Software Bundle on Windows

This guide walks you through installing the TrustDID software bundle on Windows. The download is a single signed installer (setup.exe) — running it copies the binaries, generates local TLS certificates, registers and starts the TrustDID Windows service, and optionally adds a right-click menu and a PATH entry. After it finishes you'll run trustdid-setup.exe once to activate your identity using the token and UUID we emailed you at enrolment.

The installer and binaries are digitally signed by TrustDID Solutions Inc.

The whole thing takes about three minutes for Free and Professional tiers, five minutes for Business once you have your domain and DNS access ready.

Before you start

You need:

1. The installer for your tier — download the trustdid-…-windows-amd64-setup.exe for your tier from the Downloads page.
2. An enrolment email — for paid tiers, the email contains your activation token and customer UUID. Free tier skips this.
3. Local Administrator on the target machine — the installer elevates via the Windows UAC prompt so it can write to C:\Program Files\TrustDID\ and register a Windows service.

Step 1: Run the installer

1. In your Downloads folder, double-click the file you downloaded, e.g. trustdid-prof-annual-windows-amd64-setup.exe (or your tier's name).

2. New-publisher warnings — expected, and safe to proceed. Because TrustDID is a new company, Windows warns about the download before it warns about running it. You may see any of these:

   • In your browser's download list, "isn't commonly downloaded" — open the … menu beside the file and choose Keep.
   • SmartScreen then asks again. The visible button is Delete; open the arrow beside it and choose Keep anyway.
   • On first run, SmartScreen may show "Windows protected your PC" — click More info → Run anyway.

   Check the Publisher line before you proceed. It must read TrustDID Solutions Inc. That line is the signature, verified by Windows against our code-signing certificate — it is the part a forger cannot fake. If it says anything else, or is missing, stop and email support@trustdid.ca.

   These warnings are about download reputation, not about the signature: SmartScreen also asks how many people have downloaded a file before, and a new certificate starts at zero. They fade as the count grows. There are annotated screenshots of both dialogs on the downloads page.

3. Approve the User Account Control prompt — the installer needs admin rights to install for all users and register the service.

Step 2: Choose your options in the wizard

The wizard finishes in well under a minute. Click through the pages:

1. Welcome → Next.
2. License Agreement → accept and Next.
3. Select Additional Tasks — two choices worth knowing:
   • Add right-click Explorer menu (Verify / Sign / Encrypt / Decrypt — the exact entries depend on your tier). Checked by default; recommended.
     • Restore the classic Windows 11 right-click menu — optional sub-option. Check it if you want the TrustDID entries to appear directly instead of behind Show more options.
   • Add TrustDID to the system PATH — unchecked by default; we recommend checking it so you can run trustdid, trustdid-verify, etc. from any terminal.
4. Ready to Install → Install. The installer copies the binaries, generates a local-only TLS certificate for https://localhost:8080, and registers and starts the TrustDID Windows service.
5. Completing — there's a "Run initial identity setup now" checkbox. Uncheck it for now — we'll activate in Step 3 so you can follow the per-tier instructions first. Click Finish.

What the installer does

For reference — every step is automated and you don't need to do these manually:

Step 3: Activate your identity

The software is installed but doesn't have an identity yet. To activate, you run trustdid-setup.exe with the token + UUID from your enrolment email. There is no license key to type in — --managed mode generates your keys, publishes your DID, and pulls your license straight from the API in one step.

1. Open File Explorer and go to C:\Program Files\TrustDID\, then double-click trustdid-setup.exe. (If you enabled PATH, you can instead run trustdid-setup from any terminal.)
2. If SmartScreen warns on first run, click More info → Run anyway. The binaries are signed by TrustDID Solutions Inc.; as a new publisher, SmartScreen may still prompt until our reputation builds.

3. Follow the prompts.

   • Professional / Starter / Business — run trustdid-setup --managed YOUR_TOKEN YOUR_ID with the token and ID from your enrolment email. One command covers all three; your account type is detected from the token. Step 1 of the Small Business guide walks through the prompts and the self-managed alternative.
   • Member of a business — your admin's invite email carries the same one-line command with an invite instead of a business token. It creates your own keys on this PC, publishes your identity under the business, and stores your personal token. Shared profiles your admin grants you arrive on their own once the service runs (or now, with trustdid-setup --sync).
   • Enterprise — your account manager will have provided a dedicated onboarding guide.
   • Free — no token needed. Just run trustdid-setup.exe and answer the prompts; you'll get a public test identity for trying out signing and verification.

