Given a hotkey, how can I find which program owns it?

  • 1
    which version of windows?
    – Ivo Flipse
    Jul 23, 2009 at 9:52

7 Answers 7


Caution: If you use Win 8 or later, do not use this utility as it will create some trouble - see comments.

If you are running a Windows earlier than Windows 8, then Windows Hotkey Explorer is probably what you want. This is also mentioned in the StackOverflow question: Find out what process registered a global hotkey? (Windows API).

  • 38
    HotKey explorer screws up pretty badly in Windows 8 - on startup it basically "presses" every hotkey, causing all kinds of weird stuff to happen, after which it locks up and has to be killed. Jan 18, 2015 at 19:19
  • 5
    @NathanRidley Ugh. I wish I read your comment before. This was a horrible combination with Win8 and Autohotkey. This kind of keyboard bashing could have done some serious damage too.
    – VitalyB
    Aug 9, 2015 at 7:25
  • 18
    Do NOT use Hotkey Explorer on Windows 10 either. It does the same thing @NathanRidley mentioned. Just found out the hard way. Aug 11, 2015 at 16:35
  • 5
    Also pretty screwy on Windows 7. It switched my main monitor's resolution to 640x480 (multi monitor set up).
    – Costa
    Aug 29, 2015 at 16:08
  • 3
    I wish there was a more recent tool like Hotkey Exporer that works for Windows 8 & 10
    – Flion
    Jan 16, 2016 at 17:09

This works for me in Win10 (and probably all other even vaguely-recent versions of Windows)... also copied here from https://stackoverflow.com/a/43645062/995048 since this page seems to come up first in search results:

One possible way is to use the Visual Studio tool Spy++.

Give this a try:

  1. Run the tool (for me, it's at C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\Tools\spyxx_amd64.exe, or use spyxx.exe to monitor 32-bit processes)
  2. In the menu bar, select Spy -> Log messages... (or hit Ctrl + M)
  3. Check All Windows in System in the Additional Windows frame
  4. Switch to the Messages tab
  5. Click the Clear All button
  6. Select WM_HOTKEY in the listbox, or check Keyboard in Message Groups (if you're OK with more potential noise)
  7. Click the OK button
  8. Press the hotkey in question (Win + R, for example)
  9. Select the WM_HOTKEY line in the Messages (All Windows) window, right click, and select Properties... in the context menu
  10. In the Message Properties dialog, click the Window Handle link (this will be the handle for the window that received the message)
  11. Click the Synchronize button on the Window Properties dialog. This will show the window in the main Spy++ window treeview.
  12. On the Window Properties dialog, select the Process tab
  13. Click the Process ID link. This will show you the process (In my Win + R case: EXPLORER)
  • 3
    This is a great answer, it is a lot of steps but gives perfectly detailed information. Note that you will need to install SPY++ somehow and that you need to run the 64bit version on a 64bit PC or it won't work. I think the 'easiest' way to install SPY++ is to install Visual Studio 2017, be sure to select the C++ payload. For non developers this might be a bit too much work.
    – Roy T.
    May 12, 2017 at 8:27
  • 2
    This is perfect. Elaborate, but perfect!
    – angularsen
    May 24, 2017 at 21:04
  • 26
    Great answer! Just a note that the 64-bit version of Spy++ catches only messages for 64-bit applications, so if you don't see the WM_HOTKEY message in the Message log after pressing the hotkey, you may need to run the 32-bit version of Spy++. Jul 17, 2017 at 14:54
  • 3
    You can download it from github.com/westoncampbell/SpyPlusPlus, mdb-blog.blogspot.com/2017/02/….
    – CoolMind
    May 24, 2019 at 10:26
  • 1
    Great answer! This worked for me to find out that it was Zoom responding to ALT SHIFT T and starting an image snapshot process (weird: not Zoom is for). However, it didn't capture the suggest WIN+R hotkey in your instructions which confused me initially as I tried that first to confirm I'd followed your steps correctly. Any ideas why?
    – Gruff
    Jul 27, 2019 at 12:55

I've recently wrote a small utility - Hotkey Detective - for newer Windows versions (tested on 8.1 and 10). It simply shows what process owns the hotkey when you trigger the keystroke.

As distinct from other known tools, like Hotkey Explorer, my utility doesn't list all hotkeys, because that would involve artificial triggering all of them, and breaking the system in the end. In order to see what process is the guilty one, simply run my utility with administrator privileges and press the stolen hotkey. That's all.

Hotkey Detective's sources and a quick usage manual can be found on GitHub. The binary releases are there too.

enter image description here

This is an early beta, so report any issues if you find them.

