Given a hotkey, how can I find which program owns it?


7 Answers 7


Caution: If you use Win 8 or later, do not use this utility as it will create some trouble - see comments.

If you are running a Windows earlier than Windows 8, then Windows Hotkey Explorer is probably what you want. This is also mentioned in the StackOverflow question: Find out what process registered a global hotkey? (Windows API).

  • If Hotkey Explorer reports hotkey as explorer.exe (TaskBar) then probably one of icons on desktop has this hotkey set in its properties. Sep 10, 2014 at 16:20
  • 38
    HotKey explorer screws up pretty badly in Windows 8 - on startup it basically "presses" every hotkey, causing all kinds of weird stuff to happen, after which it locks up and has to be killed. Jan 18, 2015 at 19:19
  • 5
    Also pretty screwy on Windows 7. It switched my main monitor's resolution to 640x480 (multi monitor set up).
    – Costa
    Aug 29, 2015 at 16:08
  • 1
    @Flion: so do I. I have started a thread over at SwRec: How to list all current Windows Hotkeys? Jun 6, 2016 at 14:51

This works for me in Win10 (and probably all other even vaguely-recent versions of Windows)... also copied here from https://stackoverflow.com/a/43645062/995048 since this page seems to come up first in search results:

One possible way is to use the Visual Studio tool Spy++.

Give this a try:

  1. Run the tool (for me, it's at C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\Tools\spyxx_amd64.exe, or use spyxx.exe to monitor 32-bit processes)
  2. In the menu bar, select Spy -> Log messages... (or hit Ctrl + M)
  3. Check All Windows in System in the Additional Windows frame
  4. Switch to the Messages tab
  5. Click the Clear All button
  6. Select WM_HOTKEY in the listbox, or check Keyboard in Message Groups (if you're OK with more potential noise)
  7. Click the OK button
  8. Press the hotkey in question (Win + R, for example)
  9. Select the WM_HOTKEY line in the Messages (All Windows) window, right click, and select Properties... in the context menu
  10. In the Message Properties dialog, click the Window Handle link (this will be the handle for the window that received the message)
  11. Click the Synchronize button on the Window Properties dialog. This will show the window in the main Spy++ window treeview.
  12. On the Window Properties dialog, select the Process tab
  13. Click the Process ID link. This will show you the process (In my Win + R case: EXPLORER)
  • 3
    This is a great answer, it is a lot of steps but gives perfectly detailed information. Note that you will need to install SPY++ somehow and that you need to run the 64bit version on a 64bit PC or it won't work. I think the 'easiest' way to install SPY++ is to install Visual Studio 2017, be sure to select the C++ payload. For non developers this might be a bit too much work.
    – Roy T.
    May 12, 2017 at 8:27
  • 28
    Great answer! Just a note that the 64-bit version of Spy++ catches only messages for 64-bit applications, so if you don't see the WM_HOTKEY message in the Message log after pressing the hotkey, you may need to run the 32-bit version of Spy++. Jul 17, 2017 at 14:54
  • Link should be updated to new documentation site. For Visual Studio 2017, the only required payload is "Visual C++ core desktop features". Application specific hotkey is not logged? For example, Ctrl + B in MS Word will make the text bold. Aug 3, 2018 at 21:40
  • Thank you so much for this. I FINALLY found out what was stealing Ctrl Shift F from me. (It was Razer Cortex). Another note is that sometimes spy++ will crash when you try to view the properties. (And then you cannot see any more hooks until rebooting.) I was able to resolve this by right clicking, before step 9, and choosing "Stop Logging Message". At that point, it no longer crashed when I attempted to examine the properties. Thanks again! Sep 21, 2018 at 13:20
  • 3
    You can download it from github.com/westoncampbell/SpyPlusPlus, mdb-blog.blogspot.com/2017/02/….
    – CoolMind
    May 24, 2019 at 10:26

I've recently wrote a small utility - Hotkey Detective - for newer Windows versions (tested on 8.1 and 10). It simply shows what process owns the hotkey when you trigger the keystroke.

As distinct from other known tools, like Hotkey Explorer, my utility doesn't list all hotkeys, because that would involve artificial triggering all of them, and breaking the system in the end. In order to see what process is the guilty one, simply run my utility with administrator privileges and press the stolen hotkey. That's all.

Hotkey Detective's sources and a quick usage manual can be found on GitHub. The binary releases are there too.

enter image description here

This is an early beta, so report any issues if you find them.

