Blue screen of death

"BSOD" redirects here. For other uses, see BSOD (disambiguation).

Not to be confused with Black screen of death.

The blue screen of death in Windows 9x, as it appears on Windows Me

The blue screen of death (BSoD) – or blue screen error, blue screen, fatal error, bugcheck, and officially known as a stop error – is a critical error screen displayed by many iterations of Microsoft Windows operating systems. It is used to indicate a system crash, in which the operating system reaches a critical condition where it can no longer operate safely. Its name comes from the blue colored background used predominately on the error screens found in the majority of Windows releases, which was changed to black starting with Windows 11 version 24H2.

Possible issues contributing to a BSoD may include hardware failures, an issue with or without a device driver, viruses, malware, and other factors such as intentional user action.

History

Initial non-critical error screens

The boot screens of Windows 1.01 and 2.03 when running on an incorrect DOS version, displaying mojibake

Blue screen errors have been around since the first version of Windows in 1985. In the Beta Release of Windows 1.0, if it detects a version of DOS that is newer than the OS expects, the boot screen would have the text "Incorrect DOS version" alongside other messages detailing what check failed to pass appended into it before starting normally. This behavior remains in the final version released to retail (version 1.01); however, the remaining text messages were removed during development in the lead up to Windows 1.0's release, displaying mojibake instead. However, this is not a screen of death; when the operating system actually crashes, it either freezes or unexpectedly exits to DOS. This behavior is also present in Windows 2.0 and Windows 2.1.

Windows 3.0 uses a text-mode screen for displaying important system messages, usually from digital device drivers in 386 Enhanced Mode or other situations where a program could not run. Windows 3.1 changed the color of this screen from black to blue. It also displays a blue screen when the user presses the Ctrl+Alt+Delete key combination to bring up a rudimentary task manager, reserved for quitting any unresponsive programs if they are available. Like previous versions of Windows, Windows 3.x exits to DOS if an error condition is severe enough.

First critical error screens and contemporary releases

The original blue screen of death first appeared in Windows NT 3.1; this was a later version as it appears on the Italian version of Windows NT 3.51

The first BSoD to indicate a critical system error appeared in Windows NT 3.1 (the first version of the Windows NT family, released in 1993) and all subsequent releases. The error screens initially started with *** STOP: in its earlier iterations, hence it became known as a "stop error." This format was used on all Windows operating systems released afterwards, with various differences in later versions. Despite popular belief, there are no known genuine equivalents of a BSoD in the Windows Embedded Compact (formerly known as Windows CE) line of embedded operating systems.

BSoDs can be caused by poorly written device drivers or malfunctioning hardware, such as faulty memory, power supply problems, overheating of components, hardware running beyond its specification limits, or even ACPI compliance issues with the BIOS. In the Windows 9x line of operating systems, incompatible DLLs or bugs in the operating system kernel could also cause BSoDs. Because of the general instability and lack of memory protection in Windows 9x, BSoDs were much more common.

Color change and redesign

On June 26, 2025, Microsoft announced that the color of the blue screen of death would be officially changed to black alongside an overhaul of the design of the screen itself which will be present in Windows 11 version 24H2, saying that the new design will be "easier to navigate unexpected restarts and faster recoveries". Previously, this color change appeared on a few builds of Windows 11 (including the RTM) before reverting to a more different shade of blue in later builds prior to Windows 11 version 24H2. Notably, this change was made nearly a year after the 2024 CrowdStrike outages in July 2024, which caused blue screens to many computers in the business and enterprise segments running Windows due to an update bug.

Attribution

The rudimentary task manager screen from Windows 3.1x, often confused with the blue screen of death due to its similarities

On September 4, 2014, several online journals such as Business Insider, DailyTech, Engadget, Gizmodo, Lifehacker, Neowin, Softpedia, TechSpot, Boy Genius Report (BGR), The Register, and The Verge, as well as print and non-English sources like PC Authority and Austrian tech site FutureZone all attributed the creation of the blue screen of death to Steve Ballmer, the former CEO of Microsoft. The articles specifically cited a blog post by Microsoft employee Raymond Chen entitled "Who wrote the text for the Ctrl+Alt+Del dialog in Windows 3.1?", which focused on the creation of the first rudimentary task manager in Windows 3.x. The aforementioned task manager shared some visual similarities with a BSOD, with Ballmer writing the messages that appeared on the screen.

