Is ExplorerPatcher safe?

The verdict, with conditions

What it does to your PC

We installed 71.1 on two machines and compared file, registry, service and scheduled task lists before and after: Windows 11 Enterprise 25H2 on Arm64 and Windows Server 2025 (24H2 shell). Both showed nearly the same footprint, apart from CPU-specific file names.

Two details that matter:

• EP also copies Windows 10 era components. pnidui.dll in the program folder and StartUI_.dll and JumpViewUI_.dll in the Start menu folder are files that upstream’s build project downloads from Microsoft’s public symbol server when it builds the setup (ep_setup.vcxproj). We matched the names, not the contents.
• A service can appear later. The rounded corners switch installs a small service (ep_dwm_svc) when you turn it on in the Properties window, per the source. We did not turn it on in this test, so a default install has none.

The screenshot below is Settings after an uninstall; the ExplorerPatcher entry is gone from the list.

What it sends over the network

After each install we compared the DNS cache before and after. A DNS cache only lists the names looked up, not what was sent. It also includes lookups made by Windows and by our own test script, which downloaded the setup from GitHub, so we cannot assign every name to EP.

Nothing in that list looked unexpected to us, but this is a weak test. For a firmer answer we read the source (ExplorerPatcher 71.1 ExplorerPatcher, ep_gui, ep_setup, ep_weather_host) for every web address. The runtime connections are:

The limit of this check: ExplorerPatcher’s taskbar DLL (ep_taskbar) is a binary. The wiki says its source cannot be published “for legal reasons”, so we could not read it. Several parts live in separate repositories (git submodules) that were empty in the copy of the source we read: libvalinet, sws (the Simple Window Switcher), zlib, ep_dwm and ep_starttiledata. Our statement is therefore “no tracking address in the code we could read”, not a full audit.

Upstream’s wiki says: “The code does not have any kind of telemetry built-in.” It also explains that the update check increments GitHub’s public download counter, which is why that counter (82,981,120 downloads on 6 Nov 2026) is not a user count.

Why antivirus programs flag it

ExplorerPatcher changes Explorer’s code and memory and puts a DLL named dxgi.dll into C:\Windows. Upstream’s own explanation, from its May 2025 release notes: this is “similar to how some game cheats operate”. Detections are heuristic, not matches to a known virus. Microsoft Defender flagged releases in 2024; upstream says Defender stopped flagging it in October 2025 (release 69.4), and our Defender scans of 71.1 found nothing. The whole timeline, including detections that were still reported in 2026, is on the antivirus page.

Real risks

1. Windows updates break it. The biggest cluster of problems upstream is crashes after a Windows update. One example: build 26220.8474 made the 10 taskbar and Start menu crash; the issue “ExplorerPatcher crashes with Windows 11 build 26220.8474” was opened on 16 May 2026 and drew 184 comments (issue 4957). Release 70.1 of 19 May 2026 lists a fix. Upstream says it “typically” releases a fix within a day, but you may be stuck until then. See Windows update status.
2. It loads into core Windows processes. The loader runs in explorer.exe, StartMenuExperienceHost.exe and ShellExperienceHost.exe. A bug in EP is a bug in your desktop. After Explorer has quit three times within seconds of starting, EP switches itself off at the next start (details in how it works).
3. The shell extension option is wider. “Register as shell extension” (off by default) loads EP into every program that shows an Open or Save dialog. The wiki warns that this can make recovery harder.
4. It is not code-signed. We checked the signature of every setup file we downloaded: “NotSigned”. The GitHub release is built by GitHub’s infrastructure according to the wiki, and the hash on our page lets you verify the download, but Windows cannot tell you who published it.
5. The taskbar code is closed. The reimplemented taskbar (ep_taskbar) ships as a binary. The main program’s source is public under GPL-2.0.
6. A small team. The contributor list shows two people with 685 and 371 contributions and none above four after that. GitHub shows 104 releases in 2022 and 9 in 2025 (counting pre-releases).
7. Microsoft is not on your side. In 2024 the Windows 11 24H2 setup blocked ExplorerPatcher with a “security or performance issues” message, which a later release worked around (Neowin).

Fake and lookalike sites

The release notes say that GitHub is the only official distribution channel. We opened each of these on 6 Nov 2026:

If you already downloaded a file somewhere else, do not run it. Check it with the Download Verifier; if the hash does not match any release, delete it.

Privacy in plain words

• No account, no login, no analytics in the part we could read. EP stores settings in HKCU\Software\ExplorerPatcher.
• Updates. With the default “Notify about available updates”, EP checks GitHub’s latest release when Explorer starts. You can set “Do not check for updates” in Properties, Updates. GitHub sees your IP address, as any website would.
• Weather. Off by default. When on, EP’s helper (ep_weather_host, run in a separate process) shows a cropped Google search page inside Microsoft’s WebView2. If the location field is empty, upstream says the location comes from your IP address. Browser data is kept in %APPDATA%\ExplorerPatcher\ep_weather_host.
• Symbols. The download is from Microsoft and asks for files that match your Windows build. You can switch it off under Advanced, but upstream does not recommend it.

Performance, with the method

We measured Explorer on two virtual machines with the same method: restart Explorer, wait 45 seconds, then sample for 30 seconds. We did this before installing EP and with each taskbar style.

What the numbers allow us to say: there is no meaningful cost for Explorer’s own memory, and a restart with the EP taskbar took about the same time as with the Windows 11 taskbar (within about 0.3 s). What they do not allow:

• The memory is the working set of explorer.exe only, not of the Start menu host, tray flyouts or the weather helper.
• Two virtual machines on GitHub’s runners, with no real apps, GPU, second monitor or user. Our two runs differed from each other by up to about 30 MB, so differences of that size are noise. The 111 MB result on Windows Server 2025 is lower than the baseline; we cannot explain it and do not claim that EP saves memory.
• We timed restarts only with EP installed, not before installing it.
• We did not measure battery, gaming or logon time.

How to undo it

1. Uninstall. Properties, Settings and uninstall, “Uninstall ExplorerPatcher”; or Settings, Apps; or ep_setup.exe /uninstall. In our test the two dialogs appeared and the Windows 11 taskbar was back after 15 s (Windows Server 2025) and 22 s (Arm64). Our uninstall guide has the details.
2. What stays. The settings key HKCU\Software\ExplorerPatcher stayed on both machines, by design: reinstalling keeps your settings. On Arm64 we also found %APPDATA%\ExplorerPatcher\cleanup\*.tmp. The cleanup script on the uninstall page removes both.
3. If the screen is black. Follow the black screen guide. We tested the Ctrl+Alt+Shift method: Explorer started with the Windows 11 taskbar (48 px) and EP off, along with EP’s own crash message.
4. Before you install. A system restore point or a backup is a sensible extra step. We did not test restore points.

For the methods behind these tests, see how we test.

More short answers are in the ExplorerPatcher FAQ.