About WhyCrashed

1. Drop the file

   The tool reads the bytes on a background thread using byte-range reads. A 16 GB MEMORY.DMP is handled the same way as a 300 KB minidump, because only the parts that matter are read.

2. The parser reads the bytes

   Headers, streams and magic bytes decide what the file is and what it says. That is how a stop code, a faulting module or a certificate field gets read, rather than trusting the extension.

3. The reading is matched to the library

   The result is checked against our maintained reference library: 69 stop code explainers, 82 driver pages, exception codes, certificate and registry references and file type entries.

4. Confidence is stated, then you take it

   Each observation carries the field it came from. When the evidence is thin, the confidence is lowered and the report says why. Copy, download or print it as Markdown or plain text for a forum or a ticket.

1. BSOD Dump Analyzer

   Read a blue-screen minidump or MEMORY.DMP in the browser. Returns the stop code, the blamed driver, a fix plan and the evidence behind it, and explains why ntoskrnl.exe is usually the victim rather than the root cause.

2. WER and App Crash Reader

   Open Windows Error Reporting files and app-crash minidumps to find the faulting module and exception code. Explains that a .wer file is a summary, not a full dump.

3. Certificate Decoder

   Decode SSL and X.509 certificates, CSRs, keys and PFX files to show subject, issuer, expiry, SANs and fingerprints. Works offline, so there is no revocation check and the issuer signature is not proven against a trusted root.

4. .reg File Viewer

   Read a registry file before you run it, with the keys, value types and locations laid out in plain language. Never stamps a file safe, and notes that a merge cannot be undone.

Frequently Asked Questions

Are you affiliated with Microsoft?

No. WhyCrashed is independent. Windows is a trademark of Microsoft Corporation. We have no partnership, no support contract and no case numbers, and we will never quote one. Stop code and driver information comes from our own maintained reference library.

Does this replace a debugger?

No. A full debugger and a vendor support process can go much further than a browser parser, and there are crashes only they will settle. Our job is to give you a readable verdict, the evidence behind it and a report you can paste into a forum thread or a support ticket.

Will you tell me whether my PC is infected?

No page here will say that. We are not antivirus, and we do not scan your machine. We also never call an unknown file safe. The file identifier tells you what the format looks like from its magic bytes, and format is not the same thing as safety.

Do my files get uploaded anywhere?

No. Every parser runs in your browser and reads the bytes on your own machine. There is no upload step, nothing to install and no size limit, because large dumps are read in byte ranges rather than sent anywhere.

What does the optional AI actually see?

Only a short text summary of the report that the parser already produced. It never sees the file. It is a second opinion, it is rate limited, and the full report stands on its own if you leave it switched off or it errors out.

Is ntoskrnl.exe the cause of my blue screen?

Usually not. It is the module that was on the stack when Windows stopped, so it is most often the victim rather than the root cause. The analyzer looks past it for the driver in the frames and tells you how confident that reading is.

Can you check whether a certificate has been revoked?

Not offline. The decoder reads and shows the fields, including subject, issuer, expiry, SANs and fingerprints, but it makes no network calls. That means no revocation check, and the issuer signature is not proven against a trusted root.

Is a .reg file safe because the viewer opened it?

No. The viewer shows you the keys, the value types and where they land so you can decide for yourself. Running the merge is your call, and Windows gives you no undo once it is done.