Self-Signed Certificates
Generate 4096-bit RSA .pfx certificates with custom CN, Org, and validity period. Exportable and PKCS#12 compliant.
v2.8.0 Now Available • Verify & Pre-Flight Checks
Securely Sign, Verify & Distribute Windows Software
The ultimate offline desktop application for developers. Generate certificates, sign executables, verify Authenticode signatures, run Pre-Flight release checks, and hash ANY file type securely.
# Sign your executable with timestamping
signtool sign /f "codesign.pfx" /p "••••••••" \
/fd SHA256 /tr http://timestamp.digicert.com \
/td SHA256 "my_app.exe"
# Or use the GUI: drag, drop, sign & verify ✓
signtool sign /f "codesign.pfx" /p "••••••••" \
/fd SHA256 /tr http://timestamp.digicert.com \
/td SHA256 "my_app.exe"
# Or use the GUI: drag, drop, sign & verify ✓
Windows 10/11
RFC 3161 Timestamping
Offline-First • No Cloud
Everything You Need to Sign & Verify Code
Built with Python, cryptography, and modern Tkinter UI principles. Works offline. No telemetry.
Drag & Drop Signing
Drop supported binaries (.exe, .dll, .msi, .sys, .cab, etc.) into the signing zone. One click signs with RFC 3161 timestamping.
Universal File Hashing
Drop ANY file (ISO, ZIP, PDF, EXE) to instantly generate MD5, SHA1, and SHA256 checksums. Recalculates automatically after signing.
Verify & Trust Report
Instantly verify Authenticode signatures. View signer details, timestamp status, and trust chain validity in a clean report card.
Pre-Flight Release Checker
Ensure your binary is ready for public release. Checks for valid signatures, timestamps, and detects Mark-of-the-Web (MOTW) flags.
Release Notes Generator
Automatically generate GitHub-ready Markdown release notes complete with file sizes, checksums, and PowerShell verification commands.
Trusted Store Auto-Install
Automatically install certificates to Windows Trusted Root & Trusted Publishers stores (requires admin).
Batch Signing
Sign entire folders and multiple files at once with a single click, saving time on large projects.
CI/CD Pipeline Export
Export ready-to-use GitHub Actions or Azure DevOps pipeline configurations for automated code signing.
Deploy to Other PCs
Select and install existing .pfx certificates to Trusted Root & Publishers on different machines for the same signed executable.
Load Existing Certificates
Load existing .pfx files directly in Step 2. Auto-fills metadata and warns if the certificate is expired or expiring soon.
HSM / Token Compatible
Use hardware tokens or HSMs by providing the certificate thumbprint. Supports all CSP/KSP providers.
From Certificate to Signed Binary in 3 Steps
No cloud dependencies. No account required. Just download and run.
Generate Certificate
Fill in Common Name and Organization. Click "Generate" to create a secure .pfx file locally.
Drag, Drop & Sign
Drop your executable into the signing zone. The app signs the file and automatically recalculates hashes to verify integrity.
Verify & Release
Use the Verify tool to check the signature, run a Pre-Flight check (Pro), and generate Markdown release notes.
Coming Soon in v2.9.0
What's Next on the Roadmap
We're constantly improving. Here is a sneak peek at the powerful features arriving in the next major update.
Native Dark Mode
A fully integrated, sleek dark mode toggle that dynamically themes the entire UI, including the drag-and-drop zones and hash badges, for comfortable late-night coding.
Expected Hash Matcher
Paste an expected SHA256 hash from a download page, and the toolkit will instantly compare it, displaying a massive, color-coded EXACT MATCH or MISMATCH badge.
Timestamp Server Selector
Choose your preferred RFC 3161 Timestamp Authority (DigiCert, Sectigo, SSL.com, GlobalSign) via a dropdown. If one TSA goes down, instantly switch to another.
Simple, Transparent Pricing
Free for development. Pro for production and commercial distribution.
