File formats, and what opens them
All 165 file extensions the tools here open, grouped by kind, each with a line on what it is, what it can give away, and which tools take it. Every one opens in your browser tab.
An extension is only a name: a file called .jpg can be a PDF inside. Tools read the bytes, not the name, and 40 of them take a file of any kind. For a file you cannot identify, MAGIC names its real type from its first bytes, and X-RAY and HEX show what is in it whatever it is.
Documents, books and web pages · Word, Excel and PowerPoint files · Email, calendars and contacts · Pictures · Camera raw · Audio, video and subtitles · Data, spreadsheets and tracks · Captures, logs and Windows artefacts · Programs, extensions, archives and code · Keys, certificates and signatures · Fonts · Files this site writes
Where a format has a published specification, its line names it. The lines were written against those documents where they are public; camera raw formats, Prefetch, Safari's .webarchive, and the SubRip and SubStation Alpha subtitle formats have no public specification, and those lines describe how the formats are generally known to work.
Documents, books and web pages (10)
Text you read: PDFs, e-books, Markdown and saved web pages.
Besides the tools listed, 2 take any text file: CONTRAST, UNSEEN.
| Extension | What it is | Opened by |
|---|---|---|
| .epub EPUB e-book | A zip of XHTML chapters, a stylesheet and a package file that lists them in reading order. Most e-book readers other than Kindle read it.Defined by EPUB 3.3 (W3C).Guide: Making an EPUB from a Word file | READER |
| .htm Web page | The same as .html, with the three-letter extension older Windows systems needed.Defined by HTML Living Standard (WHATWG). | Docs, ARCHIVE, BOOK, CAPSULE, UNBEACON |
| .html Web page | A web page's markup. A page saved from a browser as .html keeps its text but usually fetches its pictures and scripts from the web again when opened, which tells that site it was opened.Defined by HTML Living Standard (WHATWG). | Docs, ARCHIVE, BOOK, CAPSULE, TAKEOUT, UNBEACON, UNSEEN, UNSUB |
| .markdown Markdown | The long form of .md, the same plain text with light markup.Defined by CommonMark, or RFC 7763 for the media type. | Docs, Notes, BOOK, FOLIO, JOURNAL, MERGE, TELLS |
| .md Markdown | Plain text with a light markup: # for a heading, * for a list, ** for bold. It reads as it is and converts to HTML. The .md and .markdown extensions are the same thing.Defined by CommonMark, or RFC 7763 for the media type.Guide: A notes app that keeps notes as files | Docs, Notes, BOOK, CONTRAST, FOLIO, JOURNAL, MERGE, REDLINE, TELLS, UNSEEN |
| .mht Web archive (MHTML) | A whole web page, pictures included, packed into one file in the form of an email message. Chrome and Edge save pages this way.Defined by RFC 2557. | ARCHIVE |
| .mhtml Web archive (MHTML) | The long form of .mht: one web page and everything it shows, in one file.Defined by RFC 2557. | ARCHIVE |
| .pdf | Portable Document Format: pages described as objects in a file that can be added to without rewriting it, so earlier versions, deleted pages and text under a black box can survive inside.Defined by ISO 32000-2.Guide: Recovering text from under a redaction | PDF, ABSTRACT, BLIND, BOOKLET, BUNDLE, DISARM, EXHIBIT, FLATTEN, FORMAUDIT, LANTERN, OPTIC, PACT, PADLOCK, PDFSIG, PRESS, READER, RECEIPTS, REDLINE, REFLOW, SCRUB, SEAL, STAPLE, STRATA, WATERMARK |
| .txt Plain text | Characters and nothing else: no fonts and no layout. It says nothing about its own encoding, so a file from an old system may show accented letters wrongly until it is read as the right one. | Docs, Notes, PLAN, Sheets, ABSTRACT, ANON, BASE, BEACON, BLIND, BOOK, Cards, CASEMAP, CDR, CERTLENS, CHART, COMMS, CONTRAST, CROWD, DATASCAN, DIGITS, DOSSIER, FOLIO, HOMOGLYPH, HOUSESTYLE, JOURNAL, KEYPRINT, LINK, LOGON, MAILBOX, MATCH, MERGE, MONEY, PIVOT, PLUGGED, RECONCILE, REDLINE, SAMPLE, SIEVE, SIGIL, SPLIT, STRUCTURING, SUBS, SWEEP, TELLS, TIMESTOMP, UNBEACON, UNSEEN, UNSUB |
| .webarchive Safari web archive | A page saved by Safari: a binary property list holding the page and each resource it loaded. Apple publishes no specification of it, and few programs outside macOS and iOS open it. | AMBER |
Word, Excel and PowerPoint files (21)
Microsoft Office files. Since Office 2007 the x at the end means a zip of XML parts (Office Open XML); the m means the same with a macro project inside; the old three-letter names are the binary formats from before 2007.
| Extension | What it is | Opened by |
|---|---|---|
| .doc Word 97-2003 document | Word's binary format from before 2007, inside a Compound File (a small file system in one file). It can carry macros, and it keeps more history about its editing than it shows.Defined by MS-DOC and MS-CFB (Microsoft). | MACROLENS |
| .docm Word document with macros | A .docx that holds a VBA macro project (vbaProject.bin). Word only runs the macros if you let it.Defined by ECMA-376 and MS-OVBA. | DISARM, LINEAGE, MACROLENS, SCRUB |
| .docx Word document | A zip of XML parts: the text, the styles, the pictures, and separate parts for comments, tracked changes and the author's name. Renamed to .zip it opens as a folder.Defined by ECMA-376 / ISO/IEC 29500.Guide: What is hidden in a Word document | Docs, ABSTRACT, BLIND, BOOK, CV, DISARM, DOCSCRUB, LANTERN, LINEAGE, MACROLENS, REDLINE, SCRUB |
| .dot Word 97-2003 template | A Word template in the pre-2007 binary format. Like .doc, it can carry macros.Defined by MS-DOC and MS-CFB (Microsoft). | MACROLENS |
| .dotm Word template with macros | A Word template with a VBA project. A template attached to documents can run its macros in every one of them.Defined by ECMA-376 and MS-OVBA. | DISARM, LINEAGE, MACROLENS |
| .dotx Word template | A .docx that makes new documents rather than being edited itself.Defined by ECMA-376 / ISO/IEC 29500. | DISARM, LINEAGE, MACROLENS |
| .potm PowerPoint template with macros | A PowerPoint template with a VBA project inside.Defined by ECMA-376 and MS-OVBA. | DISARM, MACROLENS |
| .potx PowerPoint template | A presentation that makes new presentations.Defined by ECMA-376 / ISO/IEC 29500. | DISARM, MACROLENS |
| .pps PowerPoint 97-2003 show | A pre-2007 presentation that opens straight into the slide show.Defined by MS-PPT (Microsoft). | MACROLENS |
| .ppsm PowerPoint show with macros | A slide show file with a VBA project inside.Defined by ECMA-376 and MS-OVBA. | DISARM, MACROLENS |
| .ppsx PowerPoint show | A .pptx that opens straight into the slide show.Defined by ECMA-376 / ISO/IEC 29500. | DISARM |
| .ppt PowerPoint 97-2003 presentation | PowerPoint's binary format from before 2007, in a Compound File. It can carry macros.Defined by MS-PPT and MS-CFB (Microsoft). | MACROLENS |
| .pptm PowerPoint presentation with macros | A .pptx with a VBA macro project inside.Defined by ECMA-376 and MS-OVBA. | DISARM, MACROLENS, SCRUB |
| .pptx PowerPoint presentation | A zip of XML parts, one per slide, with the pictures and the speaker notes as parts of their own. Notes you never showed are still in the file you send.Defined by ECMA-376 / ISO/IEC 29500.Guide: A free PowerPoint alternative in the browser | Slides, DISARM, MACROLENS, SCRUB |
| .xla Excel 97-2003 add-in | A pre-2007 binary workbook that loads as an add-in, usually to add macros to Excel.Defined by MS-XLS (Microsoft). | MACROLENS |
| .xlam Excel add-in | A macro-enabled workbook that loads as an add-in each time Excel starts.Defined by ECMA-376 and MS-OVBA. | MACROLENS |
| .xls Excel 97-2003 workbook | Excel's binary format from before 2007 (BIFF8, in a Compound File). It can carry macros, including the old Excel 4.0 macro sheets.Defined by MS-XLS and MS-CFB (Microsoft). | MACROLENS |
| .xlsm Excel workbook with macros | A .xlsx with a VBA macro project inside.Defined by ECMA-376 and MS-OVBA. | DISARM, MACROLENS, SCRUB |
| .xlsx Excel workbook | A zip of XML parts, one per sheet, with the shared text, the styles, and each formula's last calculated value stored beside it. Hidden sheets and cells are in there, just not shown.Defined by ECMA-376 / ISO/IEC 29500.Guide: What a spreadsheet still contains | Sheets, CLEANSHEET, DISARM, MACROLENS, SCRUB |
| .xltm Excel template with macros | An Excel template with a VBA project inside.Defined by ECMA-376 and MS-OVBA. | DISARM, MACROLENS |
| .xltx Excel template | A workbook that makes new workbooks.Defined by ECMA-376 / ISO/IEC 29500. | DISARM, MACROLENS |
Email, calendars and contacts (9)
Single messages, whole mailboxes, and what a mail program exports.
