Given a hotkey, how can I find which program owns it?

  • 1
    which version of windows? – Ivo Flipse Jul 23 '09 at 9:52

Caution: If you use Win 8 or later, do not use this utility as it will create some trouble - see comments.

If you are running a Windows earlier than Windows 8, then Windows Hotkey Explorer is probably what you want. This is also mentioned in the StackOverflow question: Find out what process registered a global hotkey? (Windows API).

  • 32
    HotKey explorer screws up pretty badly in Windows 8 - on startup it basically "presses" every hotkey, causing all kinds of weird stuff to happen, after which it locks up and has to be killed. – Nathan Ridley Jan 18 '15 at 19:19
  • 2
    @NathanRidley Ugh. I wish I read your comment before. This was a horrible combination with Win8 and Autohotkey. This kind of keyboard bashing could have done some serious damage too. – VitalyB Aug 9 '15 at 7:25
  • 11
    Do NOT use Hotkey Explorer on Windows 10 either. It does the same thing @NathanRidley mentioned. Just found out the hard way. – Artem Russakovskii Aug 11 '15 at 16:35
  • 5
    Also pretty screwy on Windows 7. It switched my main monitor's resolution to 640x480 (multi monitor set up). – Costa Aug 29 '15 at 16:08
  • 3
    I wish there was a more recent tool like Hotkey Exporer that works for Windows 8 & 10 – Flion Jan 16 '16 at 17:09

This works for me in Win10 (and probably all other even vaguely-recent versions of Windows)... also copied here from https://stackoverflow.com/a/43645062/995048 since this page seems to come up first in search results:

One possible way is to use the Visual Studio tool Spy++.

Give this a try:

  1. Run the tool (for me, it's at C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\Tools\spyxx_amd64.exe, or use spyxx.exe to monitor 32-bit processes)
  2. In the menu bar, select Spy -> Log messages... (or hit Ctrl + M)
  3. Check All Windows in System in the Additional Windows frame
  4. Switch to the Messages tab
  5. Click the Clear All button
  6. Select WM_HOTKEY in the listbox, or check Keyboard in Message Groups (if you're OK with more potential noise)
  7. Click the OK button
  8. Press the hotkey in question (Win + R, for example)
  9. Select the WM_HOTKEY line in the Messages (All Windows) window, right click, and select Properties... in the context menu
  10. In the Message Properties dialog, click the Window Handle link (this will be the handle for the window that received the message)
  11. Click the Synchronize button on the Window Properties dialog. This will show the window in the main Spy++ window treeview.
  12. On the Window Properties dialog, select the Process tab
  13. Click the Process ID link. This will show you the process (In my Win + R case: EXPLORER)
  • 3
    This is a great answer, it is a lot of steps but gives perfectly detailed information. Note that you will need to install SPY++ somehow and that you need to run the 64bit version on a 64bit PC or it won't work. I think the 'easiest' way to install SPY++ is to install Visual Studio 2017, be sure to select the C++ payload. For non developers this might be a bit too much work. – Roy T. May 12 '17 at 8:27
  • 2
    This is perfect. Elaborate, but perfect! – angularsen May 24 '17 at 21:04
  • 16
    Great answer! Just a note that the 64-bit version of Spy++ catches only messages for 64-bit applications, so if you don't see the WM_HOTKEY message in the Message log after pressing the hotkey, you may need to run the 32-bit version of Spy++. – Dawid Ferenczy Rogožan Jul 17 '17 at 14:54
  • Link should be updated to new documentation site. For Visual Studio 2017, the only required payload is "Visual C++ core desktop features". Application specific hotkey is not logged? For example, Ctrl + B in MS Word will make the text bold. – Franklin Yu Aug 3 '18 at 21:40
  • Thank you so much for this. I FINALLY found out what was stealing Ctrl Shift F from me. (It was Razer Cortex). Another note is that sometimes spy++ will crash when you try to view the properties. (And then you cannot see any more hooks until rebooting.) I was able to resolve this by right clicking, before step 9, and choosing "Stop Logging Message". At that point, it no longer crashed when I attempted to examine the properties. Thanks again! – Khale_Kitha Sep 21 '18 at 13:20

This has probably been answered on Stack Overflow in this thread:

Find out what process registered a global hotkey? (Windows API)

Here's Pauk's answer:

Your question piqued my interest, so I've done a bit of digging and while, unfortunately I don't have a proper answer for you, I thought I'd share what I have.

I found this example of creating keyboard hook (in Delphi) written in 1998, but is compilable in Delphi 2007 with a couple of tweaks.

It's a DLL with a call to SetWindowsHookEx that passes through a callback function, which can then intercept key strokes: In this case, it's tinkering with them for fun, changing left cursor to right, etc. A simple app then calls the DLL and reports back its results based on a TTimer event. If you're interested I can post the Delphi 2007 based code.

It's well documented and commented and you potentially could use it as a basis of working out where a key press is going. If you could get the handle of the application that sent the key strokes, you could track it back that way. With that handle you'd be able to get the information you need quite easily.

Other apps have tried determining hotkeys by going through their Shortcuts since they can contain a Shortcut key, which is just another term for hotkey. However most applications don't tend to set this property so it might not return much. If you are interested in that route, Delphi has access to IShellLink COM interface which you could use to load a shortcut up from and get its hotkey:

uses ShlObj, ComObj, ShellAPI, ActiveX, CommCtrl;

procedure GetShellLinkHotKey;
  LinkFile : WideString;
  SL: IShellLink;
  PF: IPersistFile;

  HotKey : Word;
  HotKeyMod: Byte;
  HotKeyText : string;
  LinkFile := 'C:\Temp\Temp.lnk';

  OleCheck(CoCreateInstance(CLSID_ShellLink, nil, CLSCTX_INPROC_SERVER, IShellLink, SL));

  // The IShellLink implementer must also support the IPersistFile
  // interface. Get an interface pointer to it.
  PF := SL as IPersistFile;

  // Load file into IPersistFile object
  OleCheck(PF.Load(PWideChar(LinkFile), STGM_READ));

  // Resolve the link by calling the Resolve interface function.
  OleCheck(SL.Resolve(0, SLR_ANY_MATCH or SLR_NO_UI));

  // Get hotkey info

  // Extract the HotKey and Modifier properties.
  HotKeyText := '';
  HotKeyMod := Hi(HotKey);

  if (HotKeyMod and HOTKEYF_ALT) = HOTKEYF_ALT then
    HotKeyText := 'ALT+';
    HotKeyText := HotKeyText + 'CTRL+';
  if (HotKeyMod and HOTKEYF_SHIFT) = HOTKEYF_SHIFT then
    HotKeyText := HotKeyText + 'SHIFT+';
  if (HotKeyMod and HOTKEYF_EXT) = HOTKEYF_EXT then
    HotKeyText := HotKeyText + 'Extended+';

  HotKeyText := HotKeyText + Char(Lo(HotKey));

  if (HotKeyText = '') or (HotKeyText = #0) then
    HotKeyText := 'None';

  ShowMessage('Shortcut Key - ' + HotKeyText);

If you've got access to Safari Books Online, there is a good section about working with shortcuts / shell links in the Borland Delphi 6 Developer's Guide by Steve Teixeira and Xavier Pacheco. My example above is a butchered version from there and this site.

Hope that helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.