Chen took notice of the widespread misinformation and addressed the issue himself in a blog post on September 9, 2014. According to Chen, he was scathing on his evaluation of major tech news sites that had picked up on the incorrect story and performed poor or non-existent research that demonstrated complete ignorance of his original account. He indicated that, in addition to the faulty base story, over half a dozen significant sites had included other embellished or invented details in their stories, including incorrectly naming Chen as a Microsoft executive, treating Chen as an "official company spokesperson", and using unrelated images from Windows NT or Windows 95 as illustrations. In addition, he also pointed out a very special mention for the worst single distortion out of any misinformations, which belonged to BGR (Boy Genius Report), who "fabricated a scenario and posited it as real" in a rhetorical question to readers. He also found that several sources had conflated the creation of the BSoD with the fact that they occur, thus inverting cause and effect by implying that the invention of BSoDs caused fatal errors to occur instead of their actual, helpful function of giving the user information about a fatal error after the system has already become unrecoverable (such incorrect sources transitively blamed Ballmer for the existence of all fatal crashes in Windows). A day after his initial complaint, Chen would follow this up with another blog post on September 10, 2014, claiming responsibility for revising the BSoD in Windows 95. His post said in detail that he was the one who "sort of" created the BSoD in its first modern incarnation in Windows 95.

According to former Microsoft employee Dave Plummer, the BSoD in the Windows NT family was not based on the rudimentary task manager screen of Windows 3.x, but was actually designed by Microsoft developer John Vert. Additionally, Vert has also stated the reason why the error screens were given the color blue was because the universal color palette of the video hardware at that time was very rudimentary, and he personally used a MIPS OS box and SlickEdit for programming so that both the firmware and editor displayed white text on a blue background, making for a more consistent programming experience.

Formats

BSoDs originally showed silver (HTML color #A8A8A8) (and later white (HTML color #FFFFFF)) text on a royal blue (HTML color #0000A8 for Windows NT 3.1/3.5/3.51/4.0; HTML color #000080 for Windows 2000/XP/Vista/7) background with information about current memory values and register values. Starting with Windows Server 2012 (released in September 2012), Windows adopted a cerulean background (HTML color #1A67B3 for Windows 8/8.1 to Windows 10 version 1151; HTML color #0078D7 for Windows 10 versions 1607 to 22H2). Earlier versions of Windows 11 used a black background, which was changed to dark blue starting with build 22000.348 and then back to black with build 26120.3653. Preview builds of Windows 10, Windows 11, and Windows Server (available from the Windows Insider program) feature a dark green (HTML color #246F24) background instead of a blue one. Windows 3.1, 95, and 98 supports customizing the color of the screen whereas the color was hard-coded in the Windows NT family.

Windows 95, 98, and Me render their BSoDs in the 80×25 text mode with a 720×400 screen resolution. BSoDs in the Windows NT family initially used the 80×50 text mode with a 720×400 screen resolution, but were displayed in a 640×480 screen resolution starting with Windows 2000. BSoDs from Windows 8 and Windows Server 2012 onwards are rendered in higher resolutions than previous versions of Windows, specifically the highest screen resolution available on UEFI machines. On legacy BIOS machines, they use the 1024×768 resolution by default, but they can also be configured to use the highest resolution exposed by the firmware (via the highestmode parameter in Boot Configuration Data). Windows 95, 98, Me, and NT versions prior to Windows 2000 used text mode fonts provided by the graphics adapter; Windows 2000, XP, Vista and 7 used kernel mode fonts provided by the kernel's boot video driver bootvid.dll, which is a text mode-like font used in Windows 2000 and Lucida Console in Windows XP to 7; and Windows 8 and Windows Server 2012 onwards use the Segoe UI font.

Windows 10 builds 14316 and up uses the same format as Windows 8, but has a QR code which leads to a Microsoft Support web page that tries to help users troubleshoot the issue step-by-step. This format was retained in Windows 11, however build 26120.3291 onwards changes the layout to be more consistent with that of Windows 11's UI, removing the QR code among other changes.

Windows NT

The blue screen of death on Windows 2000

The blue screen of death on Windows XP, Windows Vista and Windows 7

A variation of the above format with memory dumping enabled, as well as extended parameters only found in 64-bit versions of Windows

In the Windows NT family of operating systems, the blue screen of death (referred to as "bug check" in the Windows software development kit and driver development kit documentation) occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This was usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation was to restart the computer. Because of this, data loss may occur since the restart was unplanned, and the user was not given an opportunity to save their work.

The text on the error screen contains the code of the error and its symbolic name (e.g. "0x0000001E, KMODE_EXCEPTION_NOT_HANDLED") along with four error-dependent values in parentheses that are there to help software engineers fix the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which was loaded at that address. Under Windows NT, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information was in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. By default, Windows will create a memory dump file when a stop error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "minidump" (introduced in Windows 2000) to a "complete dump" which was effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows, WinDBG or KD debuggers from Debugging Tools for Windows are used. A debugger was necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen was limited and thus possibly misleading, it may hide the true source of the error. By default, Windows XP was configured to save only a 64kB minidump when it encounters a stop error, and to then automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error. This happens only when the computer has a function called "Auto Restart" enabled, which can be disabled in the Control Panel which in turn shows the stop error.

Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. If a stop error was encountered while a live kernel debugger was attached to the system, Windows will halt execution and cause the debugger to break in, rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

A BSoD can also be caused by a critical boot loader error, where the operating system was unable to access the boot partition due to incorrect storage drivers, a damaged file system or similar problems. The error code in this situation was STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there was no memory dump saved. Since the system was unable to boot from the hard drive in this situation, correction of the problem often requires using the repair tools found on the Windows installation disc.

Details

Earlier versions (NT, 2000, XP, Vista, 7)

BSoDs in the Windows NT family before the release of Windows 8 and Windows Server 2012 displayed the error name in uppercase (e.g. APC_INDEX_MISMATCH) and its respective hexadecimal error number (e.g. 0x00000001), along with four parameters. This was shown together in the following format:

error code (parameter 1, parameter 2, parameter 3, parameter 4)
error name

Depending on the error number and its nature, all, some, or even none of the parameters contain data pertaining to what went wrong, and/or where it happened. In addition, starting with Windows 2000 onwards, the error screens showed up to four paragraphs of general explanation and advice and may have included other technical data such the file name of the culprit and memory addresses.

The following is a re-creation of the BSoD from Windows 2000, although they somewhat vary:

*** STOP: 0x00000001 (0x00000000,0x00000000,0x00000000,0x00000000)
APC_INDEX_MISMATCH

If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows 2000 updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Refer to your Getting Started manual for more information on
troubleshooting Stop errors.

In rare cases, the BSOD would be truncated, sometimes not showing the error name, codes, or the four paragraphs of advice. Instead, it would often show different formats of the error screen depending on the type of error that occurred. For instance, BSoDs related to the termination of the Winlogon process (e.g. "0xC000021A, WINLOGON_FATAL_ERROR") displayed the following message in this format:

STOP: c000021a {Fatal System Error}
The Windows Logon Process/SubSystem system process terminated unexpectedly
with a status of parameter 1 (parameter 2 parameter 3).
The system has been shut down.

On Windows 2000, the above message was sometimes displayed alongside the four paragraphs of general instructions and advice, the latter of which is absent on Windows XP to Windows 7.

Another example was that when Windows finds a corrupt registry file that was critical to the operating system (e.g. "0xC0000218, STATUS_CANNOT_LOAD_REGISTRY_FILE"), it would display the following message:

STOP: c0000218 {Registry File Failure}
The registry cannot load the hive
(file):\SystemRoot\System\Config\SOFTWARE
or its log or alternate.
It is corrupt, absent, or not writable.

Also, hardware errors that can prevent Windows from booting properly will also display this rare message (This example is 0x00000080 (NMI_HARDWARE_FAILURE); note that the error code was not shown in this example below):

Hardware Malfunction
Call your hardware vendor for support.
NMI: Parity Check / Memory Parity Error
The system has halted.

Certain error codes on the BSoD would also replace the error name with a description describing what kind of error that has happened. For example, BSoDs with error code 0x000000F4 (CRITICAL_OBJECT_TERMINATION) would have the text "A process or thread crucial to system operation has unexpectedly exited or been terminated" displayed in place of the error name, and BSoDs with error code 0x000000E2 (MANUALLY_INITIATED_CRASH) would also replace the error name with the text "The user manually initiated the crash dump".

With the release of Windows XP, the layout of the BSoD was slightly altered, which would remain in use for subsequent versions of Windows until Windows 8. Specifically, the hexadecimal error number and the four parameters were moved to the bottom of the screen after the four paragraphs under the label "Technical information:". The message about referring the user to the Getting Started manual for troubleshooting BSoDs (referred to as "stop errors") was also removed, and references to Windows 2000 were shortened to simply say Windows. The error screens also began with the now-infamous message:

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The following is a re-creation of the BSoD from Windows XP to Windows 7, although they somewhat vary:

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

APC_INDEX_MISMATCH

If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x00000001 (0x00000000,0x00000000,0x00000000,0x00000000)

From Windows 2000 onwards, system memory dumps are automatically performed, usually in the form of a 64 KB "minidump" by default. When this happens, the BSoD on Windows 2000 will display the following message that replaces the four paragraphs of general instructions and advice, which can also be seen when "Write an event to the system log" and/or "Send an administrative alert" is checked in the "System Failure" section under "Startup and Recovery" in System Properties even when system memory dumps are disabled:

Beginning dump of physical memory
Physical memory dump complete. Contact your system administrator or
technical support group.

