The CrashDecoder crash log reader
A free script that reads your Windows event log and tells you, in plain English, what has actually been going wrong - then links each finding to the page explaining it.
Windows already records why it crashed. The information is sitting in Event Viewer right now, spread across half a dozen providers with names like Microsoft-Windows-WHEA-Logger, in messages written for people who already know what they mean. This reads all of it for you and prints a summary you can act on.
- Finds every blue screen Windows recorded, groups them by stop code, and links each one to its page here
- Catches unclean shutdowns that left no stop code - a different and often more serious pattern
- Reports WHEA hardware errors, including the corrected ones that warn you before anything crashes
- Counts display driver timeouts and names the driver involved
- Flags disk and file system errors, and tells you if crash dumps are failing to write
- Lists the dump files you have, so you know whether there is anything to analyse
Download
It is a plain text file. Open it in Notepad before you run it - you should be able to read exactly what it does, and you should not take my word for that. It is about 300 lines with comments explaining each section.
How to run it
- Right-click the Start button and choose Terminal (Admin), or Windows PowerShell (Admin) on Windows 10.
- Change to wherever you saved it, usually:
cd $env:USERPROFILE\Downloads - Run it:
powershell -ExecutionPolicy Bypass -File .\crash-report.ps1
It runs in a few seconds and prints straight to the screen. It works without Administrator, but some log entries are hidden from a normal user, so you will get a fuller picture from an elevated terminal.
Options
| Option | What it does |
|---|---|
-Days 365 | How far back to look. The default is 90 days. |
-Export | Also writes the readout to a text file you can attach to a forum post. |
-Path D:\somewhere | Where to put that file. Defaults to your Desktop. |
For example, a full year written out to a file:
powershell -ExecutionPolicy Bypass -File .\crash-report.ps1 -Days 365 -ExportBy default Windows will not run any PowerShell script you downloaded, including harmless ones. -ExecutionPolicy Bypass on that single command lets this one run without changing any setting on your machine - the policy is unchanged for everything else, and there is nothing to undo afterwards.
You should be wary of anyone telling you to bypass a security control. That is exactly why the script is plain text and short enough to read first.
What it does not do
This matters more to me than the feature list, so it is stated plainly:
- It sends nothing anywhere. No telemetry, no analytics, no upload. It needs no internet connection at all - the URLs it prints are text on your screen, not requests.
- It changes nothing. No registry edits, no settings, no repairs, no "optimisation". It only reads.
- It installs nothing and leaves nothing behind. Delete the file and it is gone.
- There is no paid version, no upsell, and nothing to sign up for.
The one file it can write is the -Export text report, only when you ask for it, only where you tell it to. That file contains your computer name and Windows version and nothing else personal - it is meant to be safe to paste into a forum thread.
A note on what "none found" means
The Windows System log is a fixed-size ring buffer. On a busy machine it can hold days rather than months, and older entries are overwritten without warning. If you ask for a year and the log only reaches back three weeks, the script says so rather than reporting a clean result it cannot support.
That distinction matters. "No crashes recorded" and "no record survives" look identical in most tools, and only one of them is reassuring.
If you would rather do it by hand
Everything the script does, you can do yourself in Event Viewer - it is just tedious. The guide to finding your stop code walks through the manual version, including the trap where Kernel-Power Event 41 reports the stop code in decimal while everywhere else uses hexadecimal.
Once you have a code, the stop codes index explains it. If what you have is a warning rather than a crash - something degrading rather than something broken - that lives under hardware errors.