  • 7
    Worked perfectly for me, just remember to run as admin and try both x64 and x86 if you can't get it listed. The readme explains it, I just didn't read it at first :-)
    – angularsen
    May 5, 2021 at 8:03
  • This works perfectly for me too! Great utility
    – Rumal
    Feb 17, 2023 at 15:03
  • I'm on Windows 10, i've tried both x64 and x86 versions, both with admin privileges, and it does not show the stolen hotkey. I'm trying to use Ctrl+D in VS Code, and this combination just won't register. Feb 21, 2023 at 8:47
  • Yes! Thank you good man! It helped mi solve the problem with CTRL + ALT + S not printing polish letter ś. Some keywords in here to help others find this solution easier: "Snipping Tool, litera ś, problem z pisaniem litery ś, Evernote".
    – Filip
    Jul 5, 2023 at 11:12
  • Works beautifully - thank you! Jan 19 at 17:45

This has probably been answered on Stack Overflow in this thread:

Find out what process registered a global hotkey? (Windows API)

Here's Pauk's answer:

Your question piqued my interest, so I've done a bit of digging and while, unfortunately I don't have a proper answer for you, I thought I'd share what I have.

I found this example of creating keyboard hook (in Delphi) written in 1998, but is compilable in Delphi 2007 with a couple of tweaks.

It's a DLL with a call to SetWindowsHookEx that passes through a callback function, which can then intercept key strokes: In this case, it's tinkering with them for fun, changing left cursor to right, etc. A simple app then calls the DLL and reports back its results based on a TTimer event. If you're interested I can post the Delphi 2007 based code.

It's well documented and commented and you potentially could use it as a basis of working out where a key press is going. If you could get the handle of the application that sent the key strokes, you could track it back that way. With that handle you'd be able to get the information you need quite easily.

Other apps have tried determining hotkeys by going through their Shortcuts since they can contain a Shortcut key, which is just another term for hotkey. However most applications don't tend to set this property so it might not return much. If you are interested in that route, Delphi has access to IShellLink COM interface which you could use to load a shortcut up from and get its hotkey:

uses ShlObj, ComObj, ShellAPI, ActiveX, CommCtrl;

procedure GetShellLinkHotKey;
  LinkFile : WideString;
  SL: IShellLink;
  PF: IPersistFile;

  HotKey : Word;
  HotKeyMod: Byte;
  HotKeyText : string;
  LinkFile := 'C:\Temp\Temp.lnk';

  OleCheck(CoCreateInstance(CLSID_ShellLink, nil, CLSCTX_INPROC_SERVER, IShellLink, SL));

  // The IShellLink implementer must also support the IPersistFile
  // interface. Get an interface pointer to it.
  PF := SL as IPersistFile;

  // Load file into IPersistFile object
  OleCheck(PF.Load(PWideChar(LinkFile), STGM_READ));

  // Resolve the link by calling the Resolve interface function.
  OleCheck(SL.Resolve(0, SLR_ANY_MATCH or SLR_NO_UI));

  // Get hotkey info

  // Extract the HotKey and Modifier properties.
  HotKeyText := '';
  HotKeyMod := Hi(HotKey);

  if (HotKeyMod and HOTKEYF_ALT) = HOTKEYF_ALT then
    HotKeyText := 'ALT+';
    HotKeyText := HotKeyText + 'CTRL+';
  if (HotKeyMod and HOTKEYF_SHIFT) = HOTKEYF_SHIFT then
    HotKeyText := HotKeyText + 'SHIFT+';
  if (HotKeyMod and HOTKEYF_EXT) = HOTKEYF_EXT then
    HotKeyText := HotKeyText + 'Extended+';

  HotKeyText := HotKeyText + Char(Lo(HotKey));

  if (HotKeyText = '') or (HotKeyText = #0) then
    HotKeyText := 'None';

  ShowMessage('Shortcut Key - ' + HotKeyText);

If you've got access to Safari Books Online, there is a good section about working with shortcuts / shell links in the Borland Delphi 6 Developer's Guide by Steve Teixeira and Xavier Pacheco. My example above is a butchered version from there and this site.

Hope that helps!


I must recommend OpenArk. Under "Kernel" tab, "System Hotkey" page, you can find all registered hotkeys and corresponding processes. Remember to click "Enter KernelMode" button first.


These answers didn't work for me because--if I understand correctly--the hotkey had just been dropped on a .lnk that did not get removed on an uninstall. Spy++ crashed when it was invoked.

Following the steps on this answer solved it: find the shortcut in question (mine was hiding in the start menu, without showing up under windows start button for whatever reason) and remove its hotkey setting (using backspace) or just delete the shortcut altogether.


I use Ctrl-Shift-C and Ctrl-Shift-V to copy and paste formatting in Word in win10. AMD's Radeon Pro Software robbed the Ctrl-Shift-C keyboard shortcut to enable/disable the camera. I disabled all hotkeys in the Radeon software and got the functionality back for Word, but one could reassign only the camera portion, or any other conflicting hotkey if one wanted to retain the Radeon hotkey function.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .