Direct crash evidence
The kernel names a broken driver, or the exception/faulting instruction address falls inside a loaded module.
Free Windows minidump analyzer
Open a Windows .dmp file.
Read the crash evidence.
DumpReader turns a Windows crash dump into a readable report. Decode the stop code, inspect probable culprit evidence, and explore stack, driver and system details — no WinDbg, install or account required. It runs fully client-side: the dump is read in your browser and never leaves your computer.
Drop your .dmp file here
works anywhere on the page
Usually in C:\Windows\Minidump · up to 32 MB
Reading dump…
- The reader runs in your browser; your dump is never uploaded
- No account, cookies, analytics or ads
- Free — donations only
Quick answer
What is DumpReader?
DumpReader is a free online Windows dump file reader for blue-screen minidumps and user-mode MDMP files. It reads the supported crash records already present in the file and turns them into an inspectable report; it does not run the dump or claim that an automated diagnosis is proof.
- Best input64-bit Windows small dump
- File size limit32 MB
- Built-in reference150+ stop codes
- PriceFree
How to open and read a .dmp file online
-
Find the crash dump
When small-dump recording is enabled, Windows writes a dated .dmp file to
C:\Windows\Minidump. Copy the newest file somewhere you can access it. -
Drop it on this page
Drag the file here or choose it manually. DumpReader reads it in this browser — the file never leaves your machine. Files over 32 MB are rejected.
-
Read the verdict
Review the decoded stop code, confidence-rated culprit evidence, stack and driver data, plus the supported fields available in that dump. Treat the result as a lead, not proof.
Microsoft reference: Small Memory Dump files explains what Windows records and where it saves them.
Step by step: how to read a .dmp file, including where Windows 10 and Windows 11 keep the minidump.
What does the crash-dump report show?
The available evidence depends on the dump format and what Windows captured. DumpReader reports the available evidence and surfaces missing or truncated data as a limitation.
Bugcheck explained
The stop code, its four parameters, and code-specific hints where the built-in reference has them.
Culprit evidence
A candidate module with a visible confidence level and the exact reason it was selected.
Stack frames
Addresses found on the captured kernel stack, mapped to modules and public symbols when available.
Driver inventory
Available driver names, paths, image sizes and timestamps, including unloaded entries when captured.
System & memory context
Windows build, architecture, processor count, registers and bounded memory-region data where present.
Raw technical fields
Decoded header and triage values with the file offset each one was read from.
Compatibility
Which Windows dump files are supported?
A 64-bit Windows small kernel dump is the best-supported input. DumpReader also recognizes user-mode MDMP files and 32-bit kernel dumps, but those formats expose different evidence.
| Dump format | What DumpReader can extract | Important limit |
|---|---|---|
| 64-bit kernel triage dump PAGEDU64 · type 4 |
Bugcheck, parameters, crash context, stack candidates, drivers, registers, memory regions and raw triage fields when captured. | Best-supported format. Individual fields can still be absent or truncated. |
| User-mode minidump MDMP |
Application exception, faulting module, operating-system details and module list. | It is an application dump, so it does not contain a Windows BSOD bugcheck. |
| 32-bit kernel dump PAGEDUMP |
Header-level bugcheck and basic system information. | Deep analysis is not available for this format. |
| Complete, kernel, active or automatic dump MEMORY.DMP |
Header-level data only when the file fits the size limit. | Most exceed 32 MB and are rejected. A smaller dump contains less evidence, so its conclusion can differ. |
Microsoft documents the trade-offs between complete, kernel, small, automatic and active dump files.
Method & limitations
Can a minidump identify the exact crash cause?
Sometimes it can identify a strong lead; it cannot prove the cause in every crash. A module can be present because it caused the fault, because it received already-corrupted data, or simply because it was active when Windows stopped.
Stack-based lead
An early module not excluded as common core noise is a useful investigation target, not a conviction.
Insufficient evidence
Only core Windows modules appear, the necessary region is missing, or the dump is too limited to attribute the fault.
Data handling
What happens when you open a crash dump?
DumpReader reads your dump inside your own browser. The file is never uploaded, so there is no copy of it anywhere but your machine. The site does not create an account, set cookies, or run analytics.
- OpenYour browser reads the file you chose from disk into its own memory. Nothing is sent to dumpreader.com.
- ParseThe bounded parser validates the Windows dump signature and reads supported structures without executing the file — all of it in this tab.
- ResolveTo put names on the stack, this page asks dumpreader.com where Microsoft publishes each driver’s symbol file, sending that driver’s file name and build id and nothing else — never dump bytes — then reads the symbol file straight from Microsoft. Those lookups appear in ordinary server logs as a request path.
- ForgetClosing the tab is the end of it. The report was never anywhere else.
Crash dumps can contain fragments of memory from the time of the failure. Because the file stays on your machine, that memory is not exposed to this site — but it is still in the file, so take the same care when sending it anywhere else.
