Runtime Broker in Windows 10: What It Is & Is It Safe?

Runtime Broker is a standard Windows 10 background process that manages app permissions, particularly for Universal Windows Platform (UWP) apps from the Microsoft Store. If you see it in Task Manager, it’s safe, but high memory usage can indicate a problem. This article explains what it does, why it runs, and how to troubleshoot issues.

What Is Runtime Broker?

Runtime Broker (runtimebroker.exe) is a core Windows 10 system process introduced with Windows 8. Its job is to act as a middleman between UWP apps and the operating system’s permission system. When you install an app from the Microsoft Store, it requests access to things like your camera, microphone, contacts, or file system. Runtime Broker verifies those requests against the permissions you’ve granted and then allows or denies them. It also monitors apps while they run to ensure they don’t try to access something they weren’t given permission for.

This process is essential for the security model of modern Windows apps. Without it, any app could silently access your personal data. It runs automatically in the background and is not something you need to start or stop manually.

Why Does Runtime Broker Run in Task Manager?

Open Task Manager (Ctrl+Shift+Esc) and you’ll likely see one or more Runtime Broker entries under “Background processes.” That’s normal. Windows starts a new instance of Runtime Broker for each app that uses permissions, so you may see several at once. Each instance is lightweight, using just a few megabytes of RAM. The process runs only while a UWP app is active or while the system needs to check permissions. When no such app is running, Runtime Broker should go idle and use almost no CPU.

If you see many instances, that’s because multiple apps are open or running in the background. For example, the Photos app, the Store app, and the Settings app each may spawn their own broker. This is by design and not a cause for concern.

Is Runtime Broker Safe or a Virus?

Runtime Broker is a legitimate Microsoft component. The executable is located in C:\Windows\System32\runtimebroker.exe. It is digitally signed by Microsoft, so you can verify its authenticity by right-clicking the file in File Explorer, selecting Properties, and checking the Digital Signatures tab. If the file is anywhere else, it could be malware disguised as the real thing.

However, a high memory or CPU usage from Runtime Broker can indicate a problem with a specific app, not with the process itself. Common causes include a corrupted app cache, a buggy app update, or a permission loop where an app keeps asking for access. If you see Runtime Broker using hundreds of megabytes of RAM, it’s usually a sign that one of your Store apps is misbehaving, not that the broker is dangerous.

How to Fix High CPU or Memory Usage

If Runtime Broker is using excessive resources, try these steps in order:

Restart your PC. This clears temporary glitches and stops all background apps.
Close UWP apps one by one. In Task Manager, note which app is running when Runtime Broker spikes, then close that app to isolate the culprit.
Run the Windows Store Apps troubleshooter. Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Store Apps. Run it and follow the prompts.
Reset the Microsoft Store cache. Press Win+R, type wsreset.exe, and press Enter. This clears the Store’s cache without deleting your apps or data.
Update your apps. Open the Microsoft Store, click Library, then “Get updates” to install any pending app updates.
Reinstall the problematic app. If a specific app causes the issue, uninstall it from Settings > Apps, then reinstall it from the Store.

If none of these work, you can temporarily disable the process by ending it in Task Manager, but Windows will restart it when needed. This is only a temporary fix, not a permanent solution.

Common Misconceptions

One common myth is that Runtime Broker is a virus because it appears in Task Manager with no clear purpose. That’s false. Another misconception is that you should delete runtimebroker.exe to improve performance. Never do that—removing a system file can break Windows and cause instability. A third misconception is that Runtime Broker is a third-party program. It’s not; it’s a core part of Windows 10.

Some users also worry that seeing multiple instances means their system is infected. Multiple instances are normal, as explained above. The key is to check the file location and signature if you’re ever unsure.

How to Check If the Process Is Legitimate

To verify that the Runtime Broker running on your system is the real one:

Right-click the Task Manager entry and select “Open file location.”
If it opens the System32 folder, that’s a good sign. If it opens somewhere else, investigate further.
Right-click the file and select Properties.
Go to the Digital Signatures tab and confirm it says “Microsoft Windows” with a valid signature.
Check the file size—the legitimate file is typically around 50 KB on 64-bit systems.

If the file is in a temporary folder or a user directory, run a full antivirus scan immediately. But in the vast majority of cases, the process is legitimate.

Frequently Asked Questions

Can I disable Runtime Broker?

You can end the process in Task Manager, but Windows will restart it automatically when needed. There’s no supported way to permanently disable it without breaking app permissions. It’s not recommended to try.

Why does Runtime Broker use so much memory?

High memory usage is usually caused by a buggy app or a permission loop. Try closing Store apps, resetting the Store cache, or updating apps. If it persists, restart your PC.

Is Runtime Broker a virus?

No, it’s a legitimate Windows system process. However, malware can disguise itself with the same name. Always check the file location and digital signature if you’re concerned.

How many Runtime Broker processes should I see?

There’s no fixed number. You may see one or several, depending on how many UWP apps are running. Each app that uses permissions gets its own instance.

What happens if I delete runtimebroker.exe?

Deleting the file will break the permission system for Store apps, and Windows may become unstable. You cannot delete it while it’s running, and doing so could require a system repair.

Does Runtime Broker slow down my PC?

Normally, no. It uses very little CPU and a small amount of RAM. If it’s using a lot of resources, it’s a symptom of another problem, not the cause.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →