WinLevers for Windows

Bulk App Permissions Manager for Windows

Manage all your Windows app permissions from a single, filterable list. Preview changes before writing them, and undo batches easily from your history. Free, open-source, and edits real system settings—use with care.

  • Preview before every write
  • Reversible from History
  • Nothing machine-wide

Free software · MIT · not sold

Runs on
Windows, x64 and ARM64
Built with
C# on .NET 10 and WinUI 3
Writes to
HKEY_CURRENT_USER only
Network
None, ever

Manage any permission across all installed applications

Pick a permission in the sidebar and the whole machine lines up under it — apps, publishers, the state of that one lever, and when each app was last used. Filter it down, tick the rows you mean, and act on them together.

  • Search by name, publisher or path
  • Filter by state, by type, or to what you changed here
  • Hide Windows apps, or narrow to what ran in the last 30 days
  • Export the list as CSV

Full change previews before writing to the system

Open one app and every lever it has is on a single card: what it is now, when the app last used it, and a dropdown that stays on “Leave unchanged” until you move it. Changes go through a preview before anything touches the machine.

  • Now, last used and change-to, side by side
  • Every setting defaults to leaving things alone
  • Preview changes before the write
  • Machine-wide levers stay inert unless the app was launched as administrator

Privacy advisor: high-risk permissions categorized and explained

The Privacy advisor is the short version of the whole machine: the permissions that let an app watch, listen, locate you or read what is yours, banded high or medium, each with the apps currently holding it and a sentence saying what that lets them do.

  • One bar for the whole machine — allowed, denied and not set, across every permission
  • Deny allowed, and deny not set, as two separate bulk actions
  • Clearly distinguishes between "not set" and "denied" states
  • Every card opens through to the full application list for that permission

Reversible changes with atomic journaling and snapshots

Changes are recorded as batches rather than as a stream of events. Each one carries the value it replaced, so a revert undoes what actually happened rather than what was intended. A value something else has changed since is shown as a difference and left alone.

  • One entry per apply, with what it wrote and a button to put it back
  • A JSON snapshot taken and flushed to disk before the first write of every batch
  • A failed write, or one that reads back differently, is recorded as failed and left out of a revert
  • Journal, snapshots, logs and settings live in %LOCALAPPDATA%, never in the registry it edits

Every feature, in full

A list of features you can find in the application.

WinLevers feature categories
  • Rescan machine

    One button re-reads every app and every lever on the box.

  • Counted by kind

    Apps, packaged, desktop and Windows components, each with its own tile.

  • Levers managed

    How many levers exist, how many carry an explicit setting, and how many this app changed.

  • A card per lever

    Each one says how many apps it applies to and how those apps are split across states.

  • Four states, always

    Allowed, Denied, Not set and Unreadable — an unreadable lever is reported, not guessed at.

  • GPU power preference

    The battery lever, listed and set alongside the permissions.

  • Find a setting

    Search the sidebar itself when you know the permission but not where it sits.

  • Name, publisher or path

    One search box that matches all three, so an unnamed executable is still findable.

  • Any state

    Narrow to what is allowed, denied, unset or unreadable under the current lever.

  • Any type

    Desktop apps and packaged apps separated, since Windows treats them differently.

  • Modified here

    Show only the rows this app wrote, apart from everything Windows set itself.

  • Used in 30 days

    Separates what is actually running from what merely exists on disk.

  • Hide Windows apps

    Drops the components that ship with the system out of the way.

  • Publisher and last used

    Columns, not decoration — who signed it and when it last touched the lever.

  • Row selection

    Tick rows individually or take the whole filtered list at once.

  • Export CSV

    The list as it stands, filters included.

  • One app, every lever

    A single dialog listing the app’s path and each setting with its current value.

  • Leave unchanged by default

    Every dropdown starts inert, so a dialog closed by accident writes nothing.

  • Preview changes

    The write is described before it happens rather than reported afterwards.

  • Bulk deny

    From the advisor: deny everything not set, or deny everything allowed, in one action.

  • Save profile

    Capture the machine’s current levers as a file.

  • Apply profile

    Put a saved profile onto a machine, through the same preview.

  • Machine-wide levers

    Shown but inert without administrator rights — the app never takes ownership of a key it was not given.

  • A share, not a score

    What proportion of the possible grants on this machine are actually open.

  • Ranked by consequence

    Each permission carries a high or medium band rather than sitting in an alphabetical list.

  • Said in plain words

    Every card spells out what an app allowed there can do, before you decide anything.

