Sandboxie is published today in two editions, Plus and Classic, and newcomers are often puzzled to find that both appear on the same release page, carry different version numbers and yet are described as the same release. The confusion is understandable. For most of its history the program had one face and one name; the split into Sandboxie Plus and Classic arrived only after the original code was opened to the public. This article sets out what the two editions share, where they genuinely differ, how their licences and version numbers relate to one another, and how to decide which of them belongs on your machine.
The short version is that the difference lies almost entirely in the window you look at, not in the protection beneath it. The longer version matters, however, because the choice of interface determines which features you can reach comfortably, what you are permitted to do with the software in a business setting, and how much you will have to learn about the configuration file if you choose the older edition.
One engine, two editions
When Sophos released the source code under the GPL 3.0 in April 2020 and stepped away from the project, the developer David Xanatos forked it the following day. He has maintained it on GitHub ever since, in a repository that produces both editions from a single code base. That arrangement is the key to understanding the relationship: Plus and Classic are not rival products but two front ends built on top of one isolation engine.
That engine consists of three components that are identical in either edition:
- SbieDrv.sys, the kernel driver, which creates sandboxed processes with heavily restricted tokens and enforces the rules on system calls that would otherwise let a program write outside its box or read resources that have been closed to it.
- SbieSvc.exe, the service, which carries out privileged helper tasks on behalf of sandboxed programs and injects the support library into them.
- SbieDll.dll, the injected library, which virtualises the file system and registry and merges the contents of the sandbox with the real system so that a boxed program sees a coherent picture.
Because these parts are shared, the security and compatibility fixes published in each release reach both editions at once. A user who sticks with Classic is not running a weaker or older sandbox. The copy-on-write behaviour, the separate namespace for IPC objects, the private registry hive mounted for each box and the folder structure under the sandbox root all behave in exactly the same way whichever interface sits on top.
A useful mental model: the driver, service and library are the lock, and SandMan or Sandboxie Control is the key ring. Changing the key ring does not change the lock, but a larger key ring lets you reach more doors without having to cut the keys by hand.
The interfaces: SandMan, Vintage View and Sandboxie Control
Where the editions part company is in the program you open to manage your boxes. Each has its own character, and the gap between them has widened as development has concentrated on one side.
SandMan, the modern manager
The Plus edition ships with SandMan, a manager written with the Qt toolkit. It lists every box together with the processes running inside it, offers a dark mode and an optional theme styled after Windows 11, and gathers the many settings of a box into tabbed option pages rather than leaving them in a text file. Recent releases have added conveniences of real practical value: validation and auto-completion when editing the configuration directly, a search field in the tray menu, display aliases for boxes and a choice of border styles around sandboxed windows. Since the 1.16 series it has also been built with a modern compiler and Qt toolchain, which is part of the reason 32-bit builds were dropped.
Vintage View
Long-standing users sometimes find SandMan busier than the tool they knew. For them, Plus includes a Vintage View mode that reproduces the appearance of the old Sandboxie Control window. It is worth stressing that Vintage View is only a presentation layer: behind it you still have the Plus edition, with access to every newer option through the same settings dialogues. It is therefore the natural compromise for anyone who prefers the familiar layout but does not want to give up current features.
Sandboxie Control in the Classic edition
Classic retains the legacy interface, Sandboxie Control (SbieCtrl.exe), built with Microsoft's MFC libraries. It is no longer developed. It receives the same core fixes as Plus, but new capabilities are not added to its menus; where a new feature is supported by the engine, a Classic user has to enable it by editing the configuration file by hand. In practice this means Classic suits people who already know the setting names they want and value a small, quiet tool that changes very little from one release to the next.