  • 2
    Great little utility, allowed me to find out that the software of a AMD Radeon card was hijacking the Ctrl + Shift + C shortcut key, which in Winword allows one to copy text formatting. Dec 9, 2020 at 14:05
  • 3
    This is the best answer! Works on windows 10, small portable program. The path to the program linked to the hotkey came up as soon as I pressed it!
    – aiwl
    Apr 15, 2021 at 16:12
  • 2
    Worked perfectly for me, just remember to run as admin and try both x64 and x86 if you can't get it listed. The readme explains it, I just didn't read it at first :-)
    – angularsen
    May 5, 2021 at 8:03
  • Wonderful, this helped me track down what stole the CTRL+R chords from Visual Studio. Jan 12, 2022 at 9:02
  • Worked perfectly for me. Mar 31, 2022 at 14:09

This has probably been answered on Stack Overflow in this thread:

Find out what process registered a global hotkey? (Windows API)

Here's Pauk's answer:

Your question piqued my interest, so I've done a bit of digging and while, unfortunately I don't have a proper answer for you, I thought I'd share what I have.

I found this example of creating keyboard hook (in Delphi) written in 1998, but is compilable in Delphi 2007 with a couple of tweaks.

It's a DLL with a call to SetWindowsHookEx that passes through a callback function, which can then intercept key strokes: In this case, it's tinkering with them for fun, changing left cursor to right, etc. A simple app then calls the DLL and reports back its results based on a TTimer event. If you're interested I can post the Delphi 2007 based code.

It's well documented and commented and you potentially could use it as a basis of working out where a key press is going. If you could get the handle of the application that sent the key strokes, you could track it back that way. With that handle you'd be able to get the information you need quite easily.

Other apps have tried determining hotkeys by going through their Shortcuts since they can contain a Shortcut key, which is just another term for hotkey. However most applications don't tend to set this property so it might not return much. If you are interested in that route, Delphi has access to IShellLink COM interface which you could use to load a shortcut up from and get its hotkey:

uses ShlObj, ComObj, ShellAPI, ActiveX, CommCtrl;

procedure GetShellLinkHotKey;
  LinkFile : WideString;
  SL: IShellLink;
  PF: IPersistFile;

  HotKey : Word;
  HotKeyMod: Byte;
  HotKeyText : string;
  LinkFile := 'C:\Temp\Temp.lnk';

  OleCheck(CoCreateInstance(CLSID_ShellLink, nil, CLSCTX_INPROC_SERVER, IShellLink, SL));

  // The IShellLink implementer must also support the IPersistFile
  // interface. Get an interface pointer to it.
  PF := SL as IPersistFile;

  // Load file into IPersistFile object
  OleCheck(PF.Load(PWideChar(LinkFile), STGM_READ));

  // Resolve the link by calling the Resolve interface function.
  OleCheck(SL.Resolve(0, SLR_ANY_MATCH or SLR_NO_UI));

  // Get hotkey info

  // Extract the HotKey and Modifier properties.
  HotKeyText := '';
  HotKeyMod := Hi(HotKey);

  if (HotKeyMod and HOTKEYF_ALT) = HOTKEYF_ALT then
    HotKeyText := 'ALT+';
    HotKeyText := HotKeyText + 'CTRL+';
  if (HotKeyMod and HOTKEYF_SHIFT) = HOTKEYF_SHIFT then
    HotKeyText := HotKeyText + 'SHIFT+';
  if (HotKeyMod and HOTKEYF_EXT) = HOTKEYF_EXT then
    HotKeyText := HotKeyText + 'Extended+';

  HotKeyText := HotKeyText + Char(Lo(HotKey));

  if (HotKeyText = '') or (HotKeyText = #0) then
    HotKeyText := 'None';

  ShowMessage('Shortcut Key - ' + HotKeyText);

If you've got access to Safari Books Online, there is a good section about working with shortcuts / shell links in the Borland Delphi 6 Developer's Guide by Steve Teixeira and Xavier Pacheco. My example above is a butchered version from there and this site.

Hope that helps!


I must recommend OpenArk. Under "Kernel" tab, "System Hotkey" page, you can find all registered hotkeys and corresponding processes. Remember to click "Enter KernelMode" button first.


These answers didn't work for me because--if I understand correctly--the hotkey had just been dropped on a .lnk that did not get removed on an uninstall. Spy++ crashed when it was invoked.

Following the steps on this answer solved it: find the shortcut in question (mine was hiding in the start menu, without showing up under windows start button for whatever reason) and remove its hotkey setting (using backspace) or just delete the shortcut altogether.


I use Ctrl-Shift-C and Ctrl-Shift-V to copy and paste formatting in Word in win10. AMD's Radeon Pro Software robbed the Ctrl-Shift-C keyboard shortcut to enable/disable the camera. I disabled all hotkeys in the Radeon software and got the functionality back for Word, but one could reassign only the camera portion, or any other conflicting hotkey if one wanted to retain the Radeon hotkey function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.