The value
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced → HideFileExt (DWORD): 1 = extensions hidden, 0 = shown. Default is 1.
Why this specific one matters
The classic trick — invoice.pdf.exe — only works when extensions are hidden. Every security awareness session starts with showing extensions; every baseline hardening guide (DISA, ACSC, ANSSI-style) keeps it on. On a per-user tool catalog it's a two-minute win with zero side effects.
What people get wrong
- “Renaming gets tedious”: renaming in Explorer with extensions shown still selects the name only — the objection is from 2002, not from now.
- “It forces renames on copy”: no; duplicate file naming keeps the extension intact either way.
- “Some folders need it hidden”: extension display isn't per-folder — this one's global per account by design.
Set it to 0, sign out or restart Explorer, and filenames show their truth. Restore by writing 1 back — nothing else is involved.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.