Direct crash evidence
The kernel names a broken driver, or the exception/faulting instruction address falls inside a loaded module.
Free Windows minidump analyzer
Open a Windows .dmp file.
Read the crash evidence.
DumpReader turns a Windows crash dump into a readable report. Decode the stop code, inspect probable culprit evidence, and explore stack, driver and system details — no WinDbg, install or account required.
Drop your .dmp file here
works anywhere on the page
Usually in C:\Windows\Minidump · up to 32 MB
Reading dump…
- Standard analysis runs in server memory; dump bytes are discarded with the response
- No account, cookies, analytics or ads
- Free — donations only
Quick answer
What is DumpReader?
DumpReader is a free online Windows dump file reader for blue-screen minidumps and user-mode MDMP files. It reads the supported crash records already present in the file and turns them into an inspectable report; it does not run the dump or claim that an automated diagnosis is proof.
- Best input64-bit Windows small dump
- Upload limit32 MB
- Built-in reference150+ stop codes
- PriceFree
How to open and read a .dmp file online
-
Find the crash dump
When small-dump recording is enabled, Windows writes a dated .dmp file to
C:\Windows\Minidump. Copy the newest file somewhere you can access it. -
Drop it on this page
Drag the file here or choose it manually. DumpReader uploads it over HTTPS and runs the standard parser in server memory. Files over 32 MB are rejected.
-
Read the verdict
Review the decoded stop code, confidence-rated culprit evidence, stack and driver data, plus the supported fields available in that dump. Treat the result as a lead, not proof.
Microsoft reference: Small Memory Dump files explains what Windows records and where it saves them.
Step by step: how to read a .dmp file, including where Windows 10 and Windows 11 keep the minidump.
What does the crash-dump report show?
The available evidence depends on the dump format and what Windows captured. DumpReader reports the available evidence and surfaces missing or truncated data as a limitation.
Bugcheck explained
The stop code, its four parameters, and code-specific hints where the built-in reference has them.
Culprit evidence
A candidate module with a visible confidence level and the exact reason it was selected.
Stack frames
Addresses found on the captured kernel stack, mapped to modules and public symbols when available.
Driver inventory
Available driver names, paths, image sizes and timestamps, including unloaded entries when captured.
System & memory context
Windows build, architecture, processor count, registers and bounded memory-region data where present.
Raw technical fields
Decoded header and triage values with file offsets, plus optional WinDbg output when the host provides it.
Compatibility
Which Windows dump files are supported?
A 64-bit Windows small kernel dump is the best-supported input. DumpReader also recognizes user-mode MDMP files and 32-bit kernel dumps, but those formats expose different evidence.
| Dump format | What DumpReader can extract | Important limit |
|---|---|---|
| 64-bit kernel triage dump PAGEDU64 · type 4 |
Bugcheck, parameters, crash context, stack candidates, drivers, registers, memory regions and raw triage fields when captured. | Best-supported format. Individual fields can still be absent or truncated. |
| User-mode minidump MDMP |
Application exception, faulting module, operating-system details and module list. | It is an application dump, so it does not contain a Windows BSOD bugcheck. |
| 32-bit kernel dump PAGEDUMP |
Header-level bugcheck and basic system information. | Deep analysis is not available for this format. |
| Complete, kernel, active or automatic dump MEMORY.DMP |
Header-level data only when the file fits the upload limit. | Most exceed 32 MB and are rejected. A smaller dump contains less evidence, so its conclusion can differ. |
Microsoft documents the trade-offs between complete, kernel, small, automatic and active dump files.
Method & limitations
Can a minidump identify the exact crash cause?
Sometimes it can identify a strong lead; it cannot prove the cause in every crash. A module can be present because it caused the fault, because it received already-corrupted data, or simply because it was active when Windows stopped.
Stack-based lead
An early module not excluded as common core noise is a useful investigation target, not a conviction.
Insufficient evidence
Only core Windows modules appear, the necessary region is missing, or the dump is too limited to attribute the fault.
Data handling
What happens when you upload a crash dump?
The standard DumpReader analysis reads the upload in server memory and discards the dump bytes when the response is complete. The service does not create an account, set cookies, run analytics, or retain the upload as a user file.
- UploadYour browser sends the selected file to dumpreader.com over HTTPS.
- ParseThe bounded parser validates the Windows dump signature and reads supported structures without executing the file.
- ResolveWhen symbol lookup is enabled, only public module/PDB identifiers may be requested from Microsoft's symbol server — never dump bytes.
- DiscardThe response contains the report. Standard server access logs may contain an IP address, timestamp and request path for abuse prevention; they do not contain dump bytes.
Crash dumps can contain fragments of memory from the time of the failure. Upload only a dump you are authorized to share, and avoid public services for highly sensitive or regulated systems.
