Sandboxie 5.73.8

Sandboxie: Windows Application Isolation for Browsers and Untrusted Software

Sandboxie is a Windows sandboxing utility that runs applications inside isolated boxes so that file system and registry changes stay contained. It is available as Sandboxie Plus and as Sandboxie Classic, with current builds Sandboxie Plus 1.18.8 and Classic 5.73.8. Changes made inside a box can be discarded or selectively committed, which makes it a lighter option than a full virtual machine for testing software or isolating risky activity.

Core functionality

• Process and file isolation: Applications run in a confined environment, so temporary files, registry writes and other system changes remain within the sandbox and can be discarded or selectively merged.
• Browser and download containment: Sessions, cookies and downloaded files stay inside a box, which limits persistent tracking and contains web-borne threats without altering the host browser profile.
• Side-by-side testing: Several versions of an application can be installed or launched concurrently without leaving traces in the operating system, which suits development, quality assurance and compatibility checks.
• Ephemeral sessions: Closing a sandbox removes artifacts and credentials left by sandboxed programs, which is useful on shared machines and for short-lived tasks.
• Configuration: Per-program rules, an INI editor, box-specific settings and selectors allow detailed tuning for compatibility and security.

Recent development

Version 1.18.8 focuses on browser compatibility, particularly video playback in sandboxed Firefox on services such as Netflix, Amazon Prime Video, Disney+, ESPN and TVNZ that query mediaCapabilities.decodingInfo() before playback begins. The same release reworks AppContainer handling, correcting missing permissions and overly restrictive substitute tokens that could stop child processes from starting. Microsoft Edge can use the corrected substitute token without UnRestrictAppContainerToken being enabled by default. It also fixes an out-of-bounds read in the GUI proxy's MapWindowPoints handler that could expose service heap data to sandboxed callers, and it corrects the Import Boxes workflow so users can choose where imported sandboxes are created.

• Version 1.18.7: Maintenance fixes for root protection IOCTL handling, the low integrity labeling mechanism, the monitor API, Base64 decoding and file renaming through API_RENAME_FILE.
• Version 1.18.6: Persian (Farsi) translations for SandMan, the Troubleshooting Wizard and the installer, corrected handling of URL-encoded characters in SBIE message links, more reliable updater behavior and a fix for a possible null pointer exception during driver unload.
• Version 1.17.x lines: Compatibility work for Electron-based applications, Firefox, Tor, Chromium variants, Microsoft Office and WebView2/Tauri apps, along with security hardening of password storage and updater integrity checks.

Advanced options and tools in 1.18.8

• The fixboxdacls command in KmdUtil.exe adds missing AppContainer access permissions to existing sandboxes.
• KeepBroadGroupsInAppContainerToken=n restores the earlier all-deny-only substitute token behavior.
• NeutralizeLowBoxToken=n allows direct NtCreateLowBoxToken calls to pass through.
• FakeAppContainerToken=n allows sandboxed programs to create genuine AppContainer child processes.

Intended users

1. Privacy-conscious desktop users who want to compartmentalize browsers and reduce persistent tracking without the overhead of virtual machines.
2. Developers and testers who need to run installers, portable applications or several software versions without affecting the host system.
3. IT administrators and advanced users who inspect untrusted files, run legacy applications or limit exposure on shared workstations.

Installation and upgrading

• Supported platforms: Windows 10 and Windows 11.
• Upgrade procedure: If an update installation causes problems, uninstall the previous version while keeping sandboxie.ini, then install the new build.
• Source and support: Sandboxie Plus is developed openly on GitHub, where releases and change logs are published. The project accepts donations.

Performance and limitations

Sandboxie generally adds less overhead than full virtualization, and it performs close to native speed in common desktop tasks. Some low-level drivers, closely integrated system services and specialized hardware may require configuration or may not work correctly inside a sandbox. Checking critical workflows after each upgrade is advisable, and the project's documentation covers application-specific workarounds.