Software Bundle on Windows

This guide walks you through installing the TrustDID software bundle on Windows. There are two downloads, each a single signed installer (setup.exe):

Free — the verifier only. It checks sealed documents; there is no account and nothing to activate.
Suite — every TrustDID tool, for every plan. Your plan's license decides which tools run, so moving to another plan never means a new download.

The installer and binaries are digitally signed by TrustDID Solutions Inc.

Installing takes a couple of minutes. Activating a plan takes a few more, and longer if your identity lives on your own domain, because you publish DNS records.

Before you start

You need:

The installer — trustdid-free-windows-amd64-setup.exe or trustdid-suite-windows-amd64-setup.exe, from the Downloads page.
For a plan: your enrolment email — it contains your activation token and ID. Free skips this.
Local Administrator on the target machine — the installer elevates via the Windows UAC prompt so it can write to C:\Program Files\TrustDID\ and register a Windows service.

Step 1: Run the installer

In your Downloads folder, double-click the file you downloaded: trustdid-suite-windows-amd64-setup.exe (or trustdid-free-… for Free).
Check who signed it, if you want to be sure. Right-click the file → Properties → Digital Signatures. The signer must read TrustDID Solutions Inc. That signature is the part a forger cannot fake. If it says anything else, or the tab is missing, stop and email support@trustdid.ca.
Approve the User Account Control prompt — the installer needs admin rights to install for all users and register the service.

Step 2: Choose your options in the wizard

The wizard finishes in well under a minute. Click through the pages:

Welcome → Next.
License Agreement → accept and Next.
Select Additional Tasks — Add right-click Explorer menu: Verify on Free; Verify / Sign / Encrypt / Decrypt on Suite. Checked by default; recommended.
- Restore the classic Windows 11 right-click menu — optional sub-option. Check it if you want the TrustDID entries to appear directly instead of behind Show more options.
Ready to Install → Install. The installer copies the binaries and adds the install folder to the system PATH. On Suite it also generates a local-only TLS certificate for https://localhost:8080 and registers and starts the TrustDID Windows service.
Completing — Suite shows a "Run initial identity setup now" checkbox. Uncheck it for now — we'll activate in Step 3 so you have your token at hand. Click Finish.

What the installer does

For reference — every step is automated and you don't need to do these manually:

Step	What happens
Files	Creates `C:\Program Files\TrustDID\` and `\logs\`, and copies the binaries listed in the bundle's `manifest.json`.
PATH	Adds `C:\Program Files\TrustDID\` to the system `PATH`, so every tool runs from any new terminal.
Outlook	Suite: lays down the Outlook add-in under `C:\Program Files\TrustDID\outlook-plugin\`.
Certificate	Suite: generates a local-only TLS certificate for `https://localhost:8080` so browsers and Outlook can talk to the service.
Service	Suite: registers and starts the TrustDID Windows service so the local API runs at boot.
File types	Associates `.vrfy` files with TrustDID (Suite adds `.enc`), and registers the right-click menu if you kept it checked.

Step 3: Activate your identity

On Free there is nothing to activate — right-click a file and choose Verify with TrustDID, or run trustdid-verify FILE, and skip to Next: install a plugin.

On Suite, the software is installed but doesn't have an identity yet. To activate, you run trustdid-setup.exe with the token + ID from your enrolment email. There is no license key to type in — --managed mode generates your keys, publishes your DID, and pulls your license straight from the API in one step.

Open File Explorer and go to C:\Program Files\TrustDID\, then double-click trustdid-setup.exe. (Or run trustdid-setup from any new terminal.)
Follow the prompts.
- Any plan — run trustdid-setup --managed YOUR_TOKEN YOUR_ID with the token and ID from your enrolment email. One command covers every plan; your account type is detected from the token. Step 1 of the Small Business guide walks through the prompts and the self-managed alternative.
- Member of a business — your admin's invite email carries the same one-line command with an invite instead of a business token. It creates your own keys on this PC, publishes your identity under the business, and stores your personal token. Shared profiles your admin grants you arrive on their own once the service runs (or now, with trustdid-setup --sync).
- Enterprise — your account manager will have provided a dedicated onboarding guide.

You're now signed-in and the local service is ready for plugins.

