Lably
Skip to content

Notepad++

Text editor and source code editor for Windows

  • 8 min read
  • 3 chapters

Related on Lably

Through Microsoft Windows, Free and open-source software and Computer science

Lab · Class 6–8Astronomy at Jantar MantarLab · Class 6–8The Science of CookingLabLetter to NaniLabBig & Little House

Notepad++ is released as free and open-source software under a GNU General Public License (GPL) 3.0 or later. The project was originally hosted on the SourceForge software repository (2003–2010), from where it was downloaded over 28 million times, and twice won the SourceForge Community Choice Award for Best Developer Tool. The project moved to TuxFamily (2010–2015), and then to GitHub (2015–present). Notepad++ uses the Scintilla editor component. It supports Windows DirectWrite and all major Windows color font formats (COLRv0, COLRv1, and OpenType SVG).

History

Notepad++ development began in September 2003 by Don Ho, a former computer science student of Paris Diderot University. Ho first used JEXT (a Java-based text editor) at his company but, dissatisfied with its poor performance, he began to develop a text editor written in C++ with Scintilla. He developed it in his spare time since the idea was rejected by his company. Notepad++ was built as a Microsoft Windows application; the developer considered, but rejected, the idea of using wxWidgets to port it to the Mac OS X and Unix platforms.

Notepad++ was first released on SourceForge on 25 November 2003, as a Windows-only application. It is based on the Scintilla editor component, and is written in C++ with only Windows API (Win32) application programming interface (API) calls using only the Standard Template Library (STL) to increase performance and reduce program size.

In January 2010 the US government obliged US-based open source project hosts to deny access from Cuba, Iran, North Korea, Sudan, and Syria to comply with U.S. law. As a response to what the developer felt was a violation of the free and open-source software (FOSS) philosophy, in June 2010 Notepad++ moved out of US territorial jurisdiction by releasing a version on TuxFamily, in France. Some community services of Notepad++ (such as the forums and bug tracker) remained on SourceForge until 2015 when Notepad++ left SourceForge completely.

In 2011 Lifehacker described Notepad++ as "The Best Programming Text Editor for Windows", stating that "if you prefer a simple, lightweight, and extensible programming plain-text editor, our first choice is the free, open-source Notepad++". Lifehacker criticized its user interface, stating that "It is, in fact, fairly ugly. Luckily you can do a lot to customize its looks, and what it lacks in polish, it makes up for in functionality".

In 2014 Lifehacker readers voted Notepad++ as the "Most Popular Text Editor", with 40% of the 16,294 respondents specifying it as their most-loved editor. The Lifehacker team summarized the program as being "fast, flexible, feature-packed, and completely free".

In 2015 Stack Overflow conducted a worldwide Developer Survey, and Notepad++ was voted as the most used text editor worldwide with 34.7% of the 26,086 respondents claiming to use it daily. Stack Overflow noted that "The more things change, the more likely it is those things are written in JavaScript with NotePad++ on a Windows machine". The 2016 survey had Notepad++ at 35.6%.

In 2015, in response to the staff hijacking of projects hosted on SourceForge, Notepad++ left SourceForge completely with the forums being moved to NodeBB and the bug tracker to GitHub. In 2019, the website, notepad-plus-plus.org, moved to Hostinger.

In March 2017 it was revealed through WikiLeaks that CIA hacking tools used Notepad++, because of its popularity, to hide malware in a modified library named scilexer.dll. Notepad++ was subsequently hardened against modified DLLs.

Update chain hijacking

In 2025, state-sponsored hackers (suspected to be Chinese APT31) hijacked the update functionality for Notepad++ by compromising its hosting provider. Organizations in East Asia were targeted, redirecting their updates to malicious servers for several months to deliver malware. The issue was resolved by migrating to a more secure host and enforcing stronger update verification. The mechanism of the attack involved a modification to the Notepad++ updater, gup.exe, with the modification introduced in Notepad++ version 8.8.8, where the executable obtains the latest application version from https://notepad-plus-plus.org/update/getDownloadUrl.php and retrieves the update URL from a file named gup.xml, with the retrieved file then saved to a temporary directory and executed; this connection could be TLS intercepted at the ISP level, allowing the download to be redirected to any URL, and although legitimate update files use a self-signed root certificate, the updater does not perform thorough checks for tampering. As a result, gup.exe executes a malicious payload named update.exe obtained from a malicious server, containing a NSIS installer which creates the %AppData%\Bluetooth\ directory, extracts four files, sets the directory to hidden, and executes BluetoothService.exe within the resulting payload. This then sideloads a malicious DLL which loads the shellcode file into memory, and then decrypts and executes it, allowing command and control over the computer by an attacker using a web interface.

Sign in to keep reading

2 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970X (social network)American social networking serviceWayback MachineDigital archive by the Internet ArchivePython (programming language)General-purpose programming languageMacOSOperating system for Apple computersUnicodeCharacter encoding standard