Free Tier
$0 / forever
- Auto-Generate Self-signed certificates
- Single file Signing
- Universal File Hash Generator (Any File Type)
- Verify & Trust Reports
- Release Notes Generator
- RFC 3161 timestamping
- HSM / token support
- Personal & educational use
Pro License
$29 / one-time
- ✓ Everything in Free, plus:
- Hardware-bound to 1 machine
- Pre-Flight Release Checker & MOTW Unblock
- Batch sign folders & multiple files
- Export CI/CD pipeline configs
- Auto-install to Trusted Stores
- Install existing .pfx to other PCs
- Load existing certificates with auto-fill
- Commercial use rights
- Priority email support
Team License
$59 / one-time
- ✓ Everything in Pro, plus:
- Hardware-bound to 4 machines
- Send 4 Machine IDs for activation
- Perfect for small teams & workstations
- Batch sign folders & multiple files
- Export CI/CD pipeline configs
- Auto-install to Trusted Stores
- Install existing .pfx to other PCs
- Commercial use rights
🔐 Need a Production Certificate?
Self-signed certs are for development only. For public distribution, get a CA-issued code signing certificate:
Download & Install
Download the standard installer for easy setup on Windows 10/11.
Latest Release: v2.8.0
Released August 2026 • Windows 10/11 (64-bit)
📦
Code Signing Toolkit Installer
Loading downloads...View SHA256 Checksums
cb773dbd46e9e24dbac1a05fae09f972309d4b3026622b24a71e78b7132f2903
💡 First run? The app will auto-detect signtool.exe. If missing, install Windows SDK
Frequently Asked Questions
Yes. Code Signing Toolkit Pro is built specifically for Windows 10/11 (64-bit) and integrates directly with Windows SDK signtool.exe and Windows Certificate Stores. Linux/macOS support is not planned due to platform-specific signing APIs.
Pro licenses are cryptographically bound to your machine's CPU ID + MAC address hash using HMAC-SHA256. The license key contains a signed payload that validates against your hardware fingerprint at activation. You may request one (1) transfer per 12-month period for hardware failures or major upgrades by contacting support.
No. Self-signed certificates are intended for development, testing, and internal distribution only. Public software distribution requires a certificate from a trusted Certificate Authority (CA) like DigiCert or Sectigo to avoid SmartScreen warnings and ensure user trust.
The app will auto-detect signtool.exe. If missing, install Windows SDK (the app provides a direct download link for convenience). You can also manually browse to the signtool.exe path within the app settings if it's installed in a custom location.
The complete End User License Agreement (EULA) is included in the software download as LICENSE AGREEMENT.txt. Key terms: no reverse engineering, no key sharing, commercial use requires Pro license, and developers assume all liability for misuse.
No. The application works entirely offline. No telemetry, no analytics, no cloud dependencies. Your certificates, keys, and signed files never leave your machine unless you explicitly export or email them.
Yes. With the Pro license, you can use the "Install Existing .pfx to Trusted Stores - (Deploy to other PCs)" feature. Simply select your generated .pfx file on the target machine, enter the password, and the app will automatically install it into the Windows Trusted Root and Trusted Publishers stores, ensuring your signed executables run without warnings.
The Pre-Flight Checker (Pro feature) ensures your binary is completely ready for public release before you ship it. It verifies that the Authenticode signature is valid, checks for the presence of an RFC 3161 timestamp (so the signature won't expire when the cert does), and scans for Mark-of-the-Web (MOTW) flags that could trigger SmartScreen warnings for your users.
Yes! Our Team License allows activation on up to 4 machines. Simply purchase the Team License and send us the 4 Hardware IDs from your target machines. We will generate a custom license key that validates on all of them.
The Universal Hash Generator allows you to drag and drop ANY file (such as .ISO, .ZIP, .PDF, or .EXE) to instantly calculate its MD5, SHA1, and SHA256 checksums. If the dropped file is a supported executable or binary, the tool also enables one-click code signing and automatically recalculates the hashes in the background after the signature is applied.