Following our earlier announcement, “[Important] Security Incident Notice Regarding the EmEditor Installer Download Link”, we are sharing what we have learned through further investigation, along with additional details that supplement the previous notice.
We sincerely apologize once again for the serious concern and inconvenience this incident has caused.
1. Time Period Potentially Affected (U.S. Pacific Time / UTC)
In our previous notice, we provided the timeframe in U.S. Pacific Time. For reference, we also include Coordinated Universal Time (UTC).
- Dec 19, 2025 18:39 – Dec 22, 2025 12:50 (U.S. Pacific Time)
- 2025-12-20 02:39 – 2025-12-22 20:50 (UTC)
If you downloaded the installer during the period above via the EmEditor website download path (for example, the “Download Now” button), there is a possibility that you downloaded a file that was not the legitimate installer provided by us (Emurasoft, Inc.).
Please note that the period above is intentionally broad out of an abundance of caution. The actual window may have been shorter and limited to specific times.
2. About the Suspicious File (Confirmed Differences)
For the file emed64_25.4.3.msi, we have confirmed the existence of at least two suspicious files.
We also confirmed that both suspicious files were signed with Microsoft-issued digital signatures. Because the validity periods were extremely short (only a few days), we believe the certificates were likely issued in a manner similar to developer-oriented issuance.
We reported this incident to Microsoft, provided the suspicious files, and requested revocation of the relevant signatures. We have now confirmed that both signatures have been revoked. As a result, attempting to run the MSI should display a warning that the signature is invalid, making installation difficult.
Legitimate file (official EmEditor installer)
Problematic file #1
Problematic file #2
3. If You Already Deleted the Downloaded File
If you still have the downloaded file (emed64_25.4.3.msi), you can verify it (as previously announced) by checking the digital signature and/or SHA-256.
Even if you already deleted the file, Windows may have kept a copy of the MSI used during installation under C:\Windows\Installer, stored under a different name.
Because this folder is both hidden and protected by the OS, it can be difficult to locate through normal File Explorer browsing. Please open it directly by entering: C:\Windows\Installer.
After opening the folder, we recommend the steps below. Please be extremely careful not to double-click or run any MSI files.
- Sort by date (for example, “Date modified”)
- Focus on recent files
- Check the target file’s digital signature (Right-click → Properties → Digital Signatures)
4. How To Check whether Your Computer May be Infected
Even if the suspicious file was executed, infection is not guaranteed in environments such as:
- The device was offline
- A VPN/proxy was required
- Suspicious PowerShell behavior was blocked by Windows features or policies
- PowerShell execution was restricted
- Antivirus/security software blocked the activity
However, if any of the following apply, the likelihood of infection becomes very high:
C:\ProgramData\tmp_mojo.log exists- A scheduled task named
Google Drive Caching exists
background.vbs exists in %LOCALAPPDATA%\Google Drive Caching\- A browser extension named
Google Drive Caching exists in a Chromium-based browser such as Chrome or Microsoft Edge (even if it claims to be made by Google)—especially if it can “read and change data on all websites” and has clipboard access
- Network logs show connections to any of the following:
cachingdrive[.]comemeditorde[.]comemeditorgb[.]comemeditorjp[.]comemeditorsb[.]com
If none of the above apply, the risk is lower—but not zero—because part of the attack can run in memory and leave little or no file-based evidence.
5. Confirmed Behavior (Destination Domains, etc.)
As previously announced, we confirmed that the suspicious installer, when executed, downloads additional files from external domains and executes them.
While we previously confirmed access to emeditorjp[.]com, subsequent investigation has found additional access to emeditorde[.]com, emeditorgb[.]com, and emeditorsb[.]com as well.
None of these four domains (emeditorjp[.]com, emeditorde[.]com, emeditorgb[.]com, emeditorsb[.]com) are operated by us (Emurasoft, Inc.).
We also confirmed that the PowerShell command described in the previous notice downloads and executes files from external domains, and that this behavior could lead to malware infection and theft of personal information such as passwords.
For additional details, please refer to the research report prepared by Mr. Luca Palermo and Mr. Mario Ciccarelli. Mr. Palermo provided the report to us and granted permission for us to publish it, and we would like to express our sincere thanks for their cooperation.
6. Why This Was “Hard to Spot”
As a basic reality, both domains and digital signatures can be obtained by third parties under certain conditions.
