Is PortWho free?
Yes. Every Utility Forge tool is free: a complete, useful product rather than a trial, with no paid edition, subscription, account or activation. The license under which it will be published has not been announced yet.
Does PortWho change anything on my system?
No. PortWho is read-only. It never stops processes, never touches sockets or services, and never writes to files or the registry. It reads the endpoint tables, process information, the service list and, for the signature check, the executable files on disk. See Security and privacy.
Does it need administrator rights?
No. PortWho runs as a normal user and never asks for elevation. Some processes, typically protected ones or ones running with higher privileges, refuse to be opened; PortWho then shows the process name with (access denied), without the executable path or a signature verdict, and explains why in the details view. See Troubleshooting.
Does it send data anywhere?
No. PortWho makes no network connections. Even the Authenticode check is deliberately offline: revocation checking is disabled and certificate chains are built only from what is cached on the machine. There is no telemetry, no account and no update check in the current command line.
Can it kill the process that owns a port?
Not currently. PortWho answers who owns the port; what you do next is up to you. The project’s Blueprint allows stopping a process to exist later only as a secondary, explicitly confirmed action, never as the primary workflow. Any such feature will be documented before it ships, and it will be labeled as planned until then.
Where is the graphical application?
The WPF desktop application, PortWho.exe, is implemented and tested internally but not released. It uses the same read-only engine as the command line and adds a port lookup box, filters, a details pane that explains the bound address and restricted processes, background signature checks, JSON and CSV export, and light, dark and contrast themes. Like the command line, it is built from source today, and the source repository is private during development. See the Quick start.
How do I download and verify PortWho?
There is no public download yet: no installer, no portable archive, no release. When releases begin, each one will be published on an immutable release path with a published SHA-256 checksum and will say before download whether it is signed. The first release may be unsigned only after an independent rebuild and review and the owner’s approval; Windows would then show no verified publisher and may warn about or block it. The security page describes how to verify a download. Until then there is nothing to download; building from source needs access to the private repository.
Where do I report problems?
The support page lists the current channels; include the exact command, the output and your Windows version. There is no public issue tracker while the repository is private. For security vulnerabilities, follow the security page.
Which Windows versions are supported?
PortWho is built on .NET 10 (net10.0-windows) and packaged as self-contained single-file executables in a portable ZIP, so no .NET runtime has to be installed. Internal packages have been run only on Windows 11 x64. .NET 10 itself supports Windows 11 and, among Windows 10 releases, only the Enterprise and LTSC editions, so in practice a Home or Pro PC needs Windows 11. Arm64 packages are built but have never been run, so Arm64 is not claimed yet. Building from source needs the SDK version pinned in global.json.
Why does the same UDP row appear twice?
Because Windows reports it twice. Two UDP sockets that share an address and port through SO_REUSEADDR are two sockets, and PortWho deliberately shows rows exactly as the IP Helper tables return them rather than merging them.
Why does PortWho not show established TCP connections?
PortWho enumerates listening TCP sockets and bound UDP sockets, which is what “who owns this port” means. Established and closing connections are out of scope for the current command line; Get-NetTCPConnection or netstat -ano show them.
Is the JSON output stable enough to build on?
Yes, within schema version 1. Field names and the spellings of protocol, addressFamily, process.status and signature.status are a contract, and incompatible changes bump schemaVersion. See JSON output.