WhyCrashed frequently asked questions
Short answers to what people ask us most. Is ntoskrnl.exe the cause of a BSOD? Usually not. Do we upload your dump? Never. Every file is parsed in your own browser.
Three steps
What happens when you drop a dump file
Most questions on this page come down to how the reader works. Here is the whole sequence, start to finish.
Drop the file
You pick the minidump, MEMORY.DMP, .wer file, certificate or .reg file from your own disk. The browser reads it on a background thread using byte-range reads, so only the parts the parser needs are touched. Nothing is copied to a server.
Read the verdict and the evidence
You get a plain sentence about what crashed, a fix plan, and every observation with the source field it came from. Where the evidence is thin, the confidence drops and the report says so instead of guessing a driver.
Take the report with you
Copy, download or print it as Markdown or plain text, then paste it into a forum thread or a support ticket. That copy is text only, so you are not handing your dump to anyone.
03
How we work
A clear path from first conversation to finished work.
BSOD Dump Analyzer
Read a blue-screen minidump or MEMORY.DMP in the browser. Returns the stop code, the blamed driver, a fix plan and the evidence behind it, and explains why ntoskrnl.exe is usually the victim rather than the root cause.
WER and App Crash Reader
Open Windows Error Reporting files and app-crash minidumps to find the faulting module and exception code. Explains that a .wer file is a summary, not a full dump.
Certificate Decoder
Decode SSL and X.509 certificates, CSRs, keys and PFX files to show subject, issuer, expiry, SANs and fingerprints. Works offline, so there is no revocation check and the issuer signature is not proven against a trusted root.
.reg File Viewer
Read a registry file before you run it, with the keys, value types and locations laid out in plain language. Never stamps a file safe, and notes that a merge cannot be undone.
We would not send our own crash dump to a stranger, so we never ask you to send yours. The file is read on your machine, and the verdict comes from the parser and the reference library, not from a chatbot having a guess.
Five tools
Which reader answers your question
Each tool handles one kind of file and says openly what it cannot tell you.
05 — Common questions
Is ntoskrnl.exe the cause of a BSOD?
That one comes up more than any other, so it is answered first. The rest cover uploads, size limits, certificates, registry files and what the optional AI step actually sees.
Frequently Asked Questions
- Is ntoskrnl.exe the cause of my blue screen?
- Usually not. ntoskrnl.exe is the Windows kernel, and it is commonly the victim sitting in the stack when a third party driver hands it something invalid. The analyzer looks past that frame for the module that actually misbehaved, and the report names the evidence behind any blame. If the evidence is thin, it lowers the confidence instead of pinning it on a driver to look decisive.
- Do you upload my dump?
- No. The file is parsed in the browser on your own machine and nothing is sent to a server. There is no queue, no stored copy and no shared link to delete afterwards. That rule holds for dumps, .wer files, certificates, keys, registry files and unknown files alike.
- Is there a file size limit?
- No. Reads are byte-range, so the parser seeks to the structures it needs rather than loading the whole file into memory. A 16 GB MEMORY.DMP is handled the same way as a 300 KB minidump. Very large files take a little longer to walk, but nothing has to be trimmed or split first.
- Can you check whether a certificate has been revoked?
- Not offline. The decoder runs in your browser, so it cannot reach a CRL or an OCSP responder. The issuer signature is not proven against a trusted root either. Treat the decode as a field reading: subject, issuer, expiry, SANs and fingerprints as they are written in the file, not a verdict on trust.
- Is a .reg file safe because WhyCrashed viewed it?
- No. The viewer shows the keys, the value types and the locations so you can decide for yourself what the file would change. It never stamps anything safe. Remember that a merge cannot be undone, so if a line touches somewhere you do not recognise, do not run it.
- Does WhyCrashed use AI to work out the answer?
- No. The verdict is deterministic, computed by the parser from the file bytes and checked against the reference library. There is an optional explain step for a second opinion in plainer words. It sends only the short report text, never the file, and it is rate limited. Turn it off and the full report still stands on its own.
- Do I need to install anything or create an account?
- No install is needed to use the tools, and there is no account to make. You open the page you need, drop the file and read the report. Nothing is left behind on the machine except the copy of the report you choose to save.
- Is WhyCrashed affiliated with Microsoft?
- No. We are an independent set of browser-based readers for Windows files. Windows is a trademark of Microsoft Corporation. Driver pages in the reference library point to vendor download URLs only, never to third party driver-pack sites.
- Can I share the report?
- Yes. Copy, download or print it as Markdown or plain text and paste it into a forum thread or a support ticket. It carries the verdict, the fix plan and the observations with their source fields, so whoever helps you can see the reasoning without ever touching your dump.
Drop the dump and read the evidence
Have the stop code in front of you in a minute, with the blamed module and the reasoning laid out. If a question here did not cover your case, send it to us and we will answer it.