- Domains can often be purchased at low cost if they are unused or not renewed.
- Code-signing certificates can generally be obtained from many certificate authorities (in this case, the issuer was Microsoft).
- Once an issue is discovered, the main available response is to contact the issuer/certification authority and request revocation.
From a technical perspective, MSI installers can include arbitrary scripts (including PowerShell) via custom actions. With sufficient knowledge, an attacker can inject a malware loader into an installer that closely resembles a legitimate, widely distributed one.
Even if the installer were an EXE rather than an MSI, similar attacks would still be possible.
Unfortunately, this means it is difficult for software companies to completely prevent malicious installers that closely imitate legitimate ones from being created and distributed. We must assume that similarly sophisticated, multi-stage malware installers could appear again in the future.
That said, we believe the core issues in this incident can be summarized as follows:
- A convenient redirect (download path) used on our website was altered without being detected.
- A malicious installer was placed on our website by an external party.
Because these occurred together, we take full responsibility for the fact that customers were harmed after downloading from our official website, and we will reflect this in our future preventive measures.
6-1. Malicious files placed on the EmEditor website
In addition to the malicious installer emed64_25.4.3.msi, we discovered a file named base64.php under a plugin directory. After analyzing base64.php, we determined it was a typical backdoor (remote code execution / RCE).
We also found that a script had been added to footer.php (within the WordPress theme directory). This script hijacked clicks intended for the legitimate URL:
https://support.emeditor.com/ja/downloads/latest/installer/64
and redirected them to:
/wp-content/uploads/filebase/emeditor-core/emed64_25.4.3.msi
As a result, clicking the “Download Now” button on the homepage could lead to the malicious file being downloaded.
More maliciously, the script was configured to trigger only for visitors who were not logged in, making the issue difficult for administrators to reproduce and detect. As a result, even when we checked the site ourselves, we did not immediately notice that the redirect had been altered.
7. Cause (Current Assessment)
We are still investigating and have not reached a final conclusion. However, we are considering the possibilities below.
WordPress is made up of multiple components—core, plugins, themes, and more—maintained by many developers. Vulnerabilities are regularly discovered in these components, and updates are released over time.
We regularly update plugins and themes, but in some cases vulnerabilities may remain unpatched for extended periods. It is possible that the attack exploited such a vulnerability.
It is also possible that the SFTP account in use was targeted.
8. Our Response (Completed / Planned)
We immediately deleted the malicious file emed64_25.4.3.msi. We also reviewed file modification logs and confirmed the addition of base64[.]php and changes to footer[.]php. After identifying base64[.]php as a backdoor, we scanned the entire site.
We then rebuilt the website, reinstalled all plugins, and removed unnecessary plugins. We also scanned internal computers and changed login passwords for all WordPress sites and related services. We audited several services we used by looking through their logs.
In addition, we stopped using redirects for download buttons such as “Download Now,” and replaced them with direct links to verified safe files. We also updated the download page to clearly show the MSI’s SHA-256 and added instructions encouraging users to verify the digital signature.
To further strengthen the EmEditor homepage download path, we are also considering migrating the site to a custom/static website instead of WordPress in the near future.
9. Closing
As described above, an installer that has been tampered with can perform extremely dangerous actions when executed. At the same time, we cannot fundamentally prevent third parties from creating and distributing malicious installers that imitate legitimate ones.
Therefore, our top priority is to make sure no one can obtain malware through our website, since it’s our primary distribution channel.
This incident also reminded us that while popular CMS platforms such as Xoops and WordPress are convenient, their extensibility can increase exposure to vulnerabilities—and that simply keeping plugins and themes updated does not eliminate risk entirely.
Fortunately, the Emurasoft Customer Center was not compromised, and our database remained secure. We have no evidence that anyone accessed our customer database.
In the hope that what we learned from this incident will help other software companies, we have included as much detail and context as possible rather than limiting this to a brief report.
We once again offer our sincere apologies for the concern and inconvenience caused. We especially apologize to those who suffered harm related to infection.
Thank you for your continued support of EmEditor.
[Important] Follow-up: Security Incident Notice Regarding the EmEditor Installer Download Link
/in General/by Yutaka EmuraFollowing our earlier announcement, “[Important] Security Incident Notice Regarding the EmEditor Installer Download Link”, we are sharing what we have learned through further investigation, along with additional details that supplement the previous notice.
