How to uninstall Wireshark on Windows

Wireshark's capture filters, display filters and profiles live in a settings folder its uninstaller does not remove. This guide covers Wireshark installed machine-wide from the WiresharkFoundation.Wireshark winget package, and does not cover Npcap, the separate packet-capture driver Wireshark's own installer can also offer.

Quit Wireshark first

Stop any capture in progress and close Wireshark, then check Task Manager (Ctrl+Shift+Esc) for Wireshark.exe before you uninstall.

Remove the app with its own uninstaller

Go to Settings › Apps › Installed apps, find Wireshark, and choose Uninstall, or run:

winget uninstall --id WiresharkFoundation.Wireshark

Back up before you remove data

Copy %APPDATA%\Wireshark if you want to keep your capture filters, display filters and profiles for a later reinstall.

Where the data lives

Location	What it holds	What to do
`%APPDATA%\Wireshark`	Capture filters, display filters, recent files and profiles	Back this up first; the uninstaller does not remove it
`HKCU\SOFTWARE\Wireshark`	Application settings in the registry	Safe to remove after backing up the folder above

Check the result

Run these read-only commands after the uninstall finishes:

Get-Process Wireshark -ErrorAction SilentlyContinue
winget list --id WiresharkFoundation.Wireshark
Test-Path "$env:ProgramFiles\Wireshark"
Test-Path "$env:APPDATA\Wireshark"

No output from Get-Process only means this query observed no matching process; a suppressed error leaves the running state unknown.
A completed winget list query with no match means the package record is gone; a matching row means the uninstall did not finish.
The first Test-Path returning False means the program folder is gone; True means files remain there.
Test-Path "$env:APPDATA\Wireshark" returning True means your filters and profiles are still there, which is expected unless you removed them yourself.

If you installed it with winget

winget uninstall runs the same NSIS uninstaller Settings › Apps uses and removes the same program files and its Start Menu shortcut; it does not touch %APPDATA%\Wireshark on its own.

Npcap, the capture driver

Wireshark's own installer can also offer to install Npcap, the driver Windows needs to capture live traffic. Npcap registers as its own separate entry in Settings › Apps › Installed apps when it is installed that way, and removing Wireshark does not remove it; if you no longer need live capture on this machine, uninstall Npcap on its own from that list.

What Mole lists

For Wireshark installed machine-wide from winget:

The program folder and the Start Menu shortcut are selected by default.
%APPDATA%\Wireshark and HKCU\SOFTWARE\Wireshark are listed but not selected, since they hold your filters and profiles.

What this test covered

Tested with Wireshark 4.6.8 (arm64) installed through winget, machine-wide scope. The test did not install Npcap, so Npcap's own uninstall entry was not exercised.