suppressed by manually editing the RegistryFinder.config file. Add the following line at the end of the file:

<WarnStoreReadOnly>false</WarnStoreReadOnly>

Offline Registry

Registry Finder is able to treat set of registry hive files as a separate standalone registry. This feature saves you from tedious procedure of loading and unloading hive files separately. It allows you to, say, easily examine a backup of the registry or modify registry of unbootable Windows when running Registry Finder from bootable USB drive.

The usage is simple: you specify a folder with registry hive files. Registry Finder loads particular files from that folder as hives and gives you familiar interface to work with much as it were live registry: you can browse, create keys and values, import, export, search and so on.

The following files are loaded as corresponding subkeys of HKEY_LOCAL_MACHINE: SAM, SECURITY, SOFTWARE, SYSTEM, and .DEFAULT is loaded as subkey of HKEY_USERS.

In this version, HKEY_CLASSES_ROOT and HKEY_CURRENT_USER keys are not supported. Viewing and editing the keys security information is not implemented.

Because of limitations of API, this feature is not available on Windows XP.

Command Line

Command line can be used to customize Registry Finder behavior in GUI mode and to automate some tasks in command line interface (CLI) mode.

GUI mode

--helpPrints help message.
--computerName argSpecifies the name or IP address of a computer to connect to.
--navigate argSpecifies a registry key to navigate to. If this parameter is set to "clipboard" then the path is taken from the clipboard.
--reopenLocal argRestore or not previously opened local registry windows when Registry Finder starts (arg: true or false, default is true).
--reopenRemote argRestore or not previously opened remote registry windows (arg: true or false, default is true).
--findDialogOpen the Find dialog on startup.
--dataFolder argSpecifies folder to store settings and undo history.
--import argImports the specified .reg file into the registry.
The work is always performed in a separate instance (that is the --multiInst is implied).
--importSilentDo not display a confirmation of import.
--multiInstWhen an instance of Registry Finder is already running, starts a new instance. By default, the running instance is activated instead of starting another one.

Note 1. The parameter names are case insensitive.

Note 2. There are additional parameters (displayed with --help) but they are left undocumented since they are experimental and may not work as expected.

CLI mode

Please use

RegistryFinder help

in the command prompt to see overview of available commands. Below is the output of that command.

Usage: RegistryFinder <command> [<args>]
Available commands:
  find           Searches the registry for the specified text.
  help           Prints help information.
  load           Loads the specified file as a registry hive.
  unload         Unloads the specified key from the registry.

Use 'RegistryFinder help ' or 'RegistryFinder command --help' to print detailed description of the command.
Use 'RegistryFinder help --all' to print detailed descriptions for all commands.
Use 'RegistryFinder help --gui' to print detailed description of command line options for GUI mode.
						

Keyboard shortcuts

Registry Finder uses the following keyboard shortcuts.

ShortcutAction
Ctrl+LActivate address bar
Middle Click in address barPaste registry path from clipboard and navigate to it
Ctrl+NOpen new local registry tab
Ctrl+Shift+NConnect to a remote computer's registry
Ctrl+SSave changes to offline registry
Ctrl+EExport current key or entire registry to a file
Ctrl+ZUndo the last action
Ctrl+YRedo the previously undone action
F7Create a new key
Ctrl+CCopy the selection to clipboard
Ctrl+VPaste content from clipboard
DelDelete selected items
F2Rename key or value
Ctrl+ASelect all content
Ctrl+FSearch
Ctrl+RReplace in search results
Ctrl+GNavigate to the item in Registry tab. Uses existing tab if possible.
Ctrl+Shift+GNavigate to the item in new Registry tab.
Alt+EnterOpen properties of registry key or favorite item.
Ctrl+HShow/activate/hide the History window
Alt+Left ArrowGo to the previous key in navigation history
Alt+Right ArrowGo to the next key in navigation history
Alt+Up ArrowGo to up one level in registry hierarchy
F5Refresh current registry tab
Ctrl+IOpen Favorites tab
Ctrl+0 .. Ctrl+9Go to corresponding favorite item
Ctrl+Shift+0 .. Ctrl+Shift+9Edit corresponding favorite item

Search Results Limit

By default, search results are limited by 1000 items. The limit protects you from bad consequences when search criteria is specified in a way what generates a huge number of matches. For example, an empty string or a single-character string, e.g. "a". (Possible consequences are unresponsive user interface, high memory and CPU usage and eventual crash.)

If it is needed, you can increase the limit, through editing the RegistryFinder.config file. Locate and modify the following entry:

<MaxMatches>1000</MaxMatches>

Changes take effect on the next search, restart of Registry Finder is not required.

Regular Expressions

A regular expression (or regex, or regexp) is a way to specify a search pattern. This is a very powerful tool that allows you to set complex search criteria so, that the results, on the one hand, contain the required information and, on the other, that there are minimal results that do not contain the required information.

The syntax of regular expressions is quite complex, but it should not frighten you, because by mastering even the most basic things, you will significantly increase the search capabilities. For example, Registry Finder does not support the traditional usage of "*" and "?" as wildcard symbols. Instead, you can use equivalent regular expressions ".*" and ".". Or you can use the expression "word1|word2" to find a string that contains one or both of the words "word1" and "word2".

