App crash help: WER file reader and exception code lookup
A program closes, hangs, or throws up a faulting module message, and Windows Error Reporting quietly writes a record. Our WER file reader opens .wer files and app-crash minidumps in your browser tab. The file stays on your computer.
Where the reports live
Find the crash record, then read it here
Windows files these reports away without telling you. Here is the order we use when an app has fallen over and nobody wrote down what happened.
Check Event Viewer first
Open Event Viewer, then the Application log, and look for the Application Error entry at the time of the crash. It usually names the faulting module and the exception code straight away.
Dig out the .wer file
Windows Error Reporting keeps its reports in the ReportArchive and ReportQueue folders under your user profile's AppData. Each crash gets its own folder, and the .wer file inside is plain text.
Take the minidump if there is one
Many programs write their own .dmp beside the report or into a crash folder in their install directory. If both exist, keep both. The dump carries the evidence the summary leaves out.
Drop the file on the reader
The parse runs in your browser on a background thread and reads the bytes where they sit. Nothing is sent anywhere, so a locked-down work machine is not a problem.
Read it, then take it with you
You get a verdict with its reason, then the observations behind it. Copy or download the export if you need to hand it to a vendor, a forum thread or a support ticket.
03
How we work
A clear path from first conversation to finished work.
BSOD Dump Analyzer
Read a blue-screen minidump or MEMORY.DMP in the browser. Returns the stop code, the blamed driver, a fix plan and the evidence behind it, and explains why ntoskrnl.exe is usually the victim rather than the root cause.
WER and App Crash Reader
Open Windows Error Reporting files and app-crash minidumps to find the faulting module and exception code. Explains that a .wer file is a summary, not a full dump.
Certificate Decoder
Decode SSL and X.509 certificates, CSRs, keys and PFX files to show subject, issuer, expiry, SANs and fingerprints. Works offline, so there is no revocation check and the issuer signature is not proven against a trusted root.
.reg File Viewer
Read a registry file before you run it, with the keys, value types and locations laid out in plain language. Never stamps a file safe, and notes that a merge cannot be undone.
A faulting module is where the process died. It is not always what killed it. We tell you which one we think it is, and how sure we are.
Pick the right bench
Which tool to reach for next
App crashes, kernel crashes and mystery files each need a different parser. These are the ones that matter once you have a .wer file in front of you.
WER and app crash reader
Opens .wer files and app-crash minidumps to surface the faulting module and the exception code, with the summary limitation spelled out on the result.
29 exception codes explained
An access violation style code tells you the thread touched memory it was not allowed to touch. The library explains each code in plain words.
When it is really a driver
Repeat crashes in graphics-heavy apps, whole machine freezes, or a blue screen straight after the app dies all point at the kernel side instead.
How the parsing works
Byte-range reads in a background thread, a maintained reference library, and an evidence ledger rather than a guess dressed up as an answer.
Certificates and .reg files
Not a crash, but the same rule. Decode a certificate or read a registry file before you run it, all of it in your own browser.
05 — Common questions
Questions people ask before they open a .wer file
Frequently Asked Questions
- Where does Windows keep .wer files?
- Under your user profile in AppData, in the ReportArchive and ReportQueue folders that Windows Error Reporting maintains. Each crash gets its own folder. There is also a machine-wide copy in ProgramData on some systems. The walkthrough on finding and reading WER reports shows the paths and what each folder means.
- Does the faulting module in a .wer file name the cause?
- Not on its own. A .wer file is a summary, so the module it names is where execution was when the process died. That can be the real fault, or it can be an innocent library handed bad data by something else. Treat it as a lead, then check it against the matching minidump.
- What does an access violation exception code tell me?
- That a thread tried to read or write memory it was not allowed to touch, which usually means a bad or stale pointer rather than a hardware fault. The code often comes with an address, and an address near zero reads differently to one deep in a mapped region. Our library covers 29 app-crash exception codes with that detail.
- Is this an app crash or a driver problem?
- If the whole machine stalls, the screen blanks and recovers, or a blue screen follows the app closing, look at the kernel side instead. Graphics-heavy apps that die repeatedly are a classic case. Start at our Windows crash help hub and read the minidump or MEMORY.DMP with the BSOD analyzer.
- Do you upload my .wer file or minidump?
- No. The parse runs in your browser tab, reading the bytes from disk where they already are. Nothing from the file is stored or transmitted, and there is no size limit because we read in byte ranges rather than loading the whole thing.
- What does the optional AI second opinion send?
- Only the short deterministic report text that the parser already produced, never the file and never dump bytes. It is rate limited, it is optional, and the report stands on its own if you leave it switched off or it errors. The privacy page sets out exactly what leaves the browser.
Open your own crash record and see what it says
Drag the .wer file or the app-crash minidump onto the reader. It is free, there is nothing to install, and the file stays on your computer.