On Windows XP to Windows 7, the above message remains the same, but with some slight modifications, and is displayed after the four paragraphs of general advice, which were hidden on Windows 2000 when a memory dump is performed:

Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further
assistance.

Also, in most instances when performing system memory dumps on the BSoD from Windows XP to Windows 7, the following messages are displayed along with an indicator showing the progress of the memory dumps:

Collecting data for crash dump ...
Initializing disk for crash dump ...
Beginning dump of physical memory.
Dumping physical memory to disk:  100

Upon completion of the memory dumps, the following message is then displayed on screen:

Physical memory dump complete.
Contact your system admin or technical support group for further assistance.

Additionally, on versions of Windows using the 64-bit architecture, the BSoD would have the four parameters extended to sixteen digits ("0x0000000000000000") instead of eight ("0x00000000").

Later versions (Server 2012 and 8 onwards)

The blue screen of death on Windows 8, Windows 8.1 and Windows 10 (RTM–v1511), which includes a sad emoticon

The blue screen of death on Windows 10 (v1607–1909), which includes a QR code for troubleshooting

The blue screen of death on Windows 10 (v2004–22H2) and Windows 11 (build 22000.348–26120.3653), which changed references of "PC" to "device"

With the release of Windows 8 and Windows Server 2012, the BSoD was significantly changed, removing all of the above in favor of the error name and a concise description. Windows 8 also adds a sad emoticon to the error screen, which was absent from Japanese releases or its Windows Server counterparts. The hexadecimal error code and parameters can still be found in the Windows Event Log or in memory dumps.

The main text that is displayed on the screen by default is read as follows:

Your PC/device ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you.

The above message can change depending on whether or not automatic restart or memory dumps are enabled or disabled. For example, if the automatic restart functionality is disabled but memory dumping is enabled, then the above message is altered to read this:

Your PC/device ran into a problem and needs to restart. We're just collecting some error info, and then you can restart.

As well, if memory dumping is disabled, then the same message is altered to read this:

Your PC/device ran into a problem and needs to restart. We'll restart for you.

Then, if both the automatic restart functionality and memory dumping are disabled, then the following message would be displayed instead:

Your PC/device ran into a problem and needs to restart. You can restart.

In both of these last two examples, a percentage completion (e.g. "100% complete") which shows the progress of the memory dumps being performed is absent when memory dumping is disabled.

In some cases, BSoDs would use a truncated or slightly altered format from previous BSoDs. For instance, BSoDs relating to Winlogon termination may have the aforementioned hexadecimal error code in place of the error name. Hardware errors causing an BSoD also uses the same format as the normal BSoD, including the use of the error name instead of an error code. One such example are BSoDs with the error name "NMI_HARDWARE_FAILURE" (error code 0x00000080).

The blue screen of death on Windows 11 (builds 22000.51–22000.346), which used a black background instead of blue (except for the QR code)

The blue screen of death on Windows 11 (build 26100.6584), which reverts back to a black background instead of blue and removes the QR code and sad emoticon as well as changes to the layout, with an error code featuring hexadecimal numbers in parentheses

The format introduced with Windows Server 2012 and Windows 8 was retained in Windows 10 and Windows 11 (as well as its Server counterparts). Beginning with build 14316 of Windows 10 version 1607, a QR code was added to the screen for quick troubleshooting, while all references to the word "PC" were changed to "device" starting from Windows 10 version 2004 onwards. Build 26120.3291 of Windows 11 version 24H2 made a complete overhaul to the format of the BSoD, changing the layout to be more consistent with the design language of Windows 11 while removing the QR code and the sad emoticon completely. The hexadecimal error code (but not the parameters) returned and is shown after the error name, but without the leading zeroes (e.g. 0x00000001 (APC_INDEX_MISMATCH) becoming 0x01).

Windows 9x

The blue screen of death in Windows 9x, as it appears on Windows 95 and Windows 98

The Windows 9x line of operating systems used the blue screen of death as the main way for virtual device drivers to report errors to the user. This version of the BSoD, internally referred to as "_VWIN32_FaultPopup", gives the user the option either to restart the computer or to terminate the current running program and continue using Windows, allowing the user to save their work before any data could be lost. Depending on the type of situation it may have occurred, however, the options to either continue or restart may or may not work at all. This is in contrast to the BSoDs in the Windows NT family, which prevented the user from using the computer until it has been powered off or restarted (usually automatic for the latter).

