Safety review
Is Win11Debloat safe?
Yes, as long as you get it from the official source and read what you select. Win11Debloat is open-source PowerShell. It sends no data anywhere and installs nothing, and it backs up before it changes anything. Its real risks come from the choices you make: removing an app something else depends on, or locking a setting with a policy. Here is the evidence, from the source code and from our own runs on Windows.
On this page 8 sections
Verdict
Is Win11Debloat a virus, and is it safe to use?
- Not malware. The official script at
github.com/Raphire/Win11Debloatis fully readable PowerShell under the MIT license. It has 32 contributors and has been public since October 2020. - No hidden network activity. Only the launcher downloads anything, and only from GitHub. The script itself makes no web requests. When you list or remove WinGet apps, it calls Microsoft's own
wingettool. - Reversible. It saves a registry backup and a restore point first. App removals are undone by reinstalling from the Microsoft Store.
- The real risks are removing "unsafe"-rated apps, policy locks that show managed by your organization, and side effects like Windows Search changes. All of these are avoidable.
Safety scorecard
| Check | Result | How we checked |
|---|---|---|
| Source code public | Yes, all of it | 2026.08.24 is 403 files: PowerShell scripts, .reg files, XAML layouts and JSON config. No executables: the only non-text files are one screenshot and one Start menu template. |
| License | MIT | LICENSE in the repository |
| Actively maintained | Yes | 30 releases from September 2025 to August 24, 2026. Last commit October 29, 2026. 423 issues filed, 34 open on October 30, 2026. |
| Automated tests | Yes | 51 files in its Tests folder, run by a Pester workflow in Windows PowerShell 5.1 on every pull request |
| Code-signed | No | Win11Debloat.ps1 has no signature block. Check it by source and hash instead. Hashes |
| Sends data anywhere | No | No upload or analytics code in the source. Our DNS capture showed GitHub hosts only. |
| Installs anything | No | No service, scheduled task or startup entry is added. Only optional Windows features (Sandbox, WSL) can be switched on, and only if you ask. |
| Backs up first | Yes | A registry backup of every value it will change, plus a system restore point. The backup was made in every test run, and the restore point in every Windows 11 run. |
| Dry-run mode | Yes, undocumented | -WhatIf prints [WhatIf] … for each change instead of making it |
Everything it can change on your PC
Win11Debloat works through five mechanisms, and nothing else. This is the full list from the 2026.08.24 source:
| What | How | Scope | Undo |
|---|---|---|---|
| Registry settings | Imports the project's .reg files: 89 tweaks, about 200 values in total | Your user (HKCU) and the PC (HKLM). 27 tweaks write Group Policy keys. | Regfiles\Undo\*.reg, or the registry backup |
| Apps | Remove-AppxPackage and Remove-ProvisionedAppxPackage; winget uninstall for 3 apps | Current user or all users. "All users" also removes the app from the Windows image. | Reinstall from the Microsoft Store or winget |
| Scheduled tasks | Disables 8 telemetry tasks, such as Microsoft Compatibility Appraiser and Consolidator | PC | Enable them again in Task Scheduler |
| One service | Sets WSAIFabricSvc (the AI service) to Manual. It is not disabled. | PC | Undo file, or set it back to Automatic |
| Files | Start menu layout (only if you clear or replace pinned apps), the Edge uninstaller (only with -ForceRemoveEdge), and its own logs, backups and settings | User or PC | Start menu backup via Restore backup |
It does not touch Microsoft Defender, the firewall, Windows Update services, drivers, the boot configuration or your files. On our Windows 11 25H2 test machine, Default mode changed exactly 61 registry values, removed 17 app packages, and changed one service's start type. The full diff.
What it connects to
We cleared the Windows DNS cache, ran the official one-liner, and listed every host name that was looked up afterwards. The hosts the launch needed:
debloat.raphi.re: the project's short address, served by Cloudflare. It answers with an HTTP 301 redirect to GitHub.github.com,release-assets.githubusercontent.com: theGet.ps1launcher file attached to the release.api.github.com,codeload.github.com: the latest release's details and its source ZIP.
Our Windows 11 machine also looked up Microsoft Office hosts during that time. Nothing in Win11Debloat's source refers to them, so they are most likely Windows' own background traffic. The script itself, Win11Debloat.ps1 and its helpers, has no web requests. Its only links open in your browser when you click Documentation, Report a bug, About or the Ko-fi heart. To list installed apps, and to remove Copilot, Edge and OneDrive, it runs Microsoft's winget, which talks to Microsoft's package sources.
