Windows 10 (1809 and later) and Windows 11

Two ways in, and neither needs an account.

The command line installs nothing. The desktop app is a single installer. Both run the same engine, and the engine is the part that does the deleting.

The command line

Nothing is installed. npx fetches the package, runs it and leaves. Start with the scan. It deletes nothing.

PowerShell

PS> npx windowsweep --scan

Installing it globally is only worth doing if you want the weekly scheduled task or the shell alias, because both break when the npx cache is evicted.

PowerShell

PS> npm install -g windowsweep

The desktop app

Release desktop-v1.4.1, published 3 November 2026. The .exe is 2,762,709 bytes. It bundles the same engine and reimplements none of it.

windowsweep_1.4.1_x64-setup.exeRecommended

2.76 MBNSIS installerx64Windows 10 1809+

The smaller of the two and the one the updater knows how to replace.

Download the .exe

windowsweep_1.4.1_x64_en-US.msi

3.51 MBWindows Installerx64for deployment tools

Use this one if something in your organisation deploys MSI packages. It installs the same application.

Download the .msi

SmartScreen will warn you, and here is exactly why.

The installer is not signed with a paid code-signing certificate, so Microsoft SmartScreen shows “Windows protected your PC” on first run. That is a statement about the certificate, not about the file. Choose More info and then Run anyway. You can verify what you downloaded first.

What you can verify

A SHA-256 checksum published beside each installer.
A minisign signature, the same one the app’s own updater checks before it applies anything.
The source, which is public.

What neither of those is

A code-signing certificate. They prove the file is the one that was built — not who built it.
A reason SmartScreen will stop warning. It will keep warning until a certificate exists.

verify the checksum

PS> Get-FileHash .\windowsweep_1.4.1_x64-setup.exe -Algorithm SHA256 compare the result with the checksum published on the release page

The checksum value itself is not printed here: it changes with every build, and a stale hash on a marketing page is worse than no hash. The release page is the one place it can be right.

What it needs

Everything optional is optional because a section that needs it skips cleanly without it.
Requirement	Version	Why
Windows PowerShell	5.1	Ships with Windows 10 and 11. PowerShell 7 also works with --pwsh.
Node.js	>= 14	Only for npx and the global install. The .cmd launcher needs no Node.
Administrator	optional	Sections 12–16, 20, 27 and 29 need it; an all-user uninstall may also ask. Admin-only sections skip and print the exact command without it.
docker	optional	Section 5 only.

windowsweep --self-test reports which optional tools are missing on your machine, and proves the guards on it, before you trust any of this.