ClickOnce Inspector

Drop in a ClickOnce deployment — the .application manifest, its .manifest, and the payload files (often renamed with a .deploy suffix) — to see exactly what it installs, verify every file's hash, and recover the real filenames.

Drop a ClickOnce folder's files (or a ZIP of it) here, or click to choose
The .application manifest, its .manifest, and payload files — all read locally, nothing uploaded

How this works: ClickOnce publishes an app as two small XML manifests plus its payload files. This page parses those manifests directly in your browser tab, matches each declared file against what you dropped in (stripping any .deploy suffix), and recomputes each file's hash with the Web Crypto API to check it against what the manifest declares. Nothing is uploaded anywhere.

Why check first: a ClickOnce app installed straight from a trusted publisher's site goes through Windows' own signature/trust prompts, but a .application folder mirrored, emailed, or pulled from a cache doesn't always carry that context with it. This page lets you see the publisher, trust level, and entry point it declares, and confirm the files haven't changed since publishing, before you run setup.exe or open the .application file yourself.

Troubleshooting

What files do I drop in?

Either a ZIP of the whole published ClickOnce folder (or your local ClickOnce app cache folder), or the individual files loose: the .application (or .vsto) deployment manifest, the .manifest application manifest it references, and the payload files — which may have a literal .deploy suffix appended to their real name.

Why do some files show as "missing"?

The manifest declares every file the app is supposed to include, but this page can only check the ones you actually provided. Drop in more of the folder's files to verify them too — "missing" doesn't mean something is wrong, it means that file wasn't in this batch.

What does a HASH MISMATCH mean?

The manifest declares a specific SHA-1/SHA-256 hash for that file, computed when it was published. If the file you provided hashes to something different, its content has changed since publishing — from corruption, a partial download, or tampering. It does not necessarily mean malicious intent, but it means the file no longer matches what the app's own manifest says it should be.

Does this run or install the application?

No. This page only reads the XML manifests and hashes the files you provide — it never executes anything, and it never installs the application.