Find URI Protocol Handlers in Windows Regedit

This guide explains where custom application URI protocol handlers (such as mailto:, slack:, or custom internal URL schemes) are stored and registered within the Windows Registry. You will learn the exact registry hives and subkeys used for system-wide and user-specific configurations, the key flags that identify a valid protocol handler, and how to locate the specific execution paths assigned to each custom URI.

Primary Registry Locations

Custom URI protocol handlers in Windows are defined in the Classes registry trees. You can locate them in three primary paths using Registry Editor (regedit.exe):

1. Merged View (System and User)

• Path: HKEY_CLASSES_ROOT
• Description: This hive provides a combined, real-time view of both machine-wide and user-specific class registrations. If you are searching for any active protocol regardless of scope, start here.

2. User-Specific Registrations

• Path: HKEY_CURRENT_USER\Software\Classes
• Description: Handlers installed only for the currently logged-in user or portable applications without administrative privileges are stored here. Entries here take precedence over system-wide settings in HKEY_CLASSES_ROOT.

3. System-Wide Registrations

• Path: HKEY_LOCAL_MACHINE\Software\Classes
• Description: Handlers installed machine-wide for all users by administrators are stored here.

Anatomy of a URI Protocol Handler Key

A valid protocol handler key uses the URI scheme name as the key name (e.g., vscode, spotify, zoommtg). Inside the key, specific values and subkeys define its behavior:

1. Protocol Identifier:
   • A string value named URL Protocol must exist directly inside the root key (e.g., HKEY_CLASSES_ROOT\mycustomapp).
   • The value data is usually blank, but its existence marks the key as a recognized URL handler rather than a file extension.
2. Launch Command:

   • Path: [SchemeName]\shell\open\command

   • Value: The (Default) string value contains the executable path and arguments, typically formatted like:

     "C:\Program Files\Example\App.exe" "%1"

   • The "%1" parameter passes the full clicked URI string directly to the target application.

Modern Windows URL Associations

In Windows 10 and Windows 11, default application assignments for URL protocols are managed through additional user association keys:

• Path: HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\[SchemeName]\UserChoice
• Value: ProgId specifies which registered handler in HKEY_CLASSES_ROOT is actively mapped to handle the scheme for the current user.