Notepad++ plugins are optional extensions, delivered as DLL files, that are loaded from the plugins directory of a Notepad++ installation. Notepad++ ships with a few plugins, and users can add or remove others.[1] The plugin system has existed since version 3.1.[3] Most plugins are written and licensed by third parties, so an organization that deploys Notepad++ has two kinds of software to govern: the GPL-licensed editor, and whatever plugins its users install. This page also collects the packaging, update and signing facts relevant to managed deployment. The licence of Notepad++ itself is covered in Notepad++ licensing.
Plugins Admin and the plugin list
The built-in Plugins Admin tool shows the available plugins and lets users install, update and remove them.[1] The list it shows comes from nppPluginList, a separate open-source project maintained by the Notepad++ development team. Any publicly downloadable plugin may be submitted to it.[1] The list is kept as JSON and compiled into a DLL, which is signed with a certificate and shipped in the official distribution.[2][1]
Each list entry records a folder name, display name, version, hash identifier, download repository, description, author and homepage. There is no licence field. The x64 list at version 1.9.9 had 198 entries on 2026-09-27.[2] Inclusion in the list therefore says nothing about a plugin’s licence, and the licence has to be read from the plugin’s own repository or distribution. Plugins not in the list can be installed manually by placing the DLL in a subfolder of plugins named after the DLL.[1] Catalog proof: Plugins Admin plugins are third-party software with their own licences.
Plugin licensing
The Notepad++ LICENSE contains no exception for plugins. It consists of a short header and the unmodified text of GPL version 3.[6] Whether a plugin must itself be GPL-compatible therefore depends on the general GPL analysis of combined works. The FSF’s position is as follows.[4]
- If a main program dynamically links plug-ins, and they make function calls to each other and share data structures, the FSF believes they form a single combined program.
- If the main program and its plug-ins are one combined program, the plug-in must be licensed under the GPL or a GPL-compatible free software licence when distributed, with source code provided in a GPL-compliant way.
- A main program that is separate from its plug-ins makes no requirements of them. Where the line falls is a legal question that the FAQ says judges will ultimately decide.
The official plugin template published by the Notepad++ author is licensed under GPL version 2 “or (at your option) any later version”.[5] Plugins built from it inherit that licence unless their authors relicense their own code where they can. Catalog proof: Plugins that form a combined program must be GPL-compatible when distributed.
For an organization that only uses plugins internally, none of this creates an obligation. Running and internal copying are unconditioned under section 2 of the GPL.[6] The questions that matter in practice are these:
- whether each plugin’s own licence allows the intended use. A plugin can be proprietary, commercial or restricted to non-commercial use even though Notepad++ is free.
- whether the organization distributes Notepad++ bundled with plugins. In that case the redistribution rules in Notepad++ redistribution and bundled components apply to the editor, and each plugin’s licence applies to the plugin.
Deployment packages and options
Each release is published as an exe installer, portable zip and 7z packages, a mini-portable package and, for x64, an MSI.[17] The installer will usually need administrative privileges. So will later updates and plugin installation, or anything else that writes to the installation directory.[7] Starting with v8.8.8, the MSI installer is intended for IT departments deploying Notepad++ across an organization.[7] Catalog proof: MSI installer for organization-wide deployment.
| Package | Option | Effect |
|---|---|---|
| exe installer | /S | Silent installation (case-sensitive)[8] |
| exe installer | /D=path | Overrides the installation directory; must be last[8] |
| exe installer | /noUpdater | Does not install the WinGUp and Plugins Admin updating components[8] |
| exe installer | /closeRunningNpp | Tries to close running Notepad++ before installing (v8.6.9)[8] |
| MSI | NOUPDATER=1 | Prevents installation of gup.exe (v8.8.8)[8] |
| MSI | REBOOT=1 | Triggers a reboot after installation (v8.8.8)[8] |
| MSI | NPP_LANG=xyz | Selects a localization file (v8.9.4)[8] |
Updater
When Notepad++ is installed with the installer, the auto-update feature is active by default. The WinGUp updater is launched every 15 days to check for a new version, and a preference setting can disable auto-triggered updates.[9] WinGUp is a separate program licensed under the GNU Lesser General Public License version 3.[10] Catalog proof: WinGUp updater is an LGPL-3.0 component that can be omitted.
In February 2026 the project disclosed that update traffic for some targeted users had been redirected to attacker-controlled update manifests. The redirection came from a compromise of the project’s former shared hosting provider. It began in June 2025, and the provider reported that the attackers’ access ended by 2 December 2025.[11] The project stated that Notepad++ itself was not hacked and that the issue concerned the auto-updater component. For enterprise IT it recommended checking the published indicators of compromise, and noted that the MSI can be deployed without the auto-updater using NOUPDATER=1.[12] Since v8.9, a log of security errors met during updates is written to %LOCALAPPDATA%\Notepad++\log\securityError.log.[14] Organizations that distribute updates through their own tooling can omit WinGUp and control the version baseline centrally.
Code signing and integrity
Since v7.6.5, Notepad++ packages have been signed with a GPG release key.[15] The repository README gives key ID 0x8D84F46E, created 2019-03-11 and expiring 2027-03-13.[18] X.509 code signing changed several times.[3][13]
| Releases | Signing |
|---|---|
| v8.8.2 | No Windows code-signing certificate |
| v8.8.3 to v8.8.6 | Self-signed Notepad++ Root Certificate Authority only |
| v8.8.7 to v8.8.9 | Double-signed: GlobalSign-issued certificate and self-signed certificate |
| v8.9 onward | GlobalSign-issued certificate only |
The user manual attributes the GlobalSign certificate to the registration of the Notepad++ association with the appropriate government body. It recommends that users of v8.8.2 to v8.8.9 upgrade immediately.[13] The project advises removing the self-signed root certificate wherever it was installed.[3] For deployment, check the GlobalSign Authenticode signature, or the GPG signature and the SHA-256 digests published with each release, before a package enters the software library.[17] Catalog proof: Release binaries signed with GlobalSign certificate and GPG release key.
Platform support and lifecycle
The project’s supported-systems table lists Windows 8.1, 10 and 11 as supported. The current version still runs on Windows 7 and 8 without support. Windows Vista and Server 2008 stop at v8.4.6, except for GCC builds, and Windows XP and Server 2003 stop at v7.9.2. Bugs present only on unsupported systems are not treated.[16] The project publishes no end-of-life dates for its own releases. Vulnerabilities are fixed in new releases, so running the current release is the practical supported state.[17] Catalog proof: Supported only on Windows 8.1, 10 and 11.
SAM practice
- Discovery. Look for the editor in the standard installation directories and for portable copies anywhere users can write. Look for plugins under
plugins\<name>\<name>.dllin each installation.[1] - Plugin licence register. Plugins Admin records author and repository but not licence, so the licence of each plugin found in use has to be recorded from its own source.[2] See license compliance.
- Controlled updates. Deploy the MSI or the silent exe installer. Decide whether WinGUp stays enabled, and remove the self-signed root certificate where it was installed.[8][12][3]
- Procurement records. Notepad++ is classified EAR99 for export purposes, and a VPAT is offered for US accessibility requirements.[3] Catalog proof: Export classification EAR99.
Out of scope
- The licences of individual plugins, which vary by author and were not surveyed.
- Configuration files, themes and user-defined language files shared by the community.
- Third-party repackaged installers and download sites, which the project does not endorse.