Feature differences between Sandboxie Plus and Classic
The table below sets the two editions side by side. It is limited to differences that the project itself documents; where a capability depends on the shared engine, both columns reflect that.
| Aspect | Plus | Classic |
|---|---|---|
| Management interface | SandMan (Qt), with optional Vintage View | Sandboxie Control (MFC) |
| Development status | Receives all new features | No longer developed; core fixes only |
| Isolation engine | SbieDrv.sys, SbieSvc.exe, SbieDll.dll | The same components |
| Security and compatibility fixes | Included in every release | Included in every release |
| Access to newer options | Through settings pages and the INI editor | Manual editing of the configuration file, where supported |
| Dark mode and modern theme | Yes | No |
| Installers offered | x64 and ARM64 | x64 |
| Approximate installer size | About 24 MB | About 3 MB |
| Licence | Custom open-core licence | GPL-3.0-or-later |
| Version series | 1.x (for example 1.18.8) | 5.x (for example 5.73.8) |
Two rows deserve comment. The size gap reflects the Qt libraries that SandMan carries rather than any difference in the sandbox itself. The ARM64 row matters to owners of Windows on ARM devices: only Plus is built for that architecture, and on the free tier ARM64 runs as a trial, with continued use tied to a supporter certificate.
Beyond the table lie the box types that have become a defining part of the Plus experience. Standard Isolation is the free default. Security Hardened boxes, Privacy Enhanced boxes and App Compartment boxes each require a certificate, as do RAM disk boxes and USB drive sandboxing. Encrypted boxes, proxy injection and DNS filtering sit in the Advanced Feature Pack, which is needed in addition to a certificate. Snapshots, network rules through the Windows Filtering Platform and the Windows 11 context menu entry are available free of charge. All of these are presented through SandMan, which is why the Plus edition is the one most people end up using.
Licences, certificates and permitted use
The editions also differ in the terms under which they are distributed, and this is where a casual choice can have consequences for an organisation.
Classic is released under the GPL, version 3.0 or later, the same family of licence under which Sophos first opened the code. Plus is released under a custom, open-core licence. It is free for personal, non-commercial use, and on the free tier it shows an occasional reminder asking for support. Commercial use and educational use of Plus both require a Business certificate, which covers one PC per certificate for one year.
For individuals, several certificate types exist. The project describes them broadly as follows:
- Home: personal use on all of your own devices for one year.
- Personal: one year of updates, with builds released before expiry continuing to work afterwards.
- Family Pack: the whole family for one year, even across different households.
- Eternal: no expiry, family coverage and the Advanced Feature Pack included.
There are also Developer certificates, free lifetime Contributor certificates for people who help the project, and certificates linked to a Patreon subscription that remain valid while the subscription is active. A certificate or serial key is applied in SandMan under Options, then Global Settings, on the Support & Updates page; the program needs an internet connection to fetch it.
If you manage machines at work or in a school, read the licence before deploying anything. The free personal tier of Plus does not extend to commercial or educational settings, whatever edition of the interface your users happen to prefer.
Why the editions carry twin version numbers
Each release of the project produces a pair of numbers. At the time of writing, the current stable release is Plus 1.18.8, which is the same release as Classic 5.73.8. A pre-release, Plus 1.19.0 and Classic 5.74.0, is available for testing. The Classic numbering continues the 5.x line inherited from the Sophos era, when the last freeware build was 5.31.4 and the source-only release was 5.40; the Plus numbering began afresh with the new interface and reached its first stable 1.0 release in December 2021.
The practical point is simple. If one site reports 1.18.8 and another reports 5.73.8, they are not describing different degrees of freshness. They are describing the same code. The confusion arises chiefly on download portals that list only one of the two numbers, which can make it look as though Classic is far ahead of Plus, or as though one portal is badly out of date when it is not.
When you check whether you are current, compare like with like: a Plus number against the Plus number on the release page, a Classic number against the Classic number. The release notes for each version list both figures together.
Moving from one edition to the other
Because the editions share a core, switching between them is closer to changing a front end than to replacing a product. The project's general advice for any update that does not go smoothly applies here as well: uninstall the existing version while keeping the configuration file, then install the new build.
A careful migration from Classic to Plus usually looks like this in outline:
- Close every sandboxed program and make sure nothing you need is still sitting inside a box.
- Take a copy of the main configuration file and, if your boxes hold data you value, of the sandbox folders themselves, which live under the sandbox root, by default C:\Sandbox followed by your user name and the box name.
- Uninstall Classic and choose to keep the configuration when asked.
