WINDOWS PROCESS
ctfmon
Microsoft documents that ctfmon.exe manages the Text Services Framework on the desktop and provides the language bar. The Text Services Framework is the Windows service that delivers advanced text input and natural language technologies, such as input methods for other languages, to programs.
TECHNICAL SUMMARY
| Process | ctfmon.exe |
|---|---|
| Display name | CTF Loader |
| File | C:\Windows\System32\ctfmon.exe |
| Signed by | Microsoft Windows |
| Verdict | Leave it alone |
Paths, signer and service account observed on Windows 11 build 26300 on 1 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneEnding it can stop input methods, the language switcher and other text services from working in open programs until it starts again. On 64-bit Windows, Microsoft documents that a 32-bit and a 64-bit copy run side by side, each serving text services of its own kind, so two copies are normal.
What PC Tweaker does with it
PC Tweaker's priority rules refuse programs in the Windows folder and security software, so the app never changes this process's priority, and no control in the catalogue stops or edits it.
Check it yourself
See where it runs from
Protected processes hide their path from a normal window; run PowerShell as administrator to see it.
PowerShellGet-Process ctfmon -ErrorAction SilentlyContinue | Select-Object Id, PathCheck who signed the file
Expect Status: Valid and a certificate issued to Microsoft Windows. A file with this name anywhere else, or with another signer, deserves a closer look.
PowerShellGet-AuthenticodeSignature "C:\Windows\System32\ctfmon.exe" | Format-List Status, SignerCertificate
Common questions
What is CTF Loader?
CTF Loader is the name Task Manager shows for ctfmon.exe. Microsoft documents that it manages the Text Services Framework on the desktop and provides the language bar, which is how input methods for other languages reach your programs.
Is ctfmon.exe safe, or could it be a virus?
The genuine file is in C:\Windows\System32 and is signed by Microsoft Windows. A program can borrow a familiar name, so check where your copy runs from and who signed it with the commands in “Check it yourself”. A file with this name anywhere else, or with another signer, deserves a closer look.
Can I end ctfmon.exe?
Leave it alone. Ending it can stop input methods, the language switcher and other text services from working in open programs until it starts again. On 64-bit Windows, Microsoft documents that a 32-bit and a 64-bit copy run side by side, each serving text services of its own kind, so two copies are normal.
Why are there two ctfmon.exe processes?
On 64-bit Windows, Microsoft documents that a 32-bit and a 64-bit copy run side by side, each serving text services of its own kind, so two copies are normal.
What starts ctfmon.exe?
On the Windows 11 PC used for this page (build 26300, 11 November 2026), Task Scheduler listed a task named MsCtfMonitor under Microsoft, Windows, TextServicesFramework, which Windows describes as the “TextServicesFramework monitor task”. One ctfmon.exe was running, in the signed-in user's session, started by a service host (svchost.exe); the file was C:\Windows\System32\ctfmon.exe, 81,920 bytes, with a valid Microsoft Windows signature.