We sincerely apologize once again for the serious concern and inconvenience this incident has caused.
1. Time Period Potentially Affected (U.S. Pacific Time / UTC)
In our previous notice, we provided the timeframe in U.S. Pacific Time. For reference, we also include Coordinated Universal Time (UTC).
If you downloaded the installer during the period above via the EmEditor website download path (for example, the “Download Now” button), there is a possibility that you downloaded a file that was not the legitimate installer provided by us (Emurasoft, Inc.).
Please note that the period above is intentionally broad out of an abundance of caution. The actual window may have been shorter and limited to specific times.
2. About the Suspicious File (Confirmed Differences)
For the file
emed64_25.4.3.msi, we have confirmed the existence of at least two suspicious files.We also confirmed that both suspicious files were signed with Microsoft-issued digital signatures. Because the validity periods were extremely short (only a few days), we believe the certificates were likely issued in a manner similar to developer-oriented issuance.
We reported this incident to Microsoft, provided the suspicious files, and requested revocation of the relevant signatures. We have now confirmed that both signatures have been revoked. As a result, attempting to run the MSI should display a warning that the signature is invalid, making installation difficult.
Legitimate file (official EmEditor installer)
e5f9c1e9b586b59712cefa834b67f829ccbed183c6855040e6d42f0c0c3fcb3ehttps://www.virustotal.com/gui/file/e5f9c1e9b586b59712cefa834b67f829ccbed183c6855040e6d42f0c0c3fcb3e
Problematic file #1
emed64_25.4.3.msi4bea333d3d2f2a32018cd6afe742c3b25bfcc6bfe8963179dad3940305b13c98https://www.virustotal.com/gui/file/4bea333d3d2f2a32018cd6afe742c3b25bfcc6bfe8963179dad3940305b13c98
Problematic file #2
emed64_25.4.3.msi3d1763b037e66bbde222125a21b23fc24abd76ebab40589748ac69e2f37c27fchttps://www.virustotal.com/gui/file/3d1763b037e66bbde222125a21b23fc24abd76ebab40589748ac69e2f37c27fc
3. If You Already Deleted the Downloaded File
If you still have the downloaded file (
emed64_25.4.3.msi), you can verify it (as previously announced) by checking the digital signature and/or SHA-256.Even if you already deleted the file, Windows may have kept a copy of the MSI used during installation under
C:\Windows\Installer, stored under a different name.Because this folder is both hidden and protected by the OS, it can be difficult to locate through normal File Explorer browsing. Please open it directly by entering:
C:\Windows\Installer.After opening the folder, we recommend the steps below. Please be extremely careful not to double-click or run any MSI files.
4. How To Check whether Your Computer May be Infected
Even if the suspicious file was executed, infection is not guaranteed in environments such as:
However, if any of the following apply, the likelihood of infection becomes very high:
C:\ProgramData\tmp_mojo.logexistsGoogle Drive Cachingexistsbackground.vbsexists in%LOCALAPPDATA%\Google Drive Caching\Google Drive Cachingexists in a Chromium-based browser such as Chrome or Microsoft Edge (even if it claims to be made by Google)—especially if it can “read and change data on all websites” and has clipboard accesscachingdrive[.]comemeditorde[.]comemeditorgb[.]comemeditorjp[.]comemeditorsb[.]comIf none of the above apply, the risk is lower—but not zero—because part of the attack can run in memory and leave little or no file-based evidence.
5. Confirmed Behavior (Destination Domains, etc.)
As previously announced, we confirmed that the suspicious installer, when executed, downloads additional files from external domains and executes them.
While we previously confirmed access to
emeditorjp[.]com, subsequent investigation has found additional access toemeditorde[.]com,emeditorgb[.]com, andemeditorsb[.]comas well.None of these four domains (
emeditorjp[.]com,emeditorde[.]com,emeditorgb[.]com,emeditorsb[.]com) are operated by us (Emurasoft, Inc.).We also confirmed that the PowerShell command described in the previous notice downloads and executes files from external domains, and that this behavior could lead to malware infection and theft of personal information such as passwords.
For additional details, please refer to the research report prepared by Mr. Luca Palermo and Mr. Mario Ciccarelli. Mr. Palermo provided the report to us and granted permission for us to publish it, and we would like to express our sincere thanks for their cooperation.
