ctfmon.exe

Windows ProcessMicrosoft Corporation

Also called ctfmon, ctf loader, alternative input text input

WindowsSystem Component

CTF Loader. It starts the Text Services Framework that language bars, handwriting, and some alternative input use.

What you need to know

This is the language-bar loader. The same filename is a favorite malware costume.

ctfmon.exe is CTF Loader for the Text Services Framework. It belongs in System32. A ctfmon.exe in AppData is the classic fake. It is not TextInputHost.

Safe?: Yes, in System32
Do I need it?: Yes if you use an IME or the language bar
Malware name?: The filename is also abused

Feex says

I never trust ctfmon by the name alone. I open the path. System32 plus a Microsoft signature is the language bar. AppData is a different story.

What is ctfmon.exe?

ctfmon.exe is CTF Loader. It initializes the Text Services Framework so IMEs, handwriting, and the language bar can attach to apps.

What does it do?

It stays resident so the language bar can switch keyboards. It does not host the Windows 11 emoji panel. That is TextInputHost.exe.

Why is it running?

You have more than one input language, an IME, or an accessibility input service. A US-only PC can still start it because Windows leaves TSF available.

Is it safe?

Check the path

System32 and a Microsoft signature are the real loader. The filename is widely reused. Path first, then publisher. The name is not a verdict.

A legitimate copy normally runs from:

C:\Windows\System32\ctfmon.exe

Expected publisher: Microsoft Corporation
AppData copies are a common fake
Related to language bar, not emoji GIFs

Can I end it?

The language bar may vanish

Ending the System32 copy hides the language bar until it starts again. Ending an AppData copy is a malware step after you confirm the path.

Can I remove it?

Only a fake copy

Do not delete System32\ctfmon.exe. Remove extra keyboards in Settings if you want a quieter bar. Quarantine only a copy that failed the path check.

Should it start with Windows?

Windows can start CTF Loader with the user session. That is expected for TSF. It is not Steam.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Low. A broken IME can spin it
Memory: Small
Disk: Low
Network: None for the Microsoft file

File information

ctfmon.exe file information
Executable name	ctfmon.exe
Common legitimate path	C:\Windows\System32\ctfmon.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Two ctfmon.exe rows

One in System32 and one elsewhere is a path investigation, not a "Windows needs two" story.

Language bar will not hide

Remove extra languages in Settings. Deleting ctfmon is the wrong hide button.

Troubleshooting

Diagnose before you change anything destructive.

Always open the folder

Task Manager > Open file location. System32 is the expected answer.

Repair TSF after a bad IME uninstall

A leftover IME can keep CTF busy. Remove the IME package, then reboot.

Technical details

ctfmon.exe technical details
Image name	ctfmon.exe
Role	CTF Loader / Text Services Framework

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Text Services Framework · CTF and TSF
Microsoft Support: Windows · Public support naming
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.