Ventoy turns a USB drive into a boot menu. You install it on the stick once; after that you copy ISO, WIM, IMG, VHD(x) or EFI files onto it like any other files, and at boot Ventoy lists them and starts whichever you pick. There is no extracting and no reformatting per image, so one stick can carry a Windows installer, a few Linux distributions and a rescue disk at the same time.
It works with legacy BIOS and UEFI (x86, ARM64 and MIPS64EL), MBR and GPT disks, and Secure Boot, and the project says more than 1,300 images have been tested. Extras include persistence for Linux live systems, unattended Windows and Linux installs, and VentoyPlugson, a graphical editor for its plugin settings. The stick stays usable for ordinary files too.
Ventoy is GPL-3.0, written mostly in C, with about 80,000 stars, at v1.1.18 when scanned. Installing it wipes the target drive, so pick the device carefully; later upgrades keep your files.
- Repository: github.com/ventoy/Ventoy
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: C. Stars: 80.4K. Forks: 5,008. Last push: Oct 22, 2026.
- Scan: safe, Oct 26, 2026, commit 74cff34
Who it is for
Anyone who installs or repairs operating systems: IT staff, people trying out Linux distributions, and anyone who keeps a rescue USB and is tired of rewriting it for every new image.
Getting started
1. Windows: download the release zip from GitHub, extract it, run the installer and pick your USB drive
Ventoy2Disk.exe2. Linux: from the extracted release folder, install to a drive (replace sdX with your USB device; this erases it)
sudo sh Ventoy2Disk.sh -i /dev/sdX3. Linux, with a browser-based interface instead
sudo sh VentoyWeb.shReleases are on github.com/ventoy/Ventoy/releases and ventoy.net. Once installed, copy your ISO files to the large partition on the stick and boot from it. With Secure Boot on, the first boot asks you to enroll Ventoy's key once.
Safety scan
We cloned ventoy/Ventoy at commit 74cff34 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no bare-IP URLs across about 386,000 lines, mostly C with shell scripts.
- 170 committed binaries: EFI boot loaders plus the shim and MOK manager used for Secure Boot (INSTALL/EFI/BOOT), the Ventoy2Disk installers for Windows and Linux, and tools such as busybox, unsquashfs, zstd and dmsetup that run inside the boot environment. That is how Ventoy is packaged, and DOC/BuildVentoyFromSource.txt describes rebuilding them, but you are trusting that the committed files match the source.
- The three installer scripts are build helpers (setting up the dietlibc and musl toolchains, and GRUB's own install.sh). None uses sudo or pipes to a shell.
- No lockfiles, so the advisory check had nothing to read; third-party code such as GRUB, xz and zstd is vendored in the tree.
- Only 2 workflows, none using pull_request_target, and the one third-party action is not pinned. No security policy, contributing guide, Dependabot or CodeQL; OpenSSF Scorecard 2.6 of 10, mostly for missing process rather than anything found in the code.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 3 installer scripts |
| Committed binaries | 170 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 2 workflows. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often www.gnu.org, github.com, 7-zip.org, opensource.org. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | 2.6 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (3)
- DOC/installdietlibc.sh, 37 lines
- DOC/installmusl.sh, 21 lines
- GRUB2/MOD_SRC/grub-2.04/install.sh, 140 lines
Committed binaries (170)
LiveCD/ISO/EFI/boot/vmlinuz64: PE (Windows executable), 5 MBLiveCD/GRUB/bootx64.efi: PE (Windows executable), 1 MBLiveCDGUI/GRUB/bootx64.efi: PE (Windows executable), 1 MBLiveCDGUI/EXT/busybox-x86_64: ELF, 1 MBINSTALL/EFI/BOOT/BOOTX64.EFI: PE (Windows executable), 1 MBINSTALL/tool/mips64el/Ventoy2Disk.gtk3: ELF, 924 KBINSTALL/EFI/BOOT/mmx64.efi: PE (Windows executable), 879 KBINSTALL/EFI/BOOT/BOOTIA32.EFI: PE (Windows executable), 742 KBUnix/ventoy_unix/DragonFly/sbin/init: ELF, 683 KBINSTALL/EFI/BOOT/mmia32.efi: PE (Windows executable), 679 KBINSTALL/Ventoy2Disk_X64.exe: PE (Windows executable), 648 KBINSTALL/Ventoy2Disk_ARM64.exe: PE (Windows executable), 639 KBIMG/cpio_arm64/ventoy/tool/zstdcataa64: ELF, 633 KBZSTD/zstdcataa64: ELF, 633 KBINSTALL/Ventoy2Disk.exe: PE (Windows executable), 604 KBcryptsetup/veritysetup32: ELF, 597 KBINSTALL/Ventoy2Disk_ARM.exe: PE (Windows executable), 578 KBSQUASHFS/unsquashfs_64: ELF, 521 KBUnix/ventoy_unix/DragonFly/sbin/dmsetup: ELF, 489 KBSQUASHFS/unsquashfs_aa64: ELF, 463 KBPlugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe: PE (Windows executable), 461 KBSQUASHFS/unsquashfs_32: ELF, 384 KBINSTALL/tool/i386/Ventoy2Disk.gtk2: ELF, 373 KBINSTALL/tool/i386/Ventoy2Disk.gtk3: ELF, 373 KB- and 146 more
By the numbers
| Stars | 80.4K |
|---|---|
| Forks | 5,008 |
| Contributors | 136 |
| Commits | 1,241 |
| Open issues | 893 |
| Open pull requests | 116 |
| Releases | 116 |
| Latest release | v1.1.18 |
| Licence | GPL-3.0 |
| Main language | C |
| Project age | 6 years |
| Last push | Oct 22, 2026 |
| Tracked files | 1,964 |
| Lines of code | 386.2K |
| Checkout size | 101 MB |
Lines by language: C 274.6K, C/C++ header 52.9K, Shell 20K, CSS 14K, HTML 8,508, JSON 6,556.
Questions
Is Ventoy free?
Yes. Ventoy is free and open source under GPL-3.0, with no paid edition, ads or account.
Will Ventoy erase my USB drive?
Installing it does: everything on the drive is wiped. After that you add and remove ISO files like ordinary files, and upgrading Ventoy to a newer version keeps them. Double-check the device name before installing, especially with the Linux command.
Does Ventoy work with Secure Boot?
Yes, on x86 UEFI machines. The first time you boot the stick with Secure Boot on, you enroll Ventoy's key through a one-time blue screen, and after that it boots normally. Older PCs with legacy BIOS work too.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.