| Extension | What it is | Opened by |
|---|---|---|
| .dat winmail.dat (TNEF) | The attachment Outlook sends when it wraps a message's formatting and attachments in its own Transport Neutral Encapsulation Format. The real attachments are inside it.Defined by MS-OXTNEF (Microsoft).Guide: Opening winmail.dat | SATCHEL |
| .eml Email message | One email as it travelled: the headers, including every server it passed through, then the body and attachments in MIME parts. It is plain text and any mail program opens it.Defined by RFC 5322 and RFC 2045.Guide: Telling whether an email is genuine | MAILBOX, POST, SIGNET, UNBEACON, UNSEEN, UNSUB |
| .ics Calendar (iCalendar) | Events as text: times, place, organiser, and every attendee's address. Forwarding an invite forwards all of it.Defined by RFC 5545.Guide: Forwarding a meeting invitation | Calendar, CALSCRUB, TAKEOUT |
| .mbox Mailbox | Many messages in one text file, each starting on a line beginning "From ". Gmail's Takeout and Thunderbird use it.Defined by RFC 4155.Guide: What a Google Takeout export contains | POST, POSTBAG, TAKEOUT |
| .mbx Mailbox (older mail programs) | The mbox layout under the name some older mail programs, Eudora among them, gave it.Defined by RFC 4155. | POST, POSTBAG |
| .msg Outlook message | One email saved from Outlook, in a Compound File of MAPI properties rather than as text. Most programs other than Outlook cannot open it.Defined by MS-OXMSG (Microsoft).Guide: Opening a .msg file | CABINET, MAILBOX, SATCHEL |
| .ost Outlook offline data file | Outlook's local copy of a mailbox held on a server, in the same structure as a .pst.Defined by MS-PST (Microsoft). | CABINET |
| .pst Outlook data file | A whole Outlook mailbox, folders, contacts and calendar included, in Outlook's own binary database format.Defined by MS-PST (Microsoft). | CABINET |
| .vcf Contact card (vCard) | One or more contacts as text: names, numbers, addresses, and sometimes a photo.Defined by RFC 6350 (vCard 4.0). | Contacts, TAKEOUT |
Pictures (12)
Photographs, screenshots and drawings.
Besides the tools listed, 22 take any picture your browser can open (JPEG, PNG, GIF, WebP and, in Safari, HEIC): Slides, BASTION, BOOK, CLOAK, CONTRAST, EXIF, ICONS, IMAGEDIFF, INVENTORY, Obscura Photo Editor, OPTIC, PALIMPSEST, PASSPORT, PHANTOM, POSTER, QRSHIELD, RECEIPTS, SCREENSHIELD, SHRINK, SNAP, TAMPER, VEIL.
| Extension | What it is | Opened by |
|---|---|---|
| .bmp Bitmap | Uncompressed pixels, as Windows stores them. Large, and plain.Defined by Microsoft BITMAPINFOHEADER documentation. | DOTS, SCREENS, STEGOSCAN |
| .gif GIF image | 256 colours at most, with simple animation. Old, small, and still everywhere.Defined by GIF89a (CompuServe). | SCREENS, STEGOSCAN |
| .heic HEIC photograph | What an iPhone takes by default: HEVC-compressed pictures in a HEIF container, with the same EXIF data a JPEG carries. Windows and most browsers other than Safari cannot show it without help.Defined by ISO/IEC 23008-12 (HEIF).Guide: Opening a HEIC file | BOOK, DOTS, INVENTORY, Obscura Photo Editor, OPTIC, PHOTO, RECEIPTS, SCREENS, SHRINK, SNAP |
| .heif HEIF image | The container .heic files use, under its general name.Defined by ISO/IEC 23008-12 (HEIF).Guide: Opening a HEIC file | BOOK, DOTS, INVENTORY, Obscura Photo Editor, OPTIC, PHOTO, RECEIPTS, SCREENS, SHRINK, SNAP |
| .jpeg JPEG photograph | The same as .jpg.Defined by ITU-T T.81; EXIF (CIPA DC-008).Guide: What a photo says about where it was taken | PDF, BUNDLE, DOTS, EXHIBIT, PHOTO, RECEIPTS, SCREENS, SNAP, STAPLE, STEGOSCAN |
| .jpg JPEG photograph | Lossy compression for photographs. Most carry EXIF data: the camera, the time and, from a phone, often the place, and sometimes a thumbnail made before the photo was cropped.Defined by ITU-T T.81; EXIF (CIPA DC-008).Guide: What a photo says about where it was taken | PDF, BUNDLE, DOTS, EXHIBIT, PHOTO, RECEIPTS, SCREENS, SNAP, STAPLE, STEGOSCAN |
| .png PNG image | Lossless compression, for screenshots and graphics. It can hold EXIF and text chunks, but most PNGs made by a screenshot carry little beyond the size and sometimes the software.Defined by PNG (W3C Recommendation).Guide: What a PNG carries | PDF, BUNDLE, DOTS, EXHIBIT, PHANTOM, PHOTO, RECEIPTS, SCREENS, SNAP, STAPLE, STEGOSCAN |
