Inspect Protocol Handlers in Windows Registry

Custom application URIs (such as mailto:, slack:, or custom schemes used by desktop tools) allow external applications and browsers to launch specific software directly. In Windows, these custom URI protocols are defined and stored within the Windows Registry. This article explains the exact registry keys where registered protocol handlers reside and how to inspect their launch commands using the Registry Editor (regedit).

Primary Registry Keys

Registered protocol handlers are stored under the Classes hierarchy in the Windows Registry. You can inspect them in the following locations:

1. System-Wide and Merged View:
   HKEY_CLASSES_ROOT\<protocol_scheme>
HKEY_CLASSES_ROOT (HKCR) is a merged view of machine-wide protocols and current-user overrides. It is the most convenient starting point for quickly searching for any active protocol scheme.

2. Current User Only (Per-User Registrations):
   HKEY_CURRENT_USER\Software\Classes\<protocol_scheme>
   This path contains protocol handlers registered exclusively for the currently logged-in Windows account.

3. Local Machine (System-Wide Registrations):
   HKEY_LOCAL_MACHINE\Software\Classes\<protocol_scheme>
   This path contains protocol handlers installed globally for all users on the computer.

How to Identify a Valid Protocol Handler

For a registry key to function as a custom URI handler, it must contain a specific configuration:

• The URL Protocol Marker: Inside the root key of the scheme (e.g., HKEY_CLASSES_ROOT\mycustomapp), there must be a string value (REG_SZ) named URL Protocol. The value data is usually blank, but its existence signifies to Windows that the key represents a URL protocol handler rather than a standard file extension.
• The Launch Command: Expand the protocol key and navigate to the subkey located at:
  ...\<protocol_scheme>\shell\open\command
  The (Default) value inside the command key contains the command-line path executed when the URI is triggered (for example: "C:\Program Files\Example\app.exe" "%1"). The "%1" parameter passes the full URI string to the executable.

Steps to Inspect in Regedit

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. In the navigation address bar, enter HKEY_CLASSES_ROOT (or HKEY_CURRENT_USER\Software\Classes for user-specific installations).
3. Scroll alphabetically or use the find function (Ctrl + F) to locate the protocol scheme name (for example, spotify, zoommtg, or vscode).
4. Select the protocol key and confirm the presence of the URL Protocol value in the right-hand pane.
5. Expand the key to shell > open > command to view the exact executable target and command-line arguments assigned to that URI.