The most common BSoD was displayed on an 80×25 text-mode screen, which was the operating system's way of reporting an interrupt caused by a processor exception; it is a more serious form of the general protection fault dialog boxes. The memory address of the error was given and the error type was a hexadecimal number from 00 to 11 (0 to 17 decimal). The error codes are as follows:

• 00: Division fault
• 01: Startup Error
• 02: Non-Maskable Interrupt
• 03: Shutdown Error
• 04: Overflow Trap
• 05: Bounds Check Fault
• 06: Invalid Opcode Fault
• 07: "Coprocessor Not Available" Fault
• 08: Double Fault
• 09: Coprocessor Segment Overrun
• 0A: Invalid Task State Segment Fault
• 0B: Not Present Fault
• 0C: Stack Fault
• 0D: General Protection Fault
• 0E: Page Fault
• 0F: Error Message Limit Exceed
• 10: Coprocessor Error Fault
• 11: Alignment Check Fault

The following situations below can cause a BSoD:

• Missing or different dependency versions (VC++, .NET, DirectX).
• Faulty or poorly written kernel-level device drivers.
• Corrupted Windows core files.
• Misconfigured registry keys.
• Hardware incompatibilities.
• Damaged hardware such as a failing memory, storage device or graphics card can also cause a BSoD.

In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con", "c:\aux\aux", or "c:\prn\prn" on the hard drive, which can be inserted on a website to crash visitors' machines as a prank. In reality, however, they are reserved device names for DOS systems; attempting to access them from Windows causes a crash, bringing up said BSoD. Creating the aforementioned directories within Windows will also not work and may cause the same BSOD to occur. On March 16, 2000, Microsoft released a security update to resolve this issue.

One famous instance of a Windows 9x BSoD occurred during a presentation of a Windows 98 beta given by Bill Gates at COMDEX on April 20, 1998: The demo PC crashed with a BSoD when his assistant, Chris Capossela, connected a scanner to the PC to demonstrate Windows 98's support for Plug and Play devices. This event brought thunderous applause from the crowd and Gates replied (after a nervous pause): "That must be why we're not shipping Windows 98 yet."

Similar screens

"Red Screen of Death" redirects here. The term may also refer to an error message used on the PS one and PlayStation 2 systems.

Stop errors are comparable to kernel panics in macOS, Linux, and other Unix-like systems, and to bugchecks in OpenVMS.

A black screen of death can occur upon hardware or software failures. Windows 3.1 displays a black screen of death instead of a blue one. Some versions of macOS (notably OS X Lion) display a black screen of death instead of a kernel panic, usually pointed to a graphics card or sleep/wake issue, it may also display a black screen when the operating system fails to boot properly. The Xbox series of consoles (which includes the original Xbox, Xbox 360, Xbox One and the Xbox Series X/S) also display a black screen when a hardware or software error occurs.

The Red Screen of Death in Windows Longhorn build 5048 (note the word "execution" was misspelt as "exectuion", which was fixed in later builds)

In some cases, a differently-colored error screen was used. Beta versions of Windows 98 display a red error screen raised by the Advanced Configuration and Power Interface (ACPI) when the host computer's BIOS encounters a problem. The bootloader of the first beta version of Windows Vista originally displayed a red screen background in the event of a boot failure, which was changed to black afterwards. As mentioned earlier, the insider builds of Windows 10 and later, as well as Windows Server 2016 and later, display a green screen instead of blue. Windows 10 and later (and Windows Server 2016 and later) also display an orange screen in an extremely rare case where a hardware issue with the GPU or a graphics driver problem was encountered.

The blue screen of death on ReactOS, with a different font than its contemporary Windows versions

ReactOS, an open-source operating system designed to achieve binary compatibility with Windows, implements a version of the blue screen of death similar to that used in Windows NT operating systems. systemd, a software suite providing system components for Linux operating systems, also implements a version of the blue screen of death similar to that of Windows, albeit not as a replacement to the kernel panic in Linux (see above), but rather was used in the event of a bootup failure. This iteration uses systemd-bsod, which was added on December 6, 2023 starting with version 255 of systemd.

See also

• System crash screen
  • Guru Meditation
  • Kernel panic
  • Purple Screen of Death
  • Sad Mac
  • Black screen of death
• Red Ring of Death
• Hang (computing)
• Overheating (electricity)
• Machine-check exception
• Windows Hardware Error Architecture

External links

• Bug Check Code Reference
• SysInternals BlueScreen Screen Saver v3.2
• Blue Screen of Death. Archived March 31, 2022, at the Wayback Machine on MalWiki.