  • The holders, named

    The apps currently allowed on that permission are listed under the card, with their type.

  • Open lens

    Takes the card’s permission through to the full application list.

  • Not set is not refused

    The advisor says so out loud: with no setting, Windows decides when it asks.

  • Batches, not events

    Every apply is one entry, carrying what it wrote and how to put it back.

  • Put this batch back

    A revert reads the journal, so it undoes what actually happened.

  • A snapshot before every batch

    Taken first, and the recovery path if the journal is ever lost.

  • Export changes and batches

    One batch, or the whole record, out of the app.

  • Export CSV and Markdown

    The dashboard leaves as a spreadsheet or as text you can paste into a ticket.

  • A file, never the registry

    Settings live under %LOCALAPPDATA%\WinLevers, stated in the pane itself.

  • A diagnostic log

    What the application did, kept separately, for attaching to a bug report.

  • Rescan machine

    One button re-reads every app and every lever on the box.

  • Counted by kind

    Apps, packaged, desktop and Windows components, each with its own tile.

  • Levers managed

    How many levers exist, how many carry an explicit setting, and how many this app changed.

  • A card per lever

    Each one says how many apps it applies to and how those apps are split across states.

  • Four states, always

    Allowed, Denied, Not set and Unreadable — an unreadable lever is reported, not guessed at.

  • GPU power preference

    The battery lever, listed and set alongside the permissions.

  • Find a setting

    Search the sidebar itself when you know the permission but not where it sits.

  • Name, publisher or path

    One search box that matches all three, so an unnamed executable is still findable.

  • Any state

    Narrow to what is allowed, denied, unset or unreadable under the current lever.

  • Any type

    Desktop apps and packaged apps separated, since Windows treats them differently.

  • Modified here

    Show only the rows this app wrote, apart from everything Windows set itself.

  • Used in 30 days

    Separates what is actually running from what merely exists on disk.

  • Hide Windows apps

    Drops the components that ship with the system out of the way.

  • Publisher and last used

    Columns, not decoration — who signed it and when it last touched the lever.

  • Row selection

    Tick rows individually or take the whole filtered list at once.

  • Export CSV

    The list as it stands, filters included.

  • One app, every lever

    A single dialog listing the app’s path and each setting with its current value.

  • Leave unchanged by default

    Every dropdown starts inert, so a dialog closed by accident writes nothing.

  • Preview changes

    The write is described before it happens rather than reported afterwards.

  • Bulk deny

    From the advisor: deny everything not set, or deny everything allowed, in one action.

  • Save profile

    Capture the machine’s current levers as a file.

  • Apply profile

    Put a saved profile onto a machine, through the same preview.

  • Machine-wide levers

    Shown but inert without administrator rights — the app never takes ownership of a key it was not given.

  • A share, not a score

    What proportion of the possible grants on this machine are actually open.

  • Ranked by consequence

    Each permission carries a high or medium band rather than sitting in an alphabetical list.

  • Said in plain words

    Every card spells out what an app allowed there can do, before you decide anything.

  • The holders, named

    The apps currently allowed on that permission are listed under the card, with their type.

  • Open lens

    Takes the card’s permission through to the full application list.

  • Not set is not refused

    The advisor says so out loud: with no setting, Windows decides when it asks.

  • Batches, not events

    Every apply is one entry, carrying what it wrote and how to put it back.

  • Put this batch back

    A revert reads the journal, so it undoes what actually happened.

  • A snapshot before every batch

    Taken first, and the recovery path if the journal is ever lost.

  • Export changes and batches

    One batch, or the whole record, out of the app.

  • Export CSV and Markdown

    The dashboard leaves as a spreadsheet or as text you can paste into a ticket.

  • A file, never the registry

    Settings live under %LOCALAPPDATA%\WinLevers, stated in the pane itself.

  • A diagnostic log

    What the application did, kept separately, for attaching to a bug report.

See it working

Take a look at the user interface of the application.

What it never does

Here is exactly what WinLevers does not do:

  • Write anything without showing the exact list first.
  • Skip the snapshot before a batch that writes.
  • Take ownership of a registry key or rewrite an access control list.
  • Write into a key whose current shape it cannot parse.
  • Overwrite a value that has changed since the change it is reverting.
  • Undo a change that failed.
  • Delete a consent store key, as opposed to the single value it manages.
  • Write anything under HKEY_LOCAL_MACHINE.
  • Keep its own settings in the registry it edits.
  • Send, fetch or check anything over a network.

