WoSignCode: what it is
WoSignCode (in Chinese, 沃通代码签名精灵) is a visual code signing tool published by WoSign, a Chinese certificate authority that is now part of WoTrus CA Limited. It signs Windows executables and driver files in a window, so you do not have to use the command line. The vendor says it can sign in batches, use several certificates on the same file and sign with both SHA-1 and SHA-2 certificates.
It is mainly meant for people who buy code signing certificates from WoSign. We have not installed or run it ourselves (Not tested yet), and the vendor page is written in Chinese, so this page reports what that page says and what we could check from outside.
WoSignCode at a glance
| Item | Details |
|---|---|
| Developer | WoSign (沃通), WoTrus CA Limited |
| Version | Not published on the vendor page. The installer file on the vendor’s server is dated 3 July 2025 |
| Licence | Free to download. No licence terms are shown on the download page |
| Platform | Windows XP and later, according to the vendor |
| Download size | wosigncode.exe, about 3.9 MB (4,101,000 bytes) |
| Language of the page | Chinese |
| Last verified | 13 November 2026, against wosign.com and the vendor’s download server |
What the vendor says it can do
- Sign executable files (EXE, DLL, SYS, OCX) and other files such as CAB and CAT.
- Two signing modes: application signing and kernel (driver) signing.
- Batch signing: select many files and sign them in one go.
- Several certificates on one file, including SHA-1 and SHA-2 dual signing.
- A built-in root certificate, so signing kernel drivers with a WoSign code signing certificate needs no cross-certificate import.
Things to think about before you use it
- It is built around WoSign certificates. The vendor presents the tool as part of its certificate shop. If your certificate comes from another authority, use SignTool or a tool such as SignGUI.
- SHA-1 is obsolete. Dual signing with SHA-1 was meant for old systems. The SignGUI FAQ notes that Microsoft and other vendors are phasing out SHA-1. For current Windows, SHA-2 (SHA-256) is what matters.
- Trust history. Mozilla’s public wiki lists confirmed issues with WoSign as a certificate authority between 2015 and 2016. That concerns WoSign’s issuing practices, not the signing tool, but it is a reason to check the current trust status of any WoSign certificate before you buy one.
- The page looks old. The tool page sits under a 2015 path and shows no version number, release notes or checksum. The installer file was last modified in July 2025.
How to get started, if you decide to use it
- Download
wosigncode.exeonly from the vendor’s own domain, using the link on the official WoSign page. - Scan the file with your security tools and run it first in a test virtual machine.
- Check the digital signature and publisher name of the installer in the file properties.
- Sign a copy of a test file with your own certificate and verify the result in the file properties (Digital Signatures tab).
- Only then use it on a release.
Who it is for, and who should look elsewhere
- Good fit: a customer of WoSign or WoTrus code signing certificates who wants the vendor’s own window for batch signing.
- Look elsewhere: if you use a certificate from another authority, want a documented, current tool, or need automated signing in a build. Microsoft SignTool is the standard. SignGUI adds a window in front of it, and Advanced Installer can sign the installers it builds.
Limitations to know
- No version number, release notes or published checksum for the installer.
- The vendor page is in Chinese; the manual is a separate Chinese document.
- We did not test whether it works on current Windows 11 builds.
- The vendor claims dual SHA-1/SHA-2 signing is a unique feature. We did not verify that claim, and SHA-1 signing is no longer useful on modern systems.
FAQ
Is WoSignCode free?
The installer can be downloaded without payment from the vendor’s server. A code signing certificate to use with it is a paid product from WoSign.
Does it work with certificates from other authorities?
The vendor page does not say. It describes the tool as a companion to WoSign certificates, so test with your own certificate first.
What is the version?
The vendor page shows no version. We list the date of the installer file on the vendor’s server: 3 July 2025.
Is it safe?
We have not tested it. Download it only from the vendor’s own domain, check the file signature and run it first in a test machine, as for any code signing tool, since such a tool handles your signing key.
Sources
- WoSignCode product page (WoSign, in Chinese)
- CA/WoSign Issues (MozillaWiki)
- SignGUI FAQ on SHA-1 and SHA-256 signing (Briggs Softworks)