6. Why This Was “Hard to Spot”
As a basic reality, both domains and digital signatures can be obtained by third parties under certain conditions.
From a technical perspective, MSI installers can include arbitrary scripts (including PowerShell) via custom actions. With sufficient knowledge, an attacker can inject a malware loader into an installer that closely resembles a legitimate, widely distributed one.
Even if the installer were an EXE rather than an MSI, similar attacks would still be possible.
Unfortunately, this means it is difficult for software companies to completely prevent malicious installers that closely imitate legitimate ones from being created and distributed. We must assume that similarly sophisticated, multi-stage malware installers could appear again in the future.
That said, we believe the core issues in this incident can be summarized as follows:
Because these occurred together, we take full responsibility for the fact that customers were harmed after downloading from our official website, and we will reflect this in our future preventive measures.
6-1. Malicious files placed on the EmEditor website
In addition to the malicious installer
emed64_25.4.3.msi, we discovered a file namedbase64.phpunder a plugin directory. After analyzingbase64.php, we determined it was a typical backdoor (remote code execution / RCE).We also found that a script had been added to
footer.php(within the WordPress theme directory). This script hijacked clicks intended for the legitimate URL:https://support.emeditor.com/ja/downloads/latest/installer/64and redirected them to:
/wp-content/uploads/filebase/emeditor-core/emed64_25.4.3.msiAs a result, clicking the “Download Now” button on the homepage could lead to the malicious file being downloaded.
More maliciously, the script was configured to trigger only for visitors who were not logged in, making the issue difficult for administrators to reproduce and detect. As a result, even when we checked the site ourselves, we did not immediately notice that the redirect had been altered.
7. Cause (Current Assessment)
We are still investigating and have not reached a final conclusion. However, we are considering the possibilities below.
WordPress is made up of multiple components—core, plugins, themes, and more—maintained by many developers. Vulnerabilities are regularly discovered in these components, and updates are released over time.
We regularly update plugins and themes, but in some cases vulnerabilities may remain unpatched for extended periods. It is possible that the attack exploited such a vulnerability.
It is also possible that the SFTP account in use was targeted.
8. Our Response (Completed / Planned)
We immediately deleted the malicious file
emed64_25.4.3.msi. We also reviewed file modification logs and confirmed the addition ofbase64[.]phpand changes tofooter[.]php. After identifyingbase64[.]phpas a backdoor, we scanned the entire site.We then rebuilt the website, reinstalled all plugins, and removed unnecessary plugins. We also scanned internal computers and changed login passwords for all WordPress sites and related services. We audited several services we used by looking through their logs.
In addition, we stopped using redirects for download buttons such as “Download Now,” and replaced them with direct links to verified safe files. We also updated the download page to clearly show the MSI’s SHA-256 and added instructions encouraging users to verify the digital signature.
To further strengthen the EmEditor homepage download path, we are also considering migrating the site to a custom/static website instead of WordPress in the near future.
9. Closing
As described above, an installer that has been tampered with can perform extremely dangerous actions when executed. At the same time, we cannot fundamentally prevent third parties from creating and distributing malicious installers that imitate legitimate ones.
Therefore, our top priority is to make sure no one can obtain malware through our website, since it’s our primary distribution channel.
This incident also reminded us that while popular CMS platforms such as Xoops and WordPress are convenient, their extensibility can increase exposure to vulnerabilities—and that simply keeping plugins and themes updated does not eliminate risk entirely.
Fortunately, the Emurasoft Customer Center was not compromised, and our database remained secure. We have no evidence that anyone accessed our customer database.
In the hope that what we learned from this incident will help other software companies, we have included as much detail and context as possible rather than limiting this to a brief report.
We once again offer our sincere apologies for the concern and inconvenience caused. We especially apologize to those who suffered harm related to infection.
Thank you for your continued support of EmEditor.
[Important] Security Incident Notice Regarding the EmEditor Installer Download Link
/in General/by Yutaka EmuraWe regret to inform you that we have identified an incident involving the EmEditor official website’s download path (the [Download Now] button), where unauthorized modification by a third party is suspected. During the affected period, the installer downloaded via that button may not have been the legitimate file provided by us (Emurasoft, Inc.).
We sincerely apologize for the concern and inconvenience this may cause. Please review the information below.
1. Potentially Affected Period
If you downloaded the installer from the [Download Now] button on the EmEditor homepage during this period, it is possible that a different file without our digital signature was downloaded. This is a conservative estimate, and in reality the affected period may have been narrower and limited to a specific timeframe.
