File Extension Reference: What Opens Every Common File Type

You have a file, you do not recognise the extension, and you want to know what it is and what will open it. This page is that lookup, organised by category and covering the formats you are realistically likely to meet — plus a clear list of the extensions that can execute code, which is the one distinction genuinely worth knowing.

Images

The raw formats deserve a note: every camera manufacturer uses its own, and they are not interchangeable. .cr3 is Canon, .nef is Nikon, .arw is Sony, .raf is Fujifilm, .orf is Olympus. .dng is Adobe's attempt at a universal raw format, and it is the one to convert to if you care about opening these files in twenty years.

Documents

Audio and video

Archives and disk images

Code and data

Fonts, 3D and design

Extensions that can run code

This is the section worth memorising. Everything in the tables above is data — it is inert until a program interprets it. Everything below is an instruction, and double-clicking it hands control to whoever wrote it.

The double extension trick

Windows hides extensions for known file types by default. A file genuinely named invoice.pdf.exe therefore displays as invoice.pdf — and if the attacker sets a PDF icon, it looks entirely convincing. Only the final extension determines what happens when you open it.

This trick is roughly twenty-five years old and still works, because the default setting that enables it has never changed. Turning extensions on takes ten seconds and is the single highest-value security setting on a Windows machine:

A related trick uses right-to-left override characters to make annexe.fdp.exe render as annexe.exe.pdf. Showing extensions does not defeat that one, which is why the more general rule matters: be suspicious of any attachment you did not ask for, regardless of how the name reads.

Identifying a file with no extension

Extensions get stripped by download managers, email gateways and careless file transfers. The data is intact — you just need to work out what it is. Every method below reads the file's actual signature rather than trusting its name.

Then match against the common signatures:

Formats that are secretly ZIP files

A surprising number of modern formats are ZIP archives with a specified internal layout. You can open any of them with an archiver and read the contents directly:

• .docx, .xlsx, .pptx — Office XML documents
• .odt, .ods, .odp — OpenDocument
• .epub — HTML, CSS and images plus a manifest
• .jar, .war — Java archives
• .apk, .aab — Android packages
• .xpi — Firefox extensions
• .3mf — 3D manufacturing format
• .sketch — Sketch documents (JSON inside)

This is genuinely useful for recovery. If Word declares a .docx corrupt, rename a copy to .zip, open it, and look in word/media/ — every image from the document is sitting there as an ordinary file, and word/document.xml holds the text.

Four rules that cover everything

1. The extension is a label. It tells the OS which program to open; it says nothing about the contents and changing it converts nothing.
2. The bytes tell the truth. When name and behaviour disagree, check the signature.
3. Only the last extension counts. report.pdf.exe is an executable.
4. Turn on extension display. Ten seconds of configuration that defeats a whole class of attack.

Frequently Asked Questions