SignGUI

SignGUI: what it is

SignGUI is a small free Windows program from Briggs Softworks. It puts a graphical window in front of Microsoft’s SignTool.exe, the command-line utility that adds a digital signature to EXE, DLL and other files. Instead of remembering SignTool switches, you pick the file, the certificate, the timestamp server and the hash, and SignGUI runs SignTool for you.

It is useful when you sign a release now and then and do not want to maintain a build script, or when a colleague who is not a developer has to sign an installer. We have not installed or run it ourselves (Not tested yet); this page is based on the vendor’s product page, its FAQ and the headers of the official installer.

SignGUI at a glance

What you need before you start

• SignTool.exe. Microsoft does not offer it as a separate download. It comes with the Windows SDK and with several Microsoft development tools. The vendor’s FAQ gives an example path under Windows Kits\10\bin.
• A code signing certificate. It must be a code signing certificate; a TLS (website) certificate cannot be used for this. The vendor’s FAQ names Sectigo as one seller.
• A hardware token or a .pfx file. The FAQ says .pfx files are now obsolete: since 2023, code signing certificates are delivered on a hardware token (a USB device). If you have a token, leave the .pfx field empty.
• Token software. For a SafeNet token, the FAQ says to install the free SafeNet Authentication Client. When SignGUI runs SignTool, the client pops up and asks for the token password.

What SignGUI can do

• Run SignTool with the options you choose in a window, without typing the command line.
• Sign with a .pfx file or with a certificate on a hardware token.
• Add a timestamp from a timestamp server, including RFC 3161 servers and SHA-256 timestamps.
• Dual-sign a file with SHA-1 and SHA-256. The vendor’s FAQ describes two passes: the first with SHA-1 as the primary signature, the second with SHA-256 appended.
• Copy the token password to the clipboard so you can paste it into the SafeNet prompt.

How to get started

1. Install the Windows SDK, or find an existing signtool.exe of version 6.3 or later.
2. Download sgsetup.exe from the vendor’s page, run it, and choose an install folder.
3. Point SignGUI to signtool.exe, then choose the file you want to sign.
4. Select your certificate (a .pfx file, or leave it empty to use the token), a timestamp server and the hash, then sign.
5. Check the result in the file’s properties (Digital Signatures tab) before you publish the file.

Always sign a copy of the file first, and keep the unsigned original until you have checked the result.

Who it is for, and who should look elsewhere

• Good fit: a small team or a single developer who signs a few files at release time and wants a window instead of a command line.
• Look at other tools: automated builds. A build server should call SignTool, or a cloud signing service, directly from the pipeline. See also Advanced Installer, which has code signing built into its installer builds, and WoSignCode, another visual signing tool.
• Not the right tool: getting a certificate. SignGUI only signs; it does not sell or issue certificates.

Limitations to know

• It is a front end, so it does nothing without a working SignTool installation.
• The vendor’s page lists SignTool 6.3 or later, a certificate and Windows XP or later as requirements; it does not mention source code or an open-source licence.
• We found no independent reviews or published checksums for the installer. Download it only from briggsoft.com and compare the file with the vendor’s data (2.31 MB) before you run it.
• Do not store a token password in a script or in a shared note.

FAQ

Is SignGUI free?

Yes. The vendor calls it freeware. The certificate you sign with is not free, and SignTool comes separately from Microsoft.

Where do I get SignTool.exe?

From the Windows SDK, or from a Microsoft development tool you already have. Search your PC for signtool.exe first.

Does SignGUI work with a USB token?

Yes, according to the vendor’s FAQ: leave the .pfx field empty and enter the token password when the token software asks for it.

Can I sign with SHA-1 and SHA-256 together?

The vendor’s FAQ explains dual signing in two passes. SHA-1 is being phased out by Microsoft and other vendors, so for current Windows versions use SHA-256 unless you must support very old systems.

What is the latest SignGUI version?

On 13 November 2026 the vendor’s page showed version 1.30.

Sources

• SignGUI product page (Briggs Softworks)
• SignGUI FAQ (Briggs Softworks)
• SignTool (Microsoft Learn)