How every FlosForge app works

  • No telemetry

    No analytics, no crash reporting, no usage pings. Not configurable — simply absent.

  • Local storage only

    Your data stays on your own device, stored in private application sandboxes under your control.

  • Open exports

    Everything exports to standard formats you own (CSV, GPX, JSON, Markdown), with zero lock-in.

Getting it running

Get the app code from GitHub and run it on your machine following the instructions. This allows you to review the code for security and know exactly what it does before you run it.

Before you start

WinLevers edits the Windows registry, and you use it entirely at your own risk. Take a full System Restore point before your first batch — the app previews every write, journals it with the value it replaced and can put changes back, but a restore point is the wider safety net it cannot provide. Denying an app a capability it needs will change how it behaves, and Windows components sit in the grid alongside everything else.

What you need first

  • The .NET 10 SDK
  • Visual Studio 2026 with the .NET Desktop Development workload and the Windows App SDK component
  • Windows on x64 or ARM64 — the C++ workload is not needed
WinLevers on GitHub
  1. Clone the repository and open the solution

    Open WinLevers.sln, not the engine-only solution beside it.

    git clone https://github.com/dimitriostzr/winlevers.git
  2. Set WinLevers.App as the startup project

    Right-click it and choose Set as Startup Project. The repository contains a second executable — a CLI — and Visual Studio stores the startup project per user, so F5 will otherwise launch that instead.

  3. Pick your platform

    Set the platform dropdown to x64, or ARM64 on an ARM machine.

  4. Press F5

    Every launch opens with the risk notice: tick the box to continue, or Exit to close the app. Behind it the machine has already been scanned. Nothing is written until you preview and confirm a change.

  5. Or drive the same engine from a terminal

    The CLI is the engine without a window, useful for probing keys. scan, levers, plan and probe all write nothing.

    dotnet run --project src/WinLevers.Cli -- scan

Free software · MIT · not sold

Free and open source

WinLevers is released under the MIT License. It is not sold — there is no paid version, no licence key and no tier — and the licence is the whole arrangement. In plain terms:

  • It is free software, and it is not sold: there is no download to buy, no licence key and no paid tier.
  • You may use it, change it and redistribute it, for any purpose, commercial or not.
  • A copy you pass on, changed or not, keeps the copyright notice and the licence text. That is the one condition.
  • It is provided as is, without warranty of any kind. The author accepts no liability for any loss arising from its use.

Free, and the source is public

WinLevers for Windows is free software, published in full on GitHub. Clone it, audit it, or fork it. It is offered without a support commitment, so read the README first and try it on a machine you can afford to experiment with.

View on GitHub

No account, no telemetry, nothing reported back.

Trademarks and affiliation

FlosForge is an independent, one-person project. It is NOT affiliated with, endorsed by, sponsored by, certified by, approved by or connected in any way to any of the companies or organisations named below, or to any other company whose products, services or trademarks appear anywhere on this site or inside its screenshots. None of them has reviewed, approved or supported this software, and no such relationship is claimed or implied. Their names appear here for one reason only: to identify the software the pages are talking about.

Apple Inc.
Apple, macOS, Mac, the Mac App Store, Touch ID, Keychain and Apple Intelligence
Microsoft Corporation
Microsoft, Windows, Visual Studio, WinUI and .NET
Google LLC
Google, Android, Google Play, Google Drive, Health Connect and Gemini
Samsung Electronics Co., Ltd.
Samsung, Galaxy, Samsung Health and S Pen
the WordPress Foundation
WordPress
Linus Torvalds
Linux, registered in the U.S. and other countries
The MITRE Corporation
CVE (registered trademark) and CWE
Docker, Inc.
Docker
the OpenJS Foundation
Node.js and Electron
Cloudflare, Inc.
Cloudflare and R2
Amazon.com, Inc. or its affiliates
Amazon Web Services, AWS and Amazon S3
GitHub, Inc.
GitHub
the OpenStreetMap Foundation
OpenStreetMap
Yoast BV
Yoast
reMarkable AS
reMarkable, reMarkable 2 and reMarkable Paper Pro

cURL, Python, Ollama, Backblaze, Wasabi, MinIO, GeoNames, OpenTopoMap, NVD (National Vulnerability Database), the security advisory databases named on the project pages, and every other product, brand or company name shown on this site or inside its screenshots are the property of their respective owners. This product uses data from the NVD API but is not endorsed or certified by the NVD. Each mark is used nominatively — to identify the software, platforms or data sources concerned — and never as a badge of origin, quality or endorsement.