Self-Signed Certificates
Generate 4096-bit RSA .pfx certificates with custom CN, Org, and validity period. Exportable and PKCS#12 compliant.
v2.7.1 Now Available • Windows 10/11 Native
Securely Sign & Distribute Windows Software
This Code Signing Tool is a powerful desktop application for developers and software publishers. It automatically creates self-signed certificates, signs Windows executables, and acts as a universal file hasher for ANY file type (ISO, ZIP, etc.)—all offline, securely, and without relying on cloud services.
# Sign your executable with timestamping
signtool sign /f "codesign.pfx" /p "••••••••" \
/fd SHA256 /tr http://timestamp.digicert.com \
/td SHA256 "my_app.exe"
# Or use the GUI: drag, drop, sign ✓
signtool sign /f "codesign.pfx" /p "••••••••" \
/fd SHA256 /tr http://timestamp.digicert.com \
/td SHA256 "my_app.exe"
# Or use the GUI: drag, drop, sign ✓
Windows 10/11
RFC 3161 Timestamping
Offline-First • No Cloud
Everything You Need to Sign Code
Built with Python, cryptography, and modern Tkinter UI principles. Works offline. No telemetry.
Drag & Drop Signing
Drop supported binaries (.exe, .dll, .msi, .sys, .cab, etc.) into the signing zone. One click signs with RFC 3161 timestamping via signtool.exe.
Universal File Hashing
Drop ANY file (ISO, ZIP, PDF, EXE) to instantly generate MD5, SHA1, and SHA256 checksums. Automatically recalculates hashes after signing supported binaries.
Trusted Store Auto-Install
Automatically install certificates to Windows Trusted Root & Trusted Publishers stores (requires admin).
Smart Signtool Detection
Auto-detects signtool.exe across Windows SDK, Visual Studio, and App Certification Kit paths.
Batch Signing
Sign entire folders and multiple files at once with a single click, saving time on large projects.
CI/CD Pipeline Export
Export ready-to-use GitHub Actions or Azure DevOps pipeline configurations for automated code signing.
HSM / Token Compatible
Use hardware tokens or HSMs by providing the certificate thumbprint. Supports all CSP/KSP providers.
Install Existing .pfx to Trusted Stores
Deploy to other PCs - Select and install existing certificates to Trusted Root & Publishers on different machines for the same signed executable.
Load Existing Certificates
Load your existing .pfx certificate files directly in Step 2. Making it easy to reuse certificates for signing multiple versions of your software.
From Certificate to Signed Binary in 3 Steps
No cloud dependencies. No account required. Just download and run.
Generate Certificate
Fill in Common Name and Organization. Click "Generate" to create a secure .pfx file locally.
Drag & Drop to Sign
Drop your executable into the signing zone. The app constructs the signtool command, signs the file, and automatically recalculates hashes to verify integrity.
Activate Pro (Optional)
Unlock batch signing, CI/CD exports, and trusted store auto-installation with a one-time $29 license.
Coming Soon in v2.8.0
What's Next on the Roadmap
We're constantly improving. Here is a sneak peek at the powerful features arriving in the next major update.
Verify & Trust Report
Instantly verify Authenticode signatures. View signer details, timestamp status, and trust chain validity in a clean, easy-to-read report card.
Pre-Flight Release Checker
Ensure your binary is ready for public release. Checks for valid signatures, timestamps, and detects Mark-of-the-Web (MOTW) flags to prevent SmartScreen warnings.
Release Notes Generator
Automatically generate GitHub-ready Markdown release notes complete with file sizes, checksums, and PowerShell verification commands.
Simple, Transparent Pricing
Free for development. Pro for production and commercial distribution.
Free Tier
$0 / forever
- Auto-Generate Self-signed certificates
- Single file Signing
- Auto-Sign Windows Executables
- Universal File Hash Generator (Any File Type)
- RFC 3161 timestamping
- HSM / token support
- Personal & educational use
- Community support
Pro License
$29 / one-time
- ✓ Everything in Free, plus:
- Hardware-bound to 1 machine
- Batch sign folders & multiple files
- Export CI/CD pipeline configs
- Auto-install to Trusted Stores
- Install existing .pfx to other PCs
- Load existing certificates with auto-fill
- Commercial use rights
- Priority email support
- Lifetime updates
Team License
$59 / one-time
- ✓ Everything in Pro, plus:
- Hardware-bound to 4 machines
- Send 4 Machine IDs for activation
- Perfect for small teams & workstations
- Batch sign folders & multiple files
- Export CI/CD pipeline configs
- Auto-install to Trusted Stores
- Install existing .pfx to other PCs
- Commercial use rights
- Priority email support
🔐 Need a Production Certificate?
Self-signed certs are for development only. For public distribution, get a CA-issued code signing certificate:
Download & Install
Download the standard installer for easy setup on Windows 10/11.
Latest Release: v2.7.1
Released August 2026 • Windows 10/11 (64-bit)
📦
Code Signing Toolkit Installer
Loading downloads...View SHA256 Checksums
662a3cbf0b8ea99940c231208bbbac82f3f51cf02ab17bebbc93b8d462f108f1
💡 First run? The app will auto-detect signtool.exe. If missing, install Windows SDK
Frequently Asked Questions
Yes. Code Signing Toolkit Pro is built specifically for Windows 10/11 (64-bit) and integrates directly with Windows SDK signtool.exe and Windows Certificate Stores. Linux/macOS support is not planned due to platform-specific signing APIs.
Pro licenses are cryptographically bound to your machine's CPU ID + MAC address hash using HMAC-SHA256. The license key contains a signed payload that validates against your hardware fingerprint at activation. You may request one (1) transfer per 12-month period for hardware failures or major upgrades by contacting support.
No. Self-signed certificates are intended for development, testing, and internal distribution only. Public software distribution requires a certificate from a trusted Certificate Authority (CA) like DigiCert or Sectigo to avoid SmartScreen warnings and ensure user trust.
The app will auto-detect signtool.exe. If missing, install Windows SDK (the app provides a direct download link for convenience). You can also manually browse to the signtool.exe path within the app settings if it's installed in a custom location.
The complete End User License Agreement (EULA) is included in the software download as LICENSE AGREEMENT.txt. Key terms: no reverse engineering, no key sharing, commercial use requires Pro license, and developers assume all liability for misuse.
No. The application works entirely offline. No telemetry, no analytics, no cloud dependencies. Your certificates, keys, and signed files never leave your machine unless you explicitly export or email them.
Yes. With the Pro license, you can use the "Install Existing .pfx to Trusted Stores - (Deploy to other PCs)" feature. Simply select your generated .pfx file on the target machine, enter the password, and the app will automatically install it into the Windows Trusted Root and Trusted Publishers stores, ensuring your signed executables run without warnings.
Yes. With the Pro license, you can use the "Load Existing" button in Step 2 to select an existing .pfx certificate file. The app will automatically extract and populate the Common Name, Organization, and validity period fields. It also checks the certificate's expiration status and warns you if it's expired or expiring soon, making it easy to reuse certificates for signing multiple versions of your software.
Yes! Our Team License allows activation on up to 4 machines. Simply purchase the Team License and send us the 4 Hardware IDs from your target machines. We will generate a custom license key that validates on all of them.
The Universal Hash Generator allows you to drag and drop ANY file (such as .ISO, .ZIP, .PDF, or .EXE) to instantly calculate its MD5, SHA1, and SHA256 checksums. If the dropped file is a supported executable or binary, the tool also enables one-click code signing and automatically recalculates the hashes in the background after the signature is applied.