2. Incident Summary (High-Level Cause)
The [Download Now] button normally points to the following URL:
This URL uses a redirect. However, during the affected period, the redirect settings appear to have been altered by a third party, resulting in downloads being served from the following (incorrect) URL:
This file was not created by Emurasoft, Inc., and it has already been removed.
As a result, we have confirmed that the downloaded file may be digitally signed not by us, but by another organization named WALSHAM INVESTMENTS LIMITED.
Note: This issue may not be limited to the English page and may affect similar URLs for other languages as well (including Japanese).
3. File Confirmed as Potentially Affected
At this time, the only file confirmed to be involved is:
Legitimate file (official)
e5f9c1e9b586b59712cefa834b67f829ccbed183c6855040e6d42f0c0c3fcb3eSuspicious file (possible tampering)
4. Not Affected
You are not affected if any of the following applies:
download.emeditor.infoExample: https://download.emeditor.info/emed64_25.4.3.msi
emed64_25.4.3.msi5. How to Check and What to Do
If you may have downloaded the installer via [Download Now] during the affected period, please verify the digital signature and SHA-256 hash of the file
emed64_25.4.3.msi.5-1. How to check the Digital Signature (Windows)
emed64_25.4.3.msi) and select Properties.If the “Digital Signatures” tab is not shown, the file may be unsigned or the signature may not be recognized. In that case, do not run the file; delete it and follow the guidance below.
5-2. How to check SHA-256 (Windows / PowerShell)
Open PowerShell and run:
Confirm the output SHA-256 matches:
e5f9c1e9b586b59712cefa834b67f829ccbed183c6855040e6d42f0c0c3fcb3eIf the signature or SHA-256 does not match (Recommended actions)
If the digital signature is not Emurasoft, Inc. (e.g., it is WALSHAM INVESTMENTS LIMITED) or the SHA-256 does not match, you may have obtained a tampered file (potentially containing malware).
If you are using EmEditor in an organization, we also recommend contacting your internal security team (e.g., CSIRT) and preserving relevant logs where possible.
6. Observed Behavior (As Currently Confirmed)
The suspicious installer may attempt to run a powershell script, which downloads and executes content from
emeditorjp[.]com.emeditorjp[.]com is not a domain managed by Emurasoft, Inc.
Please also note that the installer may still proceed to install EmEditor normally and install legitimate EmEditor program files, which could make the issue difficult to notice.
7. Current Status and Next Updates
We are continuing to investigate the facts and determine the full scope of impact. We will provide updates on this page and/or through our official channels as soon as more information becomes available.
We take this incident very seriously and will implement necessary measures to identify the cause and prevent recurrence.
We sincerely apologize again for the inconvenience and concern this may have caused, and we appreciate your understanding and continued support of EmEditor.
EmEditor v25.4.3 Released
/in EmEditor Core/by Yutaka EmuraWe released EmEditor v25.4.3 today. This update focuses on stability and includes the following fixes—please keep your software current for the best experience:
If you use the Desktop Installer version, you can select Check for Updates from the Help menu to download the latest version. If this method fails, please download the latest version, and run the downloaded installer. If you use the Desktop portable version, you can go to the Download page to get the latest version. The Store App version can be updated through the (Microsoft Store after a few days.
EmEditor v25.4.2 Released
/in EmEditor Core/by Yutaka EmuraWe’ve just released EmEditor v25.4.2. This update delivers several important fixes and optimizations to keep your experience smooth and stable, so we recommend updating as soon as possible.
If you use the Desktop Installer version, you can select Check for Updates from the Help menu to download the latest version. If this method fails, please download the latest version, and run the downloaded installer. If you use the Desktop portable version, you can go to the Download page to get the latest version. The Store App version can be updated through the (Microsoft Store after a few days.
EmEditor v25.4.1 Released
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor v25.4.1.
v25.4.1 includes the following bug fixes. Please make sure to always update to the latest version for stable operations.
If you use the Desktop Installer version, you can select Check for Updates from the Help menu to download the latest version. If this method fails, please download the latest version, and run the downloaded installer. If you use the Desktop portable version, you can go to the Download page to get the latest version. The Store App version can be updated through the (Microsoft Store after a few days.