- Install the Plus build appropriate to your architecture, which by default goes to C:\Program Files\Sandboxie-Plus\.
- Open SandMan and confirm that your boxes and their settings have been read correctly.
Moving in the opposite direction follows the same pattern. The caution worth adding is that settings created through SandMan for newer features have no menu in Sandboxie Control. Some may continue to work if the engine supports them; others relate to Plus-only capabilities and certificates. Reviewing the configuration file after the switch is therefore sensible rather than optional.
Users who simply dislike the look of SandMan should consider Vintage View before downgrading at all. It gives back the familiar layout while keeping access to everything Plus offers, which makes a migration to Classic unnecessary for many people.
Who should choose which edition
For the great majority of readers, Sandboxie Plus is the sensible default. It is where development happens, it exposes the newer box types and options through a graphical interface, it is the only edition built for ARM64, and it can be made to look like the old tool if that matters to you. Choose Plus if any of the following describes you:
- You are new to sandboxing and would rather adjust settings in dialogues than learn configuration keys.
- You want Privacy Enhanced, Security Hardened or App Compartment boxes, encrypted boxes, or any other certificate feature.
- You use a Windows on ARM device.
- You value the INI editor's validation and auto-completion, or the newer display options for borders and box names.
Classic still has a place. It suits users who want the smallest possible installation, who are entirely comfortable maintaining their configuration by hand, and who prefer a manager that will not change its appearance from one release to the next. Its GPL licence may also appeal to those who place particular weight on distribution under a standard free-software licence, although anyone using it in an organisation should still check the terms carefully rather than assume.
Whichever edition you choose, the limits of the sandbox are the same. It is not an antivirus. A standard box can read most files on the system unless you use Privacy mode. Recovered files leave the box and should be scanned first. App Compartment boxes are not a security boundary. Windows updates and Insider builds can occasionally break the driver until a fix is released, and some software, notably games with anti-cheat systems and anything that installs drivers, will not run sandboxed. None of this changes with the interface.
Frequently Asked Questions
Is Classic less secure than Plus?
No. Both editions use the same driver, service and injected library, and both receive the same security and compatibility fixes in each release. The difference lies in the management interface and in which newer features you can reach without editing the configuration file by hand.
Why does Classic have a much higher version number?
Classic continues the 5.x numbering inherited from the earlier releases, while Plus started a new 1.x series. The current stable release is Plus 1.18.8, which is the same release as Classic 5.73.8.
Can I make Sandboxie Plus look like the old program?
Yes. SandMan includes a Vintage View mode that reproduces the appearance of Sandboxie Control while keeping all of the Plus options available.
Is there a Classic build for ARM64 devices?
No. Classic is offered only as an x64 installer. ARM64 builds are available for Plus, where ARM64 runs as a trial on the free tier and is included with a supporter certificate.
Do I need a certificate to use Plus at work?
Yes. The free tier of Plus covers personal, non-commercial use only. Commercial and educational use require a Business certificate, which covers one PC per certificate for one year.
Will my boxes survive a switch between editions?
Generally, yes, provided you keep the configuration file when uninstalling and leave the sandbox folders in place. Back both up first, and review the configuration afterwards, since options created for Plus-only features have no menu in Sandboxie Control.
Conclusion
Plus and Classic are best understood as two windows onto one sandbox. The driver that restricts tokens, the service that performs privileged work and the library that virtualises files and registry entries are common to both, and so are the fixes that keep them sound. What separates the editions is the experience of managing that engine: a modern, actively developed manager with a graphical route to every option on one side, and a frozen, compact legacy tool that expects you to speak the language of the configuration file on the other. Add to that the different licences and the twin version numbers, and most of the apparent mystery disappears.
For most people the choice settles itself. Sandboxie Plus offers the current features, the ARM64 build and, through Vintage View, even the old appearance, which leaves Classic as a deliberate preference for a small group of experienced users who want minimalism above all. Whichever you pick, take a moment to confirm that your use falls within the licence, keep a copy of your configuration before changing editions, and remember that the sandbox is a means of containment rather than a replacement for sound judgement about what you choose to run.