Because of the variety of constructions of regular expressions I do not try to describe even the most basic ones here. Instead, I recommend finding relevant information on the Internet. For example, an excellent starting point to learn regular expressions is regular-expressions.info. Another useful resource is regex101.com which is a tool for testing regular expressions.

To search for regular expressions, you have to enable the "Use regular expressions" option in the Find dialog.

Registry Finder uses the Boost.Regex library. It utilizes the Perl regular expression syntax. See the documentation is you need details.

Hidden Keys

Registry Finder supports searching so called hidden registry keys. These are the keys with the null character in the name. Such keys cannot be created, deleted, modified or viewed by standard Windows API, so they are not accessible by regedit and most other registry editors.

To quickly evaluate this feature, you can use the "Search only hidden keys" checkbox in the Find dialog.

The search Hidden Keys option

In the results list the null character is displayed as the bullet sign:

Example of hidden keys in search results

The downloaded archive contains the NReg utility that you can use to create and delete hidden keys for demonstration purposes. Type NReg -h to see the usage information.

Note. HKEY_CLASSES_ROOT is a special case. Registry Finder correctly finds hidden keys in HKEY_CLASSES_ROOT, but it does not go inside them. If you need to look deeper, you have to search at least in HKEY_CURRENT_USER\Software\Classes plus HKEY_LOCAL_MACHINE\SOFTWARE\Classes.

Translations of Registry Finder

Available translations are listed here.

Translating Registry Finder into another language

In order to translate Registry Finder into another language, follow the instructions below:
  1. Start MakeLang.exe with the -i parameter:

    MakeLang -i

    That creates RegistryFinder_lang.ini file containing all strings used in Registry Finder UI.
  2. Open the created language ini file in Notepad or in any other text editor.
  3. Translate all string entries to the desired language and save the file.

    Optionally, you can add your name and/or a link to your Web site. This is the "1018=TranslationAuthor" entry under the "[Dialog_#100]" section. TranslationAuthor must be in the form of the <a> HTML tag. For example,

    1018=<a href="www.johnsmith.com">John Smith</a>

    This information is shown in the About box.

  4. Start Registry Finder. It automatically invokes MakeLang with the -d parameter to create the RegistryFinder_lang.dll file containing all translated resources in binary form.

    If you want to run Registry Finder without the translation, rename the language ini and dll files, or move it to another folder.

Here you can find some clarifications to certain lines in the language file.

If you translate Registry Finder into you language, please send me the language ini file and I will share it with other people. Alternatively, you can make a pull request in the translations repository.

Custom toolbar icons

  • An icon set from Martin

    Icon set from Martin
    Icon set from Martin in dark mode
  • An icon set from SirTazofMania

    Icon set from SirTazofMania
    Icon set from SirTazofMania in dark mode
  • An icon set from Joe P. - rework of SirTazofMania's icons in Windows 11 style

    Icon set from Joe P.
    Icon set from Joe P. in dark mode
  • An icon set from Spitfire XIV

    Icon set from Spitfire XIV
    Icon set from Spitfire XIV in dark mode
  • An icon set from Marcio de Andrade

    Icon set from Marcio de Andrade
    Icon set from Marcio de Andrade in dark mode
  • An icon set from Frédéric Bellec

    Icon set from Frédéric Bellec
    Icon set from Frédéric Bellec in dark mode
  • An icon set from amshevch

    Icon set from amshevch
    Icon set from amshevch in dark mode
  • An icon set from Slim08

    Icon set from Slim08
    Icon set from Slim08 in dark mode

To install a custom icon set, just download an archive and unpack it to the "res" folder located in

  • For portable mode, the program's folder.
  • For normal installation mode, %APPDATA%\RegistryFinder.
(The folder does not exist by default. You should create it yourself.)

For details on how to create custom toolbar icons, see here.

Crash Reports

When Registry Finder encounters an unexpected error it generates crash report and asks you to send it to the developer.

Crash report dialog

This report contains information essential to investigate and fix the problem. So please prefer pressing the Send report button. If you encounter crash multiple times, do not hesitate to send report two or three times - it is possible, the latter contain slightly different information not available in the former. Press the Close the program button when you believe you already reported the same problem several times.

Please note that due to lack of time, I analyze reports from the latest version only.

System requirements

Windows XP, Vista, 7, 8, 8.1, 10, 11 32-bit and 64-bit versions.

License

In brief, this utility is released as freeware. You are allowed to freely distribute this utility via removable media, Internet, or in any other way, as long as you don't charge anything for this. For details, please see License Agreement.

Disclaimer

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.

PAD file

Software listing web sites that support PAD files can use this file to automatically update the product information when new version of Registry Finder is released. For more information about pad files, click here.

Feedback

If you have any problem, suggestion, comment, or you found a bug in Registry Finder, please send a message to feedback@registry-finder.com or create a topic at GoogleGroup forum.

Registry Finder will be developed further, so your feedback is greatly appreciated!