Local-only Windows shortcut inspection

Free .LNK File Safety Checker

Read the target, command-line arguments, working directory, icon source, and SHA-256 of a Windows shortcut without opening it. Processing happens locally in your browser: the selected file is not sent to ShortcutRemover.com.

Inspect a Windows shortcut locally

Your file stays in this browser.No upload endpoint is used. The shortcut is not opened or executed.

or drop one file here · maximum 4 MiB

What this checker can reveal

A Windows .LNK file is more than a pointer. Its binary structure can include a target path, relative path, working directory, command-line arguments, icon location, window-display preference, and optional data used by Windows to resolve the destination. An unexpected shortcut can therefore hide a command behind a familiar folder or document icon.

The checker parses the documented Shell Link header, LinkInfo and StringData structures. It highlights combinations that deserve attention, including encoded PowerShell commands, command-shell launch chains, Windows Script Host targets, MSHTA active content, remote executable paths, and administrative utilities combined with web or network references.

No file upload: the page uses the browser File API. It does not submit the file contents, extracted target, arguments, filename, or SHA-256 to the server. Our aggregate analytics can count that the tool was used, but not which file was selected or what it contained.

How to inspect a shortcut safely

  1. Do not double-click an unexpected shortcut. Save or copy it to a location where you can review it without launching it.
  2. Select the .LNK file above. A normal shortcut is usually small; this checker rejects files larger than 4 MiB.
  3. Review the recovered target and arguments. Pay special attention to script interpreters, encoded commands, remote paths, web addresses, and instructions that start another launcher.
  4. Compare the icon source with the real target. A separate icon file is not automatically malicious, but a document or folder icon can be used to disguise a command.
  5. Keep Microsoft Defender enabled and scan the source drive. If the shortcut came from a USB drive, isolate the drive before reconnecting it to other computers.

How to interpret the result

Result Meaning Recommended response
High-risk pattern found The recovered fields combine a command-capable launcher with encoded, remote, script, or active-content behavior. Do not open it. Preserve it only if you need evidence, scan the source with Defender, and use quarantine rather than immediate permanent deletion when practical.
Review recommended The shortcut uses a command-capable utility, remote path, minimized launch, or another pattern that can be legitimate but needs context. Confirm who created it, where the target resides, and whether the arguments match the expected application workflow.
No high-risk pattern found The fields recovered by this parser did not match its documented high-risk rules. Do not treat this as proof of safety. Check the target file, its signature, its source, and an antivirus scan before using an unexpected shortcut.

Why the checker does not call a file “safe”

A shortcut can reference a legitimate executable that later loads unsafe content, a target that is no longer available, or optional data this lightweight parser does not fully resolve. Reputation and malware classification also require information that is not present in the Shell Link structure. The responsible result is therefore a transparent list of observed fields and rules—not a promise that a file cannot cause harm.

For wider folder, Desktop, Start menu, or USB-drive review, use Shortcut Remover for Windows. The desktop application can scan many shortcuts, preserve coverage and access-error evidence, quarantine selected results, and optionally hand files to Microsoft Defender. The browser checker intentionally performs no remediation.

Format coverage and limits

  • Recognizes the standard 76-byte ShellLinkHeader and Microsoft Shell Link CLSID.
  • Parses LinkTargetIDList length, LinkInfo path fields, Unicode or ANSI StringData, and environment target blocks.
  • Never resolves or follows the target and never executes command-line arguments.
  • Does not upload the file, query reputation services, or replace Microsoft Defender.
  • May not recover a target stored only in uncommon ItemID or PropertyStore forms.

The parser follows Microsoft’s published Shell Link Binary File Format structures. Its risk descriptions are narrower than the desktop product and are documented here so that a result can be independently reviewed.

Frequently asked questions

Does selecting a .LNK file run it?

No. The page reads its bytes through the browser File API. It does not ask Windows to open, resolve, or execute the shortcut.

Is the file uploaded for analysis?

No. The selected bytes remain inside the current browser tab. The page has no file-upload request.

Can a normal shortcut use PowerShell or CMD?

Yes. Administrators and software installers sometimes create legitimate command shortcuts. Unexpected origin, concealed arguments, encoded commands, remote content, or a misleading icon increase the need for investigation.

Does deleting a .LNK file delete the original target?

Normally it removes only the shortcut. Verify that the selected item is actually a .LNK file and preserve evidence if the source may be malicious.

Last technical review: August 15, 2026. Parser version 1.0.0. See the testing methodology, security design, and editorial standards.