4. When setup finishes, run trustdid status in a fresh terminal. You should see your DID, your tier, and license: ok (or license: free on Free).

You're now signed-in and the local service is ready for plugins.

Step 4: Check your installation

Run:

trustdid-check
            

It validates your keys, configuration, DID publication, DNS records, the local service, and any configured trust registries in one pass, printing a line per check. Run it any time something feels off — it's the fastest way to find out which piece is missing.

Add a registry you trust

Verification answers two questions: is the document genuine, and who vouches for the signer? The second answer comes from the trust registries your verifier consults. To add one:

trustdid-setup --add-trusted-registry REGISTRY_DID
            

Use trustdid-setup --list-trusted-registries to see what's configured and trustdid-setup --remove-trusted-registry REGISTRY_DID to drop one. After adding, trustdid-check re-validates every configured registry — it resolves the registry's DID, probes its TRQP v2.0 endpoint, and reports whether the registry is public or private (private registries require a query token from the registry owner).

Not the same flag: trustdid-setup --add-trust-registry (no "ed") publishes your own claimed affiliation in your DID document. It carries no trust weight by itself and does not affect which registries your verifier consults — that's what --add-trusted-registry is for.

What landed where

After the install + activate sequence:

C:\Program Files\TrustDID\
            ├── trustdid.exe              CLI for signing and identity management
            ├── trustdid-setup.exe        Identity setup and license activation
            ├── trustdid-service.exe      Local API + static server (8080 / 8000)
            ├── trustdid-verify.exe       Offline .vrfy verifier
            ├── trustdid-check.exe        Environment and trust-registry checker
            ├── trustdid-keytool.exe      Key generation and rotation
            ├── trustdid-sign.exe         Signing CLI
            ├── trustdid-encrypt.exe      Optional, paid tiers
            ├── trustdid-decrypt.exe      Optional, paid tiers
            ├── outlook-plugin\           Outlook add-in (Professional and up)
            ├── manifest.json             What this bundle ships
            ├── LICENSE.txt
            └── logs\

            %USERPROFILE%\.trustdid\
            ├── config.json               Your identity, service binding
            ├── license.json              Pulled from the API by trustdid-setup --managed
            └── keys\                     Your private keys (Ed25519 / X25519 / ML-DSA-44)
            

The Windows service TrustDID is registered and starts automatically with the machine. Run trustdid-service status to check it.

To remove TrustDID later, use Settings → Apps → Installed apps → TrustDID → Uninstall (or Add or Remove Programs). The uninstaller stops the service, removes the context menu and PATH entry, and deletes the program files; your identity and keys under %USERPROFILE%\.trustdid\ are kept unless you choose to remove them.

Troubleshooting

SmartScreen or your browser warns about the installer. Expected for a new publisher. The installer is signed by TrustDID Solutions Inc. — choose Keep in the browser and More info → Run anyway in SmartScreen. The warning fades as download volume grows.

trustdid status reports "license: invalid" or "license: missing". The license file at %USERPROFILE%\.trustdid\license.json is missing, expired, or doesn't match your DID. Re-run the trustdid-setup --managed YOUR_TOKEN YOUR_ID activation to pull a fresh license. If that doesn't work, contact support@trustdid.ca with your enrolment receipt and we'll re-issue.

Browser shows "ERR_CERT_AUTHORITY_INVALID" at https://localhost:8080. Expected on first run. The service uses a local self-signed certificate that the installer generated and which never leaves your machine. Click Advanced → Proceed to localhost (unsafe).

trustdid is not recognised. PATH didn't pick up. You left the Add TrustDID to the system PATH task unchecked during install, or you opened the terminal before install finished. Re-run the installer and tick that task, or open a fresh Command Prompt / PowerShell window — existing terminals still hold the old environment.

The Windows service won't start. Open an elevated PowerShell and run trustdid-service status. It tells you whether the certificate is missing, the binding port is in use, or the config file is malformed. Most often it's a port conflict; edit %USERPROFILE%\.trustdid\config.json and change service.bind to 127.0.0.1:18080 or any free port.

Next: install a plugin

The bundle gives you the CLI and the service. To sign and verify inside your daily tools, install the matching plugin:

• Outlook on Windows — the add-in is already bundled at C:\Program Files\TrustDID\outlook-plugin\; this guide shows how to add it in Outlook.
• Chrome / Edge
• Firefox
• Thunderbird

Each plugin's online guide has its own walkthrough.