Registry Parser

Registry Parser

Drop hives below. Everything is parsed locally in your browser — no upload, no server.

100% client-side · files never uploaded

No hive loaded yet.

Forensic Windows Registry analysis in your browser

Registry Parser is a free, browser-based forensic tool for analyzing Windows Registry hives. Drop an NTUSER.DAT, SOFTWARE, SYSTEM, SAM, SECURITY, USRCLASS.DAT or Amcache.hve file and it parses the hive entirely on your own machine — nothing is uploaded to a server.

It runs more than 140 RegRipper-style plugins over the loaded hives, extracting execution, persistence, USB, network, account and user-activity artifacts, then merges every timestamped result into a single forensic timeline. Because the parser is compiled to WebAssembly and runs client-side, it works offline on Windows, macOS and Linux without installing anything.

What Registry Parser does

  • Drag-and-drop hive parsing — NTUSER.DAT, SOFTWARE, SYSTEM, SAM, SECURITY, USRCLASS.DAT and Amcache.hve, parsed locally with hivex compiled to WebAssembly.
  • 140+ RegRipper-style artifact plugins covering program execution, persistence and autoruns, USB devices, networks, local accounts and user activity.
  • A searchable key tree and full-text search across key names, value names and value data.
  • A unified timeline that merges every timestamped artifact into one chronological view, exportable to TLN and bodyfile/mactime.
  • Automated triage findings that flag high-risk configurations from the parsed artifacts.
  • One-click export to JSON, CSV, a Markdown or HTML forensic report, or PDF.

Supported registry hives

  • NTUSER.DAT — per-user activity: UserAssist, RecentDocs, TypedPaths, Run keys, MountPoints2 and more.
  • SOFTWARE — installed programs, network profiles, scheduled tasks, Winlogon and machine-wide persistence.
  • SYSTEM — services, AppCompatCache (ShimCache), BAM/DAM, USBSTOR, time zone and control-set selection.
  • SAM — local user accounts, RIDs, login counts and group membership.
  • SECURITY — LSA secrets, cached credentials and audit policy.
  • USRCLASS.DAT — ShellBags and MUICache on modern Windows.
  • Amcache.hve — file inventory with SHA-1 hashes and first-seen timestamps.

Frequently asked questions

Is Registry Parser free, and are my files uploaded anywhere?
Yes, it is free, and no files are ever uploaded. Every hive is parsed entirely in your browser using WebAssembly, so the files never leave your machine. That makes it safe to use on evidence and sensitive data.
Which Windows Registry hives can I analyze?
NTUSER.DAT, USRCLASS.DAT, SOFTWARE, SYSTEM, SAM, SECURITY and Amcache.hve. You can load several at once — for example a user's NTUSER.DAT alongside SYSTEM and SOFTWARE — and artifacts are correlated across them.
Is this a browser-based RegRipper alternative?
Effectively, yes. Registry Parser runs more than 140 plugins modelled on RegRipper's, extracting the same artifacts, but it runs in any modern browser with no Perl, no installation and no command line. It is a fast way to triage a hive when you cannot install tooling.
How do I open an NTUSER.DAT file?
Drag the NTUSER.DAT file onto the drop zone above, or click to browse. The hive is parsed locally and you can immediately explore its key tree, run every artifact plugin and build a timeline.
Does it work offline and on macOS or Linux?
Yes. The parser is compiled to WebAssembly and runs entirely client-side, so it is operating-system independent and keeps working with no network connection once the page has loaded.
What forensic artifacts does it extract?
Program execution (UserAssist, AppCompatCache/ShimCache, Amcache, BAM/DAM), persistence and autoruns (Run keys, services, scheduled tasks, Winlogon), USB device history, network connection history, local accounts, and user activity such as RecentDocs and ShellBags.

Read deep-dives on individual artifacts and RegRipper plugins on the Registry Parser blog.