| .psd Photoshop document | Photoshop's layered format: every layer, mask and adjustment, with a flattened copy of the whole picture.Defined by Adobe Photoshop File Formats Specification. | Obscura Photo Editor |
| .svg SVG drawing | A drawing written as XML. Because it is a document, it can carry scripts and links that fetch things from elsewhere when it is opened.Defined by SVG 1.1 / SVG 2 (W3C). | Obscura Photo Editor, SVGCLEAN |
| .tif TIFF image | Tagged Image File Format: pixels plus tags describing them, used for scans, print and archives. Many camera raw formats are built on it.Defined by TIFF 6.0 (Adobe). | Obscura Photo Editor |
| .tiff TIFF image | The same as .tif.Defined by TIFF 6.0 (Adobe). | Obscura Photo Editor |
| .webp WebP image | Google's format for the web, lossy or lossless, in a RIFF container that can also carry EXIF and XMP.Defined by RFC 9649. | PDF, DOTS, PHANTOM, PHOTO, RECEIPTS, SCREENS, SNAP, STEGOSCAN |
Camera raw (27)
What a camera writes before it makes a JPEG: the sensor's readings, the settings, and usually a small JPEG preview. Every one of these is taken by the Photo Editor, which is part of OBSCURA Pro.
| Extension | What it is | Opened by |
|---|---|---|
| .3fr Hasselblad raw | Hasselblad's raw format. | Obscura Photo Editor |
| .arw Sony raw | Sony's raw format, built on TIFF. | Obscura Photo Editor |
| .cr2 Canon raw | Canon's raw format up to about 2018, built on TIFF. | Obscura Photo Editor |
| .cr3 Canon raw | Canon's current raw format, built on the ISO base media file format that MP4 uses. | Obscura Photo Editor |
| .crw Canon raw (early) | Canon's first raw format, from its early digital cameras. | Obscura Photo Editor |
| .dcr Kodak raw | One of Kodak's raw formats. | Obscura Photo Editor |
| .dng Digital Negative | Adobe's open raw format, built on TIFF. Some cameras and phones write it directly; other raw files are often converted to it for keeping.Defined by DNG Specification (Adobe). | Obscura Photo Editor |
| .erf Epson raw | The raw format of Epson's rangefinder cameras. | Obscura Photo Editor |
| .fff Hasselblad and Imacon raw | The raw format of Hasselblad's and Imacon's scanning backs and cameras. | Obscura Photo Editor |
| .gpr GoPro raw | GoPro's raw stills: DNG with a different compression (VC-5). | Obscura Photo Editor |
| .iiq Phase One raw | Phase One's raw format, from its medium-format backs. | Obscura Photo Editor |
| .kdc Kodak raw | One of Kodak's raw formats. | Obscura Photo Editor |
| .mef Mamiya raw | The raw format of Mamiya's digital cameras. | Obscura Photo Editor |
| .mos Leaf raw | The raw format of Leaf's digital backs. | Obscura Photo Editor |
| .mrw Minolta raw | The raw format of Minolta and Konica Minolta cameras. | Obscura Photo Editor |
| .nef Nikon raw | Nikon Electronic Format, built on TIFF. | Obscura Photo Editor |
| .nrw Nikon raw (compact cameras) | The raw format of Nikon's Coolpix compacts. | Obscura Photo Editor |
| .orf Olympus and OM System raw | The raw format of Olympus and OM System cameras. | Obscura Photo Editor |
| .pef Pentax raw | Pentax Electronic File, built on TIFF. | Obscura Photo Editor |
| .raf Fujifilm raw | Fujifilm's raw format, with a JPEG preview near the start of the file. | Obscura Photo Editor |
| .raw Camera raw (generic name) | Used by several makers, early Panasonic and Leica among them. The extension says little; what is inside decides whether it opens. | Obscura Photo Editor |
| .rw2 Panasonic raw | Panasonic's raw format. | Obscura Photo Editor |
| .rwl Leica raw | The raw format of Leica cameras made with Panasonic. | Obscura Photo Editor |
| .sr2 Sony raw (early) | One of Sony's earlier raw formats. | Obscura Photo Editor |
| .srf Sony raw (early) | One of Sony's earlier raw formats. | Obscura Photo Editor |
| .srw Samsung raw | The raw format of Samsung's cameras. | Obscura Photo Editor |
| .x3f Sigma raw | The raw format of Sigma's Foveon-sensor cameras. | Obscura Photo Editor |
Audio, video and subtitles (17)
Recordings, and the subtitle files that go with them.
