Download Ghidra for Windows

How to download Ghidra for Windows safely

To download Ghidra for Windows from the upstream project, choose ghidra_12.1.2_PUBLIC_20260605.zip, the same multi-platform archive used on macOS and Linux. This download is the named PUBLIC asset under the official GitHub release, not one of the automatically generated Source code archives. The file is approximately 546.3 MiB and expands to about 1 GB before you create any analysis projects.

There is no official ghidra.exe, setup wizard, or Ghidra MSI. Searches for “Ghidra executable download” often reflect an expectation created by normal Windows software, but Ghidra's supported download is a portable ZIP. It includes ghidraRun.bat, which prepares the Java classpath, checks the JDK, and launches the application. Avoid third-party EXE wrappers because they are not the file published by the Ghidra maintainers.

When you download Ghidra for Windows from this page, the browser opens the official github.com/NationalSecurityAgency/ghidra asset after a visible 15-second countdown. This site does not mirror the archive. The official release publishes SHA-256 b62e81a0390618466c019c60d8c2f796ced2509c4c1aea4a37644a77272cf99d; use PowerShell to verify the ZIP when you need to confirm that the download bytes match the release notes.

Install JDK 21 on Windows

Before starting Ghidra on Windows, install a 64-bit Java 21 Development Kit. A JRE-only package is not the documented requirement. Adoptium Temurin 21 and Amazon Corretto 21 are free LTS options listed by the upstream project. Their Windows installers can configure PATH and, depending on the installer choices, JAVA_HOME for you.

Open a new PowerShell or Command Prompt after installing Java. Run java -version and javac -version. Both should report version 21. Opening a fresh terminal matters because already-running shells keep their old environment. If another application needs an older JDK, keep both versions installed and let Ghidra locate JDK 21 instead of removing the other application's dependency.

When the Ghidra launcher cannot find a supported JDK automatically, it may ask for the Java home directory. Select the JDK directory itself, such as C:\Program Files\Eclipse Adoptium\jdk-21..., not its bin folder and not the individual java.exe file. Advanced users can set JAVA_HOME_OVERRIDE in support\launch.properties after understanding the normal discovery order.

Extract the Ghidra download and run ghidraRun.bat

Use File Explorer's Extract All command or a current version of 7-Zip. Extract the entire archive into a simple path that your user account can modify, for example C:\Users\YourName\Tools\ghidra_12.1.2_PUBLIC. Avoid extracting directly into Program Files unless you intentionally want administrative permission boundaries. Never run the batch file from inside the ZIP preview.

The official notes warn that old 7-Zip versions may not preserve zero-length files correctly. If the archive appears incomplete, update the extraction utility, verify the ZIP checksum, delete the partial directory, and extract again. Do not merge the new directory with an older Ghidra version. A clean side-by-side installation prevents stale modules and makes rollback possible.

Open the extracted directory and double-click ghidraRun.bat. Windows may display a SmartScreen or unknown-publisher prompt because the launcher is a script rather than a signed installer. Confirm that the file came from the verified official ZIP before proceeding. You can also launch it from PowerShell to keep error output visible. Once the Project Window opens, create a non-shared project and choose a writable project directory.

1. 1

   Extract All

   Right-click the official ZIP, choose Extract All, and use a new destination directory.

   C:\Users\YourName\Tools\ghidra_12.1.2_PUBLIC
2. 2

   Open the extracted folder

   Confirm that ghidraRun.bat appears beside Ghidra, Extensions, docs, server, and support directories.

   ghidraRun.bat
3. 3

   Launch Ghidra

   Double-click ghidraRun.bat or run it from PowerShell when you want to see startup diagnostics.

   .\ghidraRun.bat
4. 4

   Create a shortcut if useful

   After a successful launch, create a normal Windows shortcut targeting ghidraRun.bat. This is optional and does not change the portable installation.

   Send to > Desktop (create shortcut)

Ghidra x64 and Windows ARM64 support

Ghidra 12.1 is designed for 64-bit operating systems. The public release includes native binaries for Windows x86-64. It also lists Windows ARM64 as supported through x86 emulation. That means there is not a separate official ARM64 ZIP: install a compatible 64-bit JDK and use the same release archive while Windows provides the emulation layer for packaged x86 native components.

Do not confuse the architecture of the computer running Ghidra with the architecture of the program being analyzed. An x64 Windows installation of Ghidra can analyze binaries for many other processors because Ghidra's language modules describe numerous instruction sets. Host architecture affects the Java runtime and bundled native helper programs; target architecture is selected or detected when you import a file.

Python 3.9 through 3.14 is documented for Debugger and PyGhidra support, but it is not required simply to open the desktop CodeBrowser. For Windows debugging, connectors may need additional components such as WinDbg-related support. Start with the normal GUI installation, then install debugger prerequisites only for the connector you intend to use.

Fix Ghidra startup problems on Windows

If a window flashes and disappears, run .\ghidraRun.bat from PowerShell so the error remains visible. A missing Java message means no runtime was found through PATH or JAVA_HOME. A “Failed to find a supported JDK” message usually means Windows found an incompatible version or a runtime-only installation. Check the Java and javac versions, then point Ghidra at the JDK 21 home directory.

Move Ghidra if the installation path contains an exclamation mark (!) or caret (^). The official documentation identifies both characters as launch-breaking on Windows. Also avoid synchronizing or executing a large active analysis project from a path with aggressive cloud-file placeholder behavior until you have confirmed the project remains fully local and writable.

When Ghidra reports a deeper startup error, run support\ghidraDebug.bat or change the launch mode to foreground for more detail. Debug mode can listen on 127.0.0.1:18001, so use it only while diagnosing and close it afterward. Antivirus tools may inspect the large ZIP or extracted native binaries; verify provenance and checksum before deciding whether a warning is a false positive rather than disabling protection broadly.