EmEditor v25.4.0 Released – Faster, More Robust, Snippets, and Chat with AI
/in EmEditor Core/by Yutaka EmuraWe’ve released EmEditor v25.4.0.
This update focuses first and foremost on speed. We optimized numerous parts of the code so that many actions now run faster, especially on CPUs that support AVX‑512. I used the Chat with AI feature to help write the new optimizations; it felt like having another excellent engineer at my side.
We also made classic, non‑AI optimizations. Find, Replace, Find in Files, and Replace in Files have been reworked to process UTF‑8 directly whenever possible, avoiding round trips to UTF‑16. Previously, Replace in Files on UTF‑8 converted to UTF‑16 and back; now replacements can happen directly on UTF‑8, eliminating conversion overhead. We also added a new Find in Files option: “Display File Names, Lines, and Matched Lines (truncate long lines),” enabled by default. Even when targets include very long lines (such as binaries), EmEditor now truncates output instead of printing entire lines for stable, responsive results. In our tests, Find, Replace, Find in Files, and Replace in Files were between about 2x and 6.5x faster.
Stability has also improved. Find in Files runs multithreaded, but searching many huge files at once could use a lot of memory. We now limit the number of threads that open very large files to reduce memory usage. If memory allocation fails, EmEditor automatically falls back to a lower‑memory, single‑threaded mode and retries the operation, lowering the chance of a crash.
After discontinuing the HTMLBar plug‑in in v25.3, some users missed the quick tag‑insertion buttons. In this release, you can define snippets directly in EmEditor and invoke them from menus, toolbars, or keyboard shortcuts. Execution is still handled by the Snippets plug‑in. To show the Snippets toolbar, go to View > Toolbars > Snippets. Create a snippet by dragging any text onto the Snippets toolbar, or define snippets via Customize > Snippets. For syntax details, see “To Use the Snippets Plug‑in” in the Help, or ask an AI for “EmEditor snippet syntax”.
Chat with AI (by Makoto Emura) has also received upgrades:
OPENAI_API_KEY).Note: To use AI features, including Chat with AI, install the ChatAI plug‑in separately.
We also fixed issues found during the preview build.
We hope both the Pro and Free editions meet your expectations. If you have questions, feature requests, or ideas, please contact us or post on the forum.
We appreciate your continued support of EmEditor.
— Yutaka Emura
For details, including major changes and screenshots, see “What’s New in Version 25.4.”
If you use the Desktop Installer edition, update from Help > Check for Updates. If that doesn’t work, download the latest version (https://support.emeditor.com/en/downloads/suggested) and run the installer. The Desktop Portable edition can be downloaded and updated here. The Store App edition will be available for download or update from the Microsoft Store in a few days.
EmEditor v25.3.2 Released
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor v25.3.2.
v25.3.2 includes the following bug fixes. Please make sure to always update to the latest version for stable operations.
If you use the Desktop Installer version, you can select Check for Updates from the Help menu to download the latest version. If this method fails, please download the latest version, and run the downloaded installer. If you use the Desktop portable version, you can go to the Download page to get the latest version. The Store App version can be updated through the (Microsoft Store after a few days.
Media coverage: EmEditor’s journey, modernization, and what’s next — featured on Levtech LAB
/in Reviews/by Yutaka EmuraSince its first release in 1997, EmEditor has evolved around two pillars: being fast even with ultra-large files and being exceptionally capable with CSV workflows. Levtech LAB, Japan has published an in-depth feature that looks at our core performance, practical CSV editing and high-speed search, our recent modernization with CI/CD and AI/Git integrations, and how we pass on engineering know-how across generations.
The article explores why EmEditor remains smooth even with extremely large data sets—up to roughly 16 TB (1.09 trillion lines)—and how our engine-level optimizations deliver fast searches at scale. It also highlights real-world CSV use cases where EmEditor is adopted as a solution when traditional tools hit their limits.
On the development side, it introduces our natural division of responsibilities: I (Yutaka Emura) continue to refine the C/C++ core engine, while my son Makoto focuses on the surrounding areas—DevOps, Git integration, AI assistant features, and plugins. With Makoto’s initiative, we implemented a CI/CD pipeline that automates everything from builds and testing to packaging (installer, portable, Microsoft Store) and publishing. This significantly reduced human error, improved release stability, and allows us to focus more on product quality.
The story also touches on the psychological safety that comes from mutual trust in a small team, how we make product decisions by prioritizing quality, and our commitment to “keep EmEditor the best text editor.”
