PowerToys is Microsoft's collection of extras for Windows, over 30 utilities that fill the gaps in the operating system. FancyZones snaps windows into custom layouts, PowerRename renames files in bulk with regular expressions, Text Extractor copies text from anything on screen, Peek previews files with a keypress, Color Picker grabs any pixel's color, Keyboard Manager remaps keys, and Mouse Without Borders shares one keyboard and mouse across several PCs. Command Palette, the successor to PowerToys Run, is a launcher you can extend.
It is on this list because a few of those tools now use AI. Advanced Paste can turn whatever is on your clipboard into Markdown, JSON or plain text, and its optional AI actions rewrite, summarize or translate the clipboard through a model you configure, either a cloud provider with your own key or a local model. The rest of the suite works with no AI at all.
PowerToys is developed by Microsoft in the open under the MIT licence and, at about 139,000 stars, is one of the most-starred repositories on GitHub. Releases arrive roughly monthly; the latest, 0.101, came out in August 2026.
- Repository: github.com/microsoft/PowerToys
- Licence: MIT (MIT License)
- Language: C. Stars: 139.2K. Forks: 8,627. Last push: Oct 3, 2026.
- Scan: safe, Oct 2, 2026, commit 1400fd8
Who it is for
Anyone who spends the working day on Windows and wants better window management, file handling and keyboard control without buying a stack of separate utilities.
Getting started
1. Install with WinGet, for the current user (add --scope machine for all users)
winget install Microsoft.PowerToys -s winget2. Or download the x64 per-user installer from GitHub releases (Microsoft Store, Chocolatey and Scoop also work)
start https://aka.ms/installPowerToys3. Open the PowerToys settings from the tray icon and turn on the utilities you want
# PowerToys tray icon > Settings > enable FancyZones, Advanced Paste, Command Palette...PowerToys logs basic diagnostic data to Microsoft by default; the privacy documentation linked from the README describes what is collected. The AI actions in Advanced Paste send clipboard contents to whichever model provider you set up.
Safety scan
We cloned microsoft/PowerToys at commit 1400fd8 on Oct 2, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets and no bare-IP URLs across about one million lines of C# and C++ in 9,208 files. 26 of the 27 pattern hits are minified language files from the Monaco code editor, which PowerToys bundles to preview source files; the 27th is a comment in FancyZonesCLI/Program.cs explaining how PowerShell encodes a script block, not code that does it.
- The one committed binary is MicrosoftEdgeWebview2Setup.exe (1.8 MB), Microsoft's WebView2 runtime bootstrapper, bundled with the installer. Six of the eight installer scripts are CI and UI-test helpers; the other two install PowerShell 7 and the WinGet client module from aka.ms, nuget.org and the PowerShell Gallery, and run only when you enable the Command Not Found feature that needs them.
- Three workflows run on pull_request_target (pr-intake, spelling2 and telemetry-pr-check). pr-intake explicitly checks out the default branch, telemetry-pr-check uses the default checkout, which is the base branch, and the spelling job runs with restricted permissions; none executes code from the pull request. All 8 third-party actions are pinned to commits.
- Dependencies are NuGet packages without a lockfile the scanner reads, so there is no advisory count; Dependabot is enabled. Telemetry is reviewed in the open: a dedicated workflow flags any pull request that adds a telemetry event.
- Security policy, Dependabot, licence, contributing guide and code of conduct present; no CodeQL workflow in the repository. OpenSSF Scorecard 6.2.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 27 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 8 installer scripts |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 10 workflows. 3 use pull_request_target, none check out the pull request head. 0 of 8 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, learn.microsoft.com, aka.ms, stackoverflow.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has security policy, automated dependency updates, licence file, contributing guide. Missing CodeQL. |
| OpenSSF Scorecard | 6.2 out of 10, as of Sep 28, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (27)
Installer scripts (8)
- .github/skills/ui-tests-local-vm/templates/run-ui-tests.ps1, 511 lines
- .github/skills/ui-tests-local-vm/templates/vm/Start-LocalVm.ps1, 171 lines
- .pipelines/InstallWinAppCli.ps1, 72 lines; talks to github.com
- .pipelines/InstallWinAppDriver.ps1, 16 lines; talks to github.com
- .pipelines/installPowertoys.ps1, 52 lines
- .pipelines/runUiTestAsUser.ps1, 293 lines
- src/settings-ui/Settings.UI/Assets/Settings/Scripts/InstallPowerShell7.ps1, 82 lines; talks to aka.ms, www.nuget.org
- src/settings-ui/Settings.UI/Assets/Settings/Scripts/InstallWinGetClientModule.ps1, 56 lines; talks to www.powershellgallery.com
Committed binaries (1)
installer/PowerToysSetupVNext/WebView2/MicrosoftEdgeWebview2Setup.exe: PE (Windows executable), 2 MB
Workflows worth a look
- .github/workflows/pr-intake.yml: pull_request_target
- .github/workflows/spelling2.yml: pull_request_target
- .github/workflows/telemetry-pr-check.yml: pull_request_target
By the numbers
| Stars | 139.2K |
|---|---|
| Forks | 8,627 |
| Contributors | 690 |
| Commits | 9,758 |
| Open issues | 7,546 |
| Open pull requests | 139 |
| Releases | 141 |
| Latest release | v0.101.2362.0 |
| Licence | MIT |
| Main language | C |
| Project age | 7 years |
| Last push | Oct 3, 2026 |
| Tracked files | 9,208 |
| Lines of code | 1M |
| Checkout size | 207 MB |
Lines by language: C# 623.1K, C++ 180K, C/C++ header 82.8K, Markdown 51K, YAML 35.5K, PowerShell 21.4K.
Questions
Is PowerToys free?
Yes. PowerToys is MIT-licensed and free, with no paid tier. The only possible cost is the optional AI part of Advanced Paste, which uses a model provider you configure: a cloud API bills you per use, while a local model costs nothing.
Is PowerToys safe to install?
It is an official Microsoft project, built in public on GitHub and distributed through GitHub releases, WinGet and the Microsoft Store. It does send basic diagnostic telemetry by default, documented in its privacy statement. See the scan notes below for what we found in the code.
What is the difference between PowerToys Run and Command Palette?
Both are keyboard launchers for apps, files, calculations and commands. PowerToys Run is the original, opened with Alt+Space. Command Palette is its newer successor, opened with Win+Alt+Space by default, and is built to be extended: third-party extensions add commands, and the roadmap adds tabs and JavaScript and TypeScript extensions.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.