Examples of Windows blue-screen stop codes
A stop code identifies why Windows halted, but the code alone rarely proves the root cause. DumpReader's built-in reference recognizes more than 150 entries and combines the matching explanation with evidence from your dump.
| Stop code | Code | What the code reports |
|---|---|---|
| IRQL_NOT_LESS_OR_EQUAL | 0x0A | Kernel-mode code accessed invalid or pageable memory while running at a raised interrupt request level. |
| DRIVER_IRQL_NOT_LESS_OR_EQUAL | 0xD1 | A driver accessed pageable or invalid memory at too high an IRQL; the faulting instruction and stack may identify it. |
| PAGE_FAULT_IN_NONPAGED_AREA | 0x50 | Windows referenced invalid system memory that should have remained available. |
| SYSTEM_SERVICE_EXCEPTION | 0x3B | An exception occurred while a routine was moving from non-privileged to privileged code. |
| KMODE_EXCEPTION_NOT_HANDLED | 0x1E | A kernel-mode program raised an exception that the error handler did not catch. |
| MEMORY_MANAGEMENT | 0x1A | The Windows memory manager detected a serious inconsistency; dump parameters narrow the subtype. |
| DPC_WATCHDOG_VIOLATION | 0x133 | A deferred procedure call, interrupt service routine, or time at raised IRQL exceeded its watchdog limit. |
| CRITICAL_PROCESS_DIED | 0xEF | A process or thread required for Windows operation terminated unexpectedly. |
| WHEA_UNCORRECTABLE_ERROR | 0x124 | Windows Hardware Error Architecture reported an uncorrectable hardware error; the WHEA record identifies the source. |
| UNEXPECTED_KERNEL_MODE_TRAP | 0x7F | The processor generated a trap the Windows kernel could not handle; the first parameter identifies the trap type. |
Browse the full Windows stop-code reference → — every recognized bug check with its 0x value and meaning.
For authoritative definitions and parameters, use Microsoft's Bug Check Code Reference.
Frequently asked questions
What is a minidump file?
A Windows small memory dump, commonly called a minidump, is a compact .dmp record created after a system crash when dump writing is enabled. It includes the bugcheck and selected crash context, but far less memory than a kernel or complete dump.
Where does Windows save crash dump files?
Small per-crash dumps normally live in C:\Windows\Minidump.
Windows may also write a complete, kernel, automatic or active dump to
C:\Windows\MEMORY.DMP. If no dump exists, check System Properties →
Advanced → Startup and Recovery → Write debugging information.
How do I open a .dmp file without WinDbg?
Choose the .dmp file on this page. DumpReader validates and parses it inside your browser, then shows the supported stop-code, exception, stack, driver and system evidence. Nothing is installed, nothing is uploaded, and no account is required.
Can a crash dump prove which driver caused the BSOD?
Not always. A dump can directly implicate a module or provide a strong address-based lead, but a driver on the stack may be a victim of earlier corruption. DumpReader shows a confidence level and its reasoning so you can distinguish direct evidence from a heuristic.
Which .dmp formats can DumpReader analyze?
It provides its deepest analysis for 64-bit Windows kernel triage dumps (PAGEDU64, dump type 4). It also reads user-mode MDMP files and gives header-level results for 32-bit PAGEDUMP files. See the supported-files table above for details.
Is my dump file uploaded anywhere?
No. The reader runs in your browser and the file is never sent to this site. Symbol resolution sends a module name and build id — not dump bytes — so Microsoft's symbol server can be located. Any dump can still contain fragments of crash-time memory, so take the same care if you send the file somewhere else.
My dump file is larger than 32 MB — what now?
Use the small per-crash file in C:\Windows\Minidump when one is
available. Larger C:\Windows\MEMORY.DMP files can be complete, kernel,
automatic or active dumps and require a desktop debugger such as WinDbg. A smaller
dump contains less evidence, so its result is not guaranteed to be identical.
Which stop codes can DumpReader decode?
The built-in reference recognizes more than 150 stop-code entries, including IRQL_NOT_LESS_OR_EQUAL, PAGE_FAULT_IN_NONPAGED_AREA and WHEA_UNCORRECTABLE_ERROR. For an unrecognized code, the report still preserves the raw value and parameters.
Provenance
Sources and analysis methodology
DumpReader's compatibility and privacy statements above are derived from the parser and server behavior in this project. Windows terminology and bugcheck meanings are checked against Microsoft's primary documentation.
- Small Memory Dumpcontents, location and configuration
- Varieties of kernel-mode dump filescomplete, kernel, small, automatic and active dumps
- Bug Check Code Referenceauthoritative stop-code index and parameters
- Microsoft public symbolspublic symbol-server behavior
Content and implementation claims last substantively reviewed .