EmEditor v25.3.1 Released
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor v25.3.1.
v25.3.1 includes the following bug fixes. Please make sure to always update to the latest version for stable operations.
If you use the Desktop Installer version, you can select Check for Updates from the Help menu to download the latest version. If this method fails, please download the latest version, and run the downloaded installer. If you use the Desktop portable version, you can go to the Download page to get the latest version. The Store App version can be updated through the (Microsoft Store after a few days.
EmEditor v25.3.0 Released — Expanded AI Features, Sort by Similarity, Markdown/HTML Toolbar, and Performance Improvements
/in EmEditor Core/by Yutaka EmuraWe released EmEditor v25.3.0 today.
Generative AI Enhancements (ChatAI plugin required)
One of the biggest additions in v25.3 is enhanced generative AI support, developed by Makoto Emura. This release adds Google as a provider and supports OpenAI’s GPT‑5. EmEditor now also supports Tool Calling, which lets the AI invoke a limited set of built-in EmEditor tools. It’s similar to an AI agent, but restricted to tools that EmEditor exposes—hence the name “Tool Calling.” With this, you can run natural-language commands on the currently open document via the Chat with AI interface. For example, if you open a file with email addresses and type “Extract email addresses from this document” into the Chat with AI bar, EmEditor will extract them and create a new document.
To use Tool Calling, click the “Tools” button and ensure it’s highlighted in blue. You can also choose which tools are enabled on the Tool Calling page in Chat with AI settings.
The Chat with AI Settings and the AI Options page in the Customization dialog let you set Max tokens and Temperature (randomness). Previously, the default Max tokens was 4096, which could cause truncated output for reasoning-heavy models like GPT‑5. In this version, you can toggle Max tokens on or off. When it’s off, the provider’s default is used.
In Chat with AI Settings, you can also adjust Reasoning effort where supported. When Reasoning effort is off, the model’s default is used. Higher effort yields more reliable responses but can be slower. If you want the fastest replies, turn Reasoning effort on and select Minimal.
Sort by Similarity
EmEditor includes many sorting commands, and this version adds the ability to sort by similarity to the text on the current line or in the current cell. Similarity is calculated using the Levenshtein distance (edit distance) introduced in v22.0.0, with an option to ignore case. For example, if you have a CSV roster and search for
Michael, placing the cursor onMichaeland running Sort by Similarity will sort the list so close matches likeMichealandMikeappear first—making similar names easier to spot.Markdown/HTML Toolbar
We’ve added HTML features to the Markdown toolbar introduced in v24.4 and combined them into a single Markdown/HTML toolbar. Markdown and HTML modes switch automatically. Opening a Markdown file and choosing Markdown settings or turning on Markdown Design Mode enables Markdown mode; opening an HTML file and choosing HTML settings enables HTML mode. Accordingly, the old HTMLBar plugin has been discontinued. The new HTML mode is more capable than HTMLBar. For example, the drop-down for Paragraph, Heading 1, Heading 2, and more automatically detects and shows the current style, and buttons like Bold, Italic, and Code reflect the current font state. If no text is selected and you click Bold, the word at the cursor becomes bold. Selecting the Bold command (Ctrl+B by default) while selecting
textproduces**text**in Markdown mode and<strong>text</strong>in HTML mode.Performance and More
We continued optimizing startup performance in this release. The Extract Frequent Strings command is also significantly faster. In our tests, startup is 1.90× faster than v25.0, and Extract Frequent Strings is 1.42–4.44× faster than v25.2.
Other improvements include:
(?#_text_c!=17)for more flexible highlighting.We also fixed issues found during the preview build. Starting with this version, the trial period before registration changes from 30 days to 7 days.
We hope both the Pro and Free editions meet your expectations. If you have questions, feature requests, or ideas, please contact us or post on the forum.
We appreciate your continued support of EmEditor.
— Yutaka Emura
For details, including major changes and screenshots, see “What’s New in Version 25.3.” (/text-editor-features/history/new-in-version-25-3/)
If you use the Desktop Installer edition, update from Help > Check for Updates. If that doesn’t work, download the latest version (https://support.emeditor.com/en/downloads/suggested) and run the installer. The Desktop Portable edition can be downloaded and updated here. The Store App edition will be available for download or update from the Microsoft Store in a few days.