Besides the tools listed, 7 take any recording your browser can play: AVSCRUB, HUSH, SCRIBE, SNIP, SPLICE, SUBS, VOICEGUARD.
Besides the tools listed, 6 take any video your browser can play: AVSCRUB, HUSH, RECAST, SCRIBE, SPLICE, SUBS.
| Extension | What it is | Opened by |
|---|---|---|
| .aac AAC audio | Raw AAC audio without the MP4 container around it.Defined by ISO/IEC 14496-3. | HUSH, SNIP |
| .ass Advanced SubStation Alpha subtitles | Subtitles with styles, positions and effects, much used for anime. Documented by the programs that use it rather than by a standard. | SUBS |
| .flac FLAC audio | Lossless audio, with text tags (Vorbis comments) and pictures in blocks at the front.Defined by RFC 9639. | AVSCRUB, HUSH, SNIP |
| .m4a MPEG-4 audio | AAC or ALAC audio in the MP4 container. Voice memos on an iPhone are saved this way, with the recording date inside.Defined by ISO/IEC 14496-12 and -14. | AVSCRUB, HUSH, SNIP |
| .m4v MPEG-4 video | MP4 under the name Apple uses for video.Defined by ISO/IEC 14496-12. | HUSH |
| .mkv Matroska video | An open container that can hold any codec, several audio tracks, subtitles and attachments.Defined by RFC 9559. | HUSH |
| .mov QuickTime movie | Apple's container, from which MP4 was developed. iPhone video is .mov, with the place it was filmed inside.Defined by QuickTime File Format (Apple).Guide: What a video file gives away | AVSCRUB, HUSH |
| .mp3 MP3 audio | Lossy audio. ID3 tags at the start or end can hold the title, artist, pictures and comments, sometimes the software and a name.Defined by ISO/IEC 11172-3; ID3v2 (informal). | AVSCRUB, HUSH, SNIP |
| .mp4 MP4 video | Video and audio in the MPEG-4 container, with boxes that can hold the recording time, the device and, from a phone, the place.Defined by ISO/IEC 14496-12 and -14.Guide: What a video file gives away | AVSCRUB, HUSH |
| .oga Ogg audio | The same as .ogg, named to say it holds audio only.Defined by RFC 3533 and RFC 5334. | AVSCRUB, HUSH |
| .ogg Ogg audio | Audio, usually Vorbis or Opus, in the Ogg container.Defined by RFC 3533. | AVSCRUB, HUSH, SNIP |
| .opus Opus audio | Opus audio in Ogg: what WhatsApp and many voice-note apps record.Defined by RFC 6716 and RFC 7845. | AVSCRUB, HUSH |
| .srt SubRip subtitles | The commonest subtitle file: a number, a start and end time, and the words, repeated. No formal specification was ever published. | SUBS |
| .ssa SubStation Alpha subtitles | The older form of .ass, with fewer styling options. | SUBS |
| .vtt WebVTT subtitles | The web's subtitle format, close to SRT, with cue settings for position and styling.Defined by WebVTT (W3C). | SUBS |
| .wav WAV audio | Usually uncompressed audio in a RIFF container, which can also carry chunks of text: who recorded it, when, and with what.Defined by Microsoft RIFF / WAVE. | AVSCRUB, HUSH, SNIP |
| .webm WebM video or audio | A subset of Matroska for the web, with VP8, VP9 or AV1 video and Vorbis or Opus audio. Browsers record screens and microphones in it.Defined by WebM Project, on RFC 9559. | HUSH, SNIP |
Data, spreadsheets and tracks (9)
Tables, structured data, bank downloads and GPS tracks.