Why antivirus tools and sandboxes flag it
Some security tools warn about Win11Debloat, and one public sandbox report labels a run of it "malicious activity". Here is why that happens, behaviour by behaviour:
| Behaviour | Why it looks suspicious | Why Win11Debloat does it |
|---|---|---|
Downloads and runs a script with irm … | scriptblock | The classic "download and execute" pattern used by malware loaders | It is the one-line launcher. The ZIP method avoids it. |
-ExecutionPolicy Bypass | It skips PowerShell's script policy | Windows blocks unsigned downloaded scripts by default |
| Asks for administrator rights | Elevation is what malware wants | Removing apps for all users and writing HKLM require it |
Writes to HKLM\SOFTWARE\Policies | Policy keys can disable security features | Turning off telemetry, Copilot and Recall is done through policies. None of them touch Defender. |
| Removes apps and stops processes | It looks like tampering with the system | That is the job: removing apps, and closing Widgets before removing it |
A flag is not proof of anything either way. If your antivirus blocks it, check that your copy matches the published hashes before you allow it. Do not switch off your antivirus for a copy you got from anywhere other than the official repository.
The real risks, ranked
These come from the project's own issue tracker, sorted by how many people discussed them. Each links to the fix.
- Removing an app something else depends on. The project rates 7 apps "unsafe": the Microsoft Store, Edge, Get Help, Windows Terminal, and the Xbox identity provider, speech overlay and TCUI framework. The project describes the Xbox identity provider as required for some games and Xbox services, so removing it can break Xbox sign-in in games. Removing Get Help disables the built-in troubleshooters. Default mode selects none of the seven. Check an app.
- Windows Search or Start behaving differently (issue #361, the most-discussed issue ever, and #830). Turning off Bing in search changes what search returns. Some users also report search breaking entirely. Fixes.
- "Some settings are managed by your organization." This is expected after 27 policy-based tweaks, 8 of them in Default mode, and it locks those toggles in Settings. How to clear it.
- Unrelated problems blamed on the script. Issues about audio drivers, webcams, fullscreen flicker or copy-paste are mostly labelled unconfirmed or cannot reproduce by the maintainers. Rule them out with the registry backup before assuming.
- No restore point. If System Protection is off, Win11Debloat turns it on and makes one. Only if that fails, as on Windows Server, does it ask whether to continue. The registry backup is still made.
- Work and school PCs. Policies set by Win11Debloat can conflict with your organization's Intune or Group Policy settings. Ask your IT team first.
The biggest risk: a copy that is not Win11Debloat
The official project has no .exe, no installer and no app-store package. Copies under other GitHub accounts, download portals, translated "CN" builds and executables named Win11Debloat cannot be checked against the source. A separate PowerShell tool called "Windows Toolbox" was reported by Neowin to contain malicious files; it is unrelated to this project. The full list of copies to avoid.
Check it yourself in five minutes
Download the ZIP instead of using the one-liner
That way you can read everything before anything runs. How.
Compare the hash
Run
Get-FileHash .\Win11Debloat.ps1and compare the result with our table.Read the .reg files for the tweaks you want
They are plain text in the
Regfilesfolder, with a comment above each key. Our tweak reference shows them in readable form.Do a dry run
Run the script with
-WhatIf, for example.\Win11Debloat.ps1 -RunDefaults -WhatIf. Every change is printed as[WhatIf] …and nothing is applied.Keep the backups on
Leave Create a registry backup and Create a system restore point ticked, so you can always go back.
Questions
Is Win11Debloat a virus?
No. The official script is open-source PowerShell that anyone can read, published by Raphire on GitHub under the MIT license. Antivirus warnings come from generic behaviour, such as downloading a script, asking for admin rights and editing policies, not from known malware. Copies from other sources are a different matter.
Is Win11Debloat safe according to Reddit?
Community opinion on Reddit and forums such as ElevenForum is broadly positive, with the same caveats as on this page. Use the official source, keep the defaults unless you know what an app does, and make a restore point. Most negative reports trace back to removing apps with a red rating, or to tools mixed up with Win11Debloat.
Does Win11Debloat collect or send my data?
No. There is no telemetry, analytics or upload code in the script. Its purpose is the opposite: it turns down Windows' own telemetry. The only network traffic comes from the launcher, which downloads from GitHub, and from winget when you remove the few apps that need it.
Can Win11Debloat break Windows?
It can break specific features if you remove what they depend on. Examples are the Microsoft Store, Edge, the Xbox identity components and Get Help. It does not touch system files, drivers or boot settings, so it cannot stop Windows from starting. If something you need stops working, restore the registry backup and reinstall the removed app.
Is it safe to use on a work or school PC?
Only with your IT department's approval. Its policy-based tweaks can conflict with your organization's management, and removing apps like Teams can stop you from working.
Should I trust the one-line command?
The official one is & ([scriptblock]::Create((irm "https://debloat.raphi.re/"))), and it only fetches from the project's GitHub releases. Never run a variant that points to another domain. If you prefer to read before running, use the ZIP.
Keep going
Something wrong or out of date? Email hello@win11debloat.dev and we will fix it.