What it's serving
Fingerprints the command line and recognizes Next.js, Vite, Nuxt, NestJS, webpack, nodemon, ts-node, tsx and Jest. Anything else shows the actual script name — never a bare PID.
Windows Node Monitor
Find the Node process. See its port. Kill it.
Six node.exe entries in Task Manager and not one will tell you which is which.
Winnom hunts down every Node.js process on your machine, shows what it's serving, what port
it owns and what it's eating — and ends the runaways with one click.
Windows 10 & 11 · Native app, no Electron · A few megabytes
What Winnom shows you
For every node.exe process, at a glance — refreshed every two seconds.
Listening ports
Read straight from the Windows kernel TCP table — no netstat parsing. You instantly know which process owns :3000 or :5173.
Live CPU, memory & uptime
Per-process CPU sampled live between refreshes, working-set memory, and how long each process has really been running.
Per-process network IO
Bytes up and down for each process, pulled from a kernel ETW trace. Run as administrator to light up the network columns.
Reveal the exact file
Hit the folder button and Explorer opens right at the serving directory — highlighting the script itself. Winnom reads the process's real working directory to get it right.
End it cleanly
The End process button terminates the process and its entire child tree, after a quick confirmation so you don't nuke unsaved work by accident.
One look at the whole fleet
A header strip rolls every Node process up into four numbers — total count, total CPU, total memory, and total network throughput — so you can tell at a glance whether Node is quietly idling or quietly eating your laptop.
Why Winnom
Native, not a browser in a trench coat
Built on WPF / .NET 10. No Electron, no Chromium, no 200 MB install. It starts instantly and stays out of the way.
Does one thing well
Not a bloated system dashboard. Winnom is laser-focused on Node.js processes — the thing developers actually need to wrangle a dozen times a day.
Reads the kernel, not guesses
Ports from the TCP table, working directories from the process PEB, network IO from ETW. Real numbers from the source, not scraped from other tools.
Get Winnom
Two builds, same core app. Windows 10 (1809+) and Windows 11, x64. Pick the one that fits.
Microsoft Store
Free
- Every Node process: port, CPU, memory, uptime
- What each process is serving, fingerprinted
- Reveal in Explorer and one-click end process
- Installs and updates through the Store
- No per-process network monitoring
Direct download · Gumroad
$5
- Everything in the Store build
- Per-process network IO from a kernel ETW trace
- Fleet-wide network totals in the rollup strip
- Run as administrator to light the network columns
- Supports development directly
Why the split? Per-process network monitoring needs a kernel ETW trace, and a packaged Store app can neither open one nor run as administrator. The direct build can — so that one feature lives only there.
Frequently asked questions
What is Winnom?
Winnom is the Windows Node Monitor — a lightweight native desktop app that lists every Node.js process running on your machine, shows its port, CPU, memory, uptime and what it's serving, and lets you end a process and its child tree with one click.
How do I find out what's using port 3000 on Windows?
Open Winnom. It reads listening ports straight from the Windows kernel TCP table and shows which Node.js process owns each port, so you can see what holds :3000 (or :5173, or :8080) without parsing netstat output — then kill it right there.
Is Winnom free?
The Microsoft Store build is free for Windows 10 and Windows 11. If you want per-process network monitoring, there's a paid direct-download build on Gumroad — the Store build can't open the kernel trace that feature needs.
Does Winnom use Electron?
No. Winnom is a native WPF / .NET 10 app. There's no browser engine and no hundreds-of-megabytes install — it starts instantly and the whole app is a few megabytes.
Why do the network numbers say “needs admin”?
Per-process network IO is measured through a Windows kernel trace (ETW) session, which is a privileged operation. Run Winnom as administrator and the network columns light up. Everything else works without elevation.