| Extension | What it is | Opened by |
|---|---|---|
| .1pux 1Password export | A zip holding export.data, a JSON file of every item in the vault, and any attached files. It is not encrypted, so it should not be kept once it has been imported. 1Password describes the format on its support site, which could not be reached to check this line against.Guide: A password manager with no account | MIGRATOR |
| .csv Comma-separated values | A table as text, one row per line. The file does not say which character separates the columns or how it is encoded, which is why it can open in one column.Defined by RFC 4180.Guide: A CSV that opens in one column | Contacts, PLAN, Sheets, Tasks, ANON, BASE, BEACON, Cards, CASEMAP, CDR, CHART, COMMS, COSTS, CROWD, DATASCAN, DIGITS, DOSSIER, HOMOGLYPH, KEYS, LINK, LOGON, MATCH, MERGE, MIGRATOR, MONEY, RECONCILE, SAMPLE, SIEVE, SPLIT, STRUCTURING, TAKEOUT, TIMESTOMP, UNSEEN |
| .gpx GPS track | Points with latitude, longitude, height and time, from a watch, phone or app. A run's track starts and ends where the run did.Defined by GPX 1.1 (Topografix).Guide: Sharing a run without giving away where you live | TRAIL |
| .json JSON | Structured data as text: objects, lists, strings and numbers. Most apps' exports are JSON.Defined by RFC 8259. | Contacts, Drive, PLAN, Tasks, ALIAS, BREACH, Cards, CASEMAP, CHAIN, CLAUSE, CONFLICT, CONSENT, CONTRAST, COSTS, CV, DATASCAN, DOSSIER, DSAR, Forms, HOLD, INTERCEPT, INTERVIEW, INVENTORY, INVOICES, JOURNAL, KEYS, LEDGER, MIGRATOR, MILEAGE, MINUTES, MIRAGE, MONEY, PACT, PRIVLOG, PROOF, QUOTE, REDACTLOG, REQUEST, RETENTION, ROPA, SNAP, STATEMENT, TAKEOUT, THREAD, TIMELINE, UNSEEN, WITNESS |
| .ofx Open Financial Exchange | A bank or card statement for accounting software: every transaction with its date, amount and reference.Defined by OFX specification (Financial Data Exchange). | MONEY |
| .qfx Quicken statement | Intuit's form of OFX, for Quicken, with a few fields of its own.Defined by OFX, with Intuit's additions. | MONEY |
| .tcx Garmin training file | Garmin's XML for workouts: the track plus heart rate, cadence and laps.Defined by Training Center Database schema (Garmin).Guide: Sharing a run without giving away where you live | TRAIL |
| .tsv Tab-separated values | A table as text with tabs between the columns: what copying from a spreadsheet gives you.Defined by IANA text/tab-separated-values. | Sheets, ANON, Cards, CHART, DATASCAN, MERGE, RECONCILE, SAMPLE, SIEVE, SPLIT |
| .xml XML | Structured data in tags. What it means depends on who wrote it: here, a Microsoft Project plan, an Apple Health export or an Nmap scan.Defined by XML 1.0 (W3C). | PLAN, SWEEP, TRAIL, VITALS |
Captures, logs and Windows artefacts (13)
What a network capture, a browser or Windows leaves behind, and the lists of hashes used to sort files.
| Extension | What it is | Opened by |
|---|---|---|
| .bin Office macro project (vbaProject.bin) | Taken here as the VBA project pulled out of an Office file: the macros' source and compiled code in a Compound File. A .bin from anywhere else may be anything at all.Defined by MS-OVBA (Microsoft). | MACROLENS |
| .cap Capture file (by name) | An extension several capture tools use. WIRE reads it if what is inside is pcap or pcapng, whatever the name says. | WIRE |
| .dmp Capture file (by name) | Some capture tools use .dmp; Windows uses it for memory dumps, which are a different thing. WIRE reads it only if it is pcap or pcapng inside. | WIRE |
| .gnmap Nmap grepable output | Nmap's one-line-per-host results, made for grep.Defined by Nmap documentation. | SWEEP |
| .har HTTP Archive | A browser's record of every request a page made, as JSON: addresses, headers, cookies and often the bodies. One saved while signed in carries the session.Defined by HAR 1.2 (W3C draft, never published as a standard). | INTERCEPT |
| .lnk Windows shortcut | A shortcut file, which records its target's path, size and times, and often the volume serial number and the name of the computer it was made on.Defined by MS-SHLLINK (Microsoft). | SHORTCUT |
| .log Log file | Text lines a program writes as it works. The tools here read Windows' setupapi.dev.log, DNS and proxy logs, authentication logs and web server logs.Guide: Telling whether a USB drive was plugged in | BEACON, HOMOGLYPH, LOGON, PLUGGED |
| .md5 MD5 hash list | A list of MD5 digests, each usually followed by a file name, as md5sum writes it.Defined by RFC 1321 for MD5.Guide: Sorting files by hash | SIEVE |
| .pcap Packet capture | Network traffic as tcpdump and Wireshark write it: a file header, then every packet with its time.Defined by IETF draft-ietf-opsawg-pcap (not yet an RFC).Guide: Reading a packet capture | WIRE |
| .pcapng Packet capture, next generation | Wireshark's default: blocks that can record several interfaces, comments and name resolutions alongside the packets.Defined by IETF draft-ietf-opsawg-pcapng (not yet an RFC).Guide: Reading a packet capture | WIRE |
| .pf Windows Prefetch | Written by Windows each time a program runs: how many times, the last eight run times on Windows 8 and later, and the files it loaded. Since Windows 10 it is compressed (a MAM header, then Xpress Huffman). Microsoft does not publish the format.Guide: Telling whether a USB drive was plugged in | PREFETCH |
| .sha1 SHA-1 hash list | A list of SHA-1 digests and file names, as sha1sum writes it.Defined by FIPS 180-4.Guide: Sorting files by hash | SIEVE |
| .sha256 SHA-256 hash list | A list of SHA-256 digests and file names, as sha256sum writes it: what a download page publishes to check against.Defined by FIPS 180-4.Guide: Checking a file has not been changed | SIEVE |
Programs, extensions, archives and code (19)
Things that run, or hold things that run.
| Extension | What it is | Opened by |
|---|---|---|
| .apk Android app | A zip of the app's code, resources and AndroidManifest.xml, which lists the permissions it asks for, signed by its developer.Defined by Android developer documentation.Guide: What a browser extension can do | MANIFEST |
| .apks Android app set | Several split APKs in one zip, as bundletool and some app stores make them.Defined by bundletool documentation. | MANIFEST |
| .cpl Control Panel item | A Windows library that opens as a Control Panel applet when double-clicked.Defined by PE Format (Microsoft). | VOUCH |
| .crx Chrome extension | A zip with a signed header in front: the letters Cr24, a version, then keys and signatures. Inside is manifest.json, which lists the permissions.Defined by Chromium source, crx3.proto.Guide: What a browser extension can do | MANIFEST |
| .css Stylesheet | The colours, sizes and layout of a web page, as text.Defined by CSS (W3C). | CONTRAST |
| .dll Windows library | A Portable Executable that other programs load rather than one you run.Defined by PE Format (Microsoft). | SPECIMEN, VOUCH |
| .efi UEFI program | A Portable Executable that the firmware runs before the operating system starts, such as a boot loader.Defined by UEFI Specification. | VOUCH |
| .exe Windows program | A Portable Executable: headers, code, and often an Authenticode signature saying who published it.Defined by PE Format (Microsoft).Guide: Checking a PDF before you open it | SPECIMEN, VOUCH |
| .js JavaScript | Source code a browser or Node.js runs, as text.Defined by ECMA-262. | UNSEEN |
| .less Less stylesheet | CSS with variables and nesting, turned into CSS before it is used.Defined by Less documentation. | CONTRAST |
| .mui Windows language resources | A Portable Executable holding one language's text and resources for another program.Defined by PE Format (Microsoft). | VOUCH |
| .ocx ActiveX control | A Windows library that registers itself as a control other programs can host.Defined by PE Format (Microsoft). | SPECIMEN, VOUCH |
| .py Python | Python source code, as text.Defined by The Python Language Reference. | UNSEEN |
| .scr Windows screen saver | An ordinary Windows program with a different extension, which is why it turns up in phishing.Defined by PE Format (Microsoft). | SPECIMEN, VOUCH |
| .scss Sass stylesheet | CSS with variables, nesting and functions, turned into CSS before it is used.Defined by Sass documentation. | CONTRAST |
| .sys Windows driver | A Portable Executable loaded into the Windows kernel.Defined by PE Format (Microsoft). | SPECIMEN, VOUCH |
| .xapk Android app package (unofficial) | A zip of an APK and its extra data, made by some download sites. Not a Google format. | MANIFEST |
| .xpi Firefox add-on | A signed zip holding the add-on's manifest.json and code.Defined by Mozilla extension documentation.Guide: What a browser extension can do | MANIFEST |
| .zip Zip archive | Files compressed into one, each listed in a central directory at the end with its name and time. A password on a zip usually hides the contents but not the file names.Defined by PKWARE APPNOTE.TXT.Guide: Password protecting a zip | Notes, DOSSIER, MANIFEST, Obscura Photo Editor, PACK, POSTBAG, STRONGBOX, TAKEOUT, VITALS |
Keys, certificates and signatures (18)
The files that prove who made something, or that it has not changed.
