This project is a work-in-progress that allows existing eBPF toolchains and APIs familiar in the Linux ecosystem to be used on top of Windows. It takes existing eBPF projects as submodules and adds the layer in between to make them run on top of Windows.
Publisher’s description
What is eBPF for Windows?
eBPF for Windows is an open-source program for Windows from Microsoft. It is written in C.
Installation and requirements
Official installers exist for 64-bit and ARM64 as Portable. It runs without installation (portable).
Popularity and file types
The source code on GitHub (microsoft/ebpf-for-windows) has 3,573 stars.
Project description on GitHub: “eBPF implementation that runs on top of Windows”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Native ARM64 build for Windows on Arm
- Portable: runs without installation
In short: eBPF for Windows is an open-source Windows tool for 64-bit and ARM64 PCs.
Is eBPF for Windows safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
26857F13FD97DBE662E0D4187C86B97271B27E5EE75304E15CD2EFC7D170A81A· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Security practices (OpenSSF Scorecard)
Automated checks of the microsoft/ebpf-for-windows repository on GitHub by the Open Source Security Foundation, last run on April 1, 2025.
- Dependency update tool10
- Security policy10
- Code review10
- Actively maintained10
- No dangerous workflows10
- Static code analysis10
- No known vulnerabilities10
- Licence declared10
- Fuzzing10
- Tests in CI10
- Contributors from several organisations10
- Pinned dependencies9
- No binaries in the repository5
- Restricted token permissions5
- OpenSSF Best Practices badge5
- Branch protection5
- Signed releases0
The score rates how the project is developed and released, not whether the program is safe to install. scorecard.dev
Recent versions
All 1 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 1.1.0Latest | March 21, 2026 | — | 64-bit ZIPARM64 ZIP |
Install from the command line
Silent install ›winget install --id Microsoft.eBPFforWindows -eRelated guide: How to use winget: install and update apps
Information
- Publisher
- Microsoft
- Licence
- MIT
- Price
- Free
- Source code
- github.com/microsoft/ebpf-for-windows
- Written in
- C
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, ARM64
- Installer
- Portable
- Version
- 1.1.0
- Released
- March 21, 2026
- Added to the catalogue
- May 4, 2026
- Versions listed
- 1
- GitHub stars
- 3,573
- GitHub forks
- 311
- Website
- github.com
- winget ID
- Microsoft.eBPFforWindows
Ratings and reviews
No reviews yet. Be the first to rate it.
Frequently asked questions
Is eBPF for Windows free?
Yes. eBPF for Windows is open-source software under the MIT licence.
Is eBPF for Windows safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install eBPF for Windows with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does eBPF for Windows run on ARM (Windows on Arm)?
Yes, there is a native ARM64 installer.
Can I use eBPF for Windows without administrator rights?
Yes, it is portable: unpack and run it.