Examples of Windows blue-screen stop codes
A stop code identifies why Windows halted, but the code alone rarely proves the root cause. DumpReader's built-in reference recognizes more than 150 entries and combines the matching explanation with evidence from your dump.
| Stop code | Code | What the code reports |
|---|---|---|
| IRQL_NOT_LESS_OR_EQUAL | 0x0A | Kernel-mode code accessed invalid or pageable memory while running at a raised interrupt request level. |
| DRIVER_IRQL_NOT_LESS_OR_EQUAL | 0xD1 | A driver accessed pageable or invalid memory at too high an IRQL; the faulting instruction and stack may identify it. |
| PAGE_FAULT_IN_NONPAGED_AREA | 0x50 | Windows referenced invalid system memory that should have remained available. |
| SYSTEM_SERVICE_EXCEPTION | 0x3B | An exception occurred while a routine was moving from non-privileged to privileged code. |
| KMODE_EXCEPTION_NOT_HANDLED | 0x1E | A kernel-mode program raised an exception that the error handler did not catch. |
| MEMORY_MANAGEMENT | 0x1A | The Windows memory manager detected a serious inconsistency; dump parameters narrow the subtype. |
| DPC_WATCHDOG_VIOLATION | 0x133 | A deferred procedure call, interrupt service routine, or time at raised IRQL exceeded its watchdog limit. |
| CRITICAL_PROCESS_DIED | 0xEF | A process or thread required for Windows operation terminated unexpectedly. |
| WHEA_UNCORRECTABLE_ERROR | 0x124 | Windows Hardware Error Architecture reported an uncorrectable hardware error; the WHEA record identifies the source. |
| UNEXPECTED_KERNEL_MODE_TRAP | 0x7F | The processor generated a trap the Windows kernel could not handle; the first parameter identifies the trap type. |
Browse the full Windows stop-code reference → — every recognized bug check with its 0x value and meaning.
For authoritative definitions and parameters, use Microsoft's Bug Check Code Reference.
Frequently asked questions
What is a minidump file?
A Windows small memory dump, commonly called a minidump, is a compact .dmp record created after a system crash when dump writing is enabled. It includes the bugcheck and selected crash context, but far less memory than a kernel or complete dump.
Where does Windows save crash dump files?
Small per-crash dumps normally live in C:\Windows\Minidump.
Windows may also write a complete, kernel, automatic or active dump to
C:\Windows\MEMORY.DMP. If no dump exists, check System Properties →
Advanced → Startup and Recovery → Write debugging information.
How do I open a .dmp file without WinDbg?
Choose the .dmp file on this page. DumpReader validates and parses it on the server, then shows the supported stop-code, exception, stack, driver and system evidence in your browser. Nothing is installed and no account is required.
Can a crash dump prove which driver caused the BSOD?
Not always. A dump can directly implicate a module or provide a strong address-based lead, but a driver on the stack may be a victim of earlier corruption. DumpReader shows a confidence level and its reasoning so you can distinguish direct evidence from a heuristic.
Which .dmp formats can DumpReader analyze?
It provides its deepest analysis for 64-bit Windows kernel triage dumps (PAGEDU64, dump type 4). It also reads user-mode MDMP files and gives header-level results for 32-bit PAGEDUMP files. See the supported-files table above for details.
Is it safe to upload a dump file?
The standard analyzer processes the file in server memory and discards the dump bytes with the response. Symbol resolution may send public module identifiers—not dump bytes—to Microsoft's symbol service. Because any dump can contain fragments of crash-time memory, upload only files you are authorized to share.
My dump file is larger than 32 MB — what now?
Use the small per-crash file in C:\Windows\Minidump when one is
available. Larger C:\Windows\MEMORY.DMP files can be complete, kernel,
automatic or active dumps and require a desktop debugger such as WinDbg. A smaller
dump contains less evidence, so its result is not guaranteed to be identical.
Which stop codes can DumpReader decode?
The built-in reference recognizes more than 150 stop-code entries, including IRQL_NOT_LESS_OR_EQUAL, PAGE_FAULT_IN_NONPAGED_AREA and WHEA_UNCORRECTABLE_ERROR. For an unrecognized code, the report still preserves the raw value and parameters.
Provenance
Sources and analysis methodology
DumpReader's compatibility and privacy statements above are derived from the parser and server behavior in this project. Windows terminology and bugcheck meanings are checked against Microsoft's primary documentation.
- Small Memory Dumpcontents, location and configuration
- Varieties of kernel-mode dump filescomplete, kernel, small, automatic and active dumps
- Bug Check Code Referenceauthoritative stop-code index and parameters
- Microsoft public symbolspublic symbol-server behavior
Content and implementation claims last substantively reviewed .