| Extension | What it is | Opened by |
|---|---|---|
| .asc ASCII-armoured OpenPGP | An OpenPGP key, signature or message written as text between BEGIN and END lines, so it survives email.Defined by RFC 9580.Guide: Checking a file has not been changed | SIGIL |
| .cer Certificate | An X.509 certificate, binary (DER) or text (PEM). Windows' name for one.Defined by RFC 5280. | CERTLENS |
| .crt Certificate | An X.509 certificate, usually PEM text.Defined by RFC 5280 and RFC 7468. | CERTLENS |
| .csr Certificate signing request | What you send a certificate authority: your public key and the names you want on the certificate.Defined by RFC 2986 (PKCS #10). | CERTLENS |
| .der Certificate (DER) | An X.509 certificate in its binary encoding.Defined by RFC 5280; ITU-T X.690. | CERTLENS |
| .gpg OpenPGP (binary) | An OpenPGP key, signature or encrypted file in binary, as GnuPG writes it.Defined by RFC 9580. | SIGIL |
| .key Key file | Taken here as an OpenPGP public key. The extension is used for many kinds of key, and for Keynote presentations too.Defined by RFC 9580. | SIGIL |
| .minisig Minisign signature | A small Ed25519 signature from minisign, with a comment line that is signed too.Defined by Minisign documentation (Frank Denis). | SIGIL |
| .p7b Certificate bundle (PKCS #7) | Certificates, usually a chain, packed into a signed-data structure with no signature.Defined by RFC 5652 and RFC 2315. | CERTLENS |
| .p7c Certificates only (PKCS #7) | The S/MIME name for a certs-only PKCS #7 file.Defined by RFC 8551. | CERTLENS, SIGNET |
| .p7m S/MIME signed or encrypted file | A file wrapped in a CMS signature or envelope, with the original inside.Defined by RFC 5652 and RFC 8551.Guide: The smime.p7s attachment | SIGNET |
| .p7s S/MIME signature | The signature part of a signed email (smime.p7s): the sender's certificate and a signature over the message.Defined by RFC 5652 and RFC 8551.Guide: The smime.p7s attachment | SIGNET |
| .pem PEM file | Base64 between BEGIN and END lines: a certificate, a chain of them, or a key. The line names which.Defined by RFC 7468.Guide: The smime.p7s attachment | CERTLENS, SIGNET |
| .pgp OpenPGP (binary) | The same as .gpg, under the older PGP name.Defined by RFC 9580. | SIGIL |
| .pub Public key | An SSH public key, one line of type, key and comment, as in id_ed25519.pub; or an OpenPGP public key.Defined by RFC 4253 and RFC 4716 (SSH); RFC 9580 (OpenPGP).Guide: SSH key fingerprints | KEYPRINT, SIGIL |
| .sig Detached signature | A signature kept beside the file it signs: OpenPGP, or signify and minisign under the same name.Defined by RFC 9580.Guide: Checking a file has not been changed | SIGIL |
| .sign Detached signature | Another name for a detached signature file.Defined by RFC 9580. | SIGIL |
| .signature Detached signature | Another name for a detached signature file.Defined by RFC 9580. | SIGIL |
Fonts (5)
Font files, which carry a licence and the names of who made them.
| Extension | What it is | Opened by |
|---|---|---|
| .otf OpenType font | An OpenType font, usually with PostScript (CFF) outlines.Defined by ISO/IEC 14496-22 (Open Font Format). | FONTLENS |
| .ttc TrueType collection | Several fonts in one file, sharing their glyphs.Defined by ISO/IEC 14496-22 (Open Font Format). | FONTLENS |
| .ttf TrueType font | An OpenType font with TrueType outlines. Its name table holds the designer, the maker, and the licence text.Defined by ISO/IEC 14496-22 (Open Font Format). | FONTLENS |
| .woff Web font | A TrueType or OpenType font compressed for the web, with room for the maker's metadata.Defined by WOFF 1.0 (W3C). | FONTLENS |
| .woff2 Web font | WOFF with Brotli compression and some tables transformed first, so it comes out smaller than WOFF.Defined by WOFF 2.0 (W3C). | FONTLENS |
Files this site writes (5)
The site's own formats, for keeping work and reopening it in the same tool.
| Extension | What it is | Opened by |
|---|---|---|
| .obphoto Photo Editor project | A Photo Editor project with its layers, to be opened again in the Photo Editor. | Obscura Photo Editor |
| .obscura TOKEN backup | TOKEN's encrypted export of your two-step login codes: AES-256-GCM, with the key made from your passphrase by PBKDF2. | TOKEN |
| .obscura-journal JOURNAL export | A JOURNAL, exported from this browser to be opened again in JOURNAL. | JOURNAL |
| .obscura-money MONEY file | A MONEY set of accounts, saved to be opened again in MONEY. | MONEY |
| .pivot PIVOT map | A PIVOT attack model, written as text. | PIVOT |