Your plan and the Suite

The Suite installs every tool, and your license decides which ones run. A tool your plan doesn't include tells you so when you start it — for example "Encryption is not included in your Starter plan" — with a link to compare plans. After you change plans, refresh this computer's license:

trustdid-setup --pull

No reinstall is needed.

Step 4: Check your installation

Run:

trustdid-check

It validates your keys, configuration, DID publication, DNS records, your license, and any configured trust registries in one pass, printing a line per check. Run it any time something feels off — it's the fastest way to find out which piece is missing.

Add a registry you trust

Verification answers two questions: is the document genuine, and who vouches for the signer? The second answer comes from the trust registries your verifier consults. To add one:

trustdid-setup --add-trusted-registry REGISTRY_DID

Use trustdid-setup --list-trusted-registries to see what's configured and trustdid-setup --remove-trusted-registry REGISTRY_DID to drop one. After adding, trustdid-check re-validates every configured registry — it resolves the registry's DID, probes its TRQP v2.0 endpoint, and reports whether the registry is public or private (private registries require a query token from the registry owner).

Not the same flag: trustdid-setup --add-trust-registry (no "ed") publishes your own claimed affiliation in your DID document. It carries no trust weight by itself and does not affect which registries your verifier consults — that's what --add-trusted-registry is for.

What landed where

After the Suite install + activate sequence (Free installs trustdid-verify.exe only):

C:\Program Files\TrustDID\
            ├── trustdid-setup.exe        Identity setup and license activation
            ├── trustdid-service.exe      Local API + static server (8080 / 8000)
            ├── trustdid-verify.exe       Offline .vrfy verifier
            ├── trustdid-check.exe        Installation and trust-registry checker
            ├── trustdid-keytool.exe      Key generation and rotation
            ├── trustdid-sign.exe         Seal a file
            ├── trustdid-sign-dir.exe     Seal every file in a folder
            ├── trustdid-encrypt.exe      Encrypt for one or more DIDs
            ├── trustdid-decrypt.exe      Decrypt what was sent to you
            ├── trustdid-profile.exe      Manage signing profiles
            ├── trustdid-test-local.exe   Self-test of this installation
            ├── outlook-plugin\           Outlook add-in
            ├── manifest.json             What this bundle ships
            └── logs\

            %USERPROFILE%\.trustdid\
            ├── config.json               Your profiles and service settings
            ├── identities\               Each identity's license and token
            └── keys\                     Your private keys (Ed25519 / X25519 / ML-DSA-44)

The Windows service TrustDID is registered and starts automatically with the machine. Run trustdid-service status to check it.

To remove TrustDID later, use Settings → Apps → Installed apps → TrustDID → Uninstall (or Add or Remove Programs). The uninstaller stops the service, removes the context menu and PATH entry, and deletes the program files; your identity and keys under %USERPROFILE%\.trustdid\ are kept unless you choose to remove them.

Troubleshooting

A tool says your license is missing, expired or doesn't include it. Run trustdid-setup --pull to fetch your current license, then trustdid-check. If the tool isn't in your plan, the message links to the plans; if the license expired, renew and pull again. Still stuck? Contact support@trustdid.ca with your enrolment receipt and we'll re-issue.

Browser shows "ERR_CERT_AUTHORITY_INVALID" at https://localhost:8080. Expected on first run. The service uses a local self-signed certificate that the installer generated and which never leaves your machine. Click Advanced → Proceed to localhost (unsafe).

trustdid-verify is not recognised. The installer adds TrustDID to the system PATH, but terminals opened before it finished still hold the old environment. Open a fresh Command Prompt or PowerShell window.

The Windows service won't start. Open an elevated PowerShell and run trustdid-service status. It tells you whether the certificate is missing, the port is in use, or the config file is malformed. Most often it's a port conflict; edit %USERPROFILE%\.trustdid\config.json and set service.apiPort to a free port such as 18080.

Next: install a plugin

The bundle gives you the CLI and the service. To sign and verify inside your daily tools, install the matching plugin:

Outlook on Windows — the add-in is already bundled at C:\Program Files\TrustDID\outlook-plugin\; this guide shows how to add it in Outlook.
Chrome / Edge
Firefox
Thunderbird

Each plugin's online guide has its own walkthrough.