File extension
Also known as: filename extension, file type extension, file suffix
A file extension is the group of letters after the last dot in a file name, such as .docx for Word documents, .jpg for photos, .pdf for PDFs, and .exe for Windows programs.
Operating systems use extensions to decide which app opens a file and which icon to show. Windows hides common extensions by default, which scammers exploit by naming malware something like 'invoice.pdf.exe.' While extensions are a helpful label, they can be changed freely, so they don't guarantee what a file really contains.
File extension, explained at three levels
At home
A file extension is like the label on a jar in your pantry. The contents don't announce themselves, but a label saying jam tells you what's inside and that it goes with toast. The letters after the dot, such as .jpg or .docx, tell your computer what kind of file it is and which app should open it. Swap the label, though, and the contents stay the same.
At work
A file extension is the short ending after the last dot in a file name, such as .docx, .pdf or .exe. Windows and macOS use it to choose which app opens the file. Businesses care because Windows hides extensions by default, so a malicious program named invoice.pdf.exe can look like a harmless PDF. Showing extensions helps staff spot disguised attachments.
At home
A file's contents are just a long string of bytes, and nothing about them tells the operating system which app should open them. The extension, the letters after the last dot, is a label that fills that gap. Windows and macOS keep a list matching each extension to a default app, so double-clicking report.docx opens Word. Windows hides known extensions by default, which is why a file called invoice.pdf.exe can display as 'invoice.pdf' while really being a program.
At work
Operating systems decide how to open files by extension, but the actual format is defined by the bytes inside, often starting with a signature called a magic number, such as %PDF for PDF files. Email filters and security tools block risky extensions, such as .exe, .js, .vbs, .hta and .iso, because opening them runs code. Showing extensions on all managed PCs through policy helps staff spot disguised files in phishing attachments.
At home
Renaming a file's extension changes the label, not the contents. Rename photo.heic to photo.jpg and the bytes inside are still in HEIC format, so some apps refuse to open it and others show an error. Converting a file means rewriting the data into the new format's structure, which is what 'Save as' or 'Export' does. In my view, use those or a proper converter to change formats safely, and keep the original.
At work
Block or quarantine executable and script attachments, and inspect file contents and signatures rather than trusting extensions, since attackers rename files freely. Watch for double extensions, right-to-left override characters that reverse displayed names, and container formats such as ISO, IMG, ZIP and password-protected archives used to bypass filters and Mark of the Web protections. Set default apps for risky script types, such as .js and .vbs, to Notepad so double-clicking does not execute them.
Real-world examples
At home
Sophie received an email attachment called 'receipt.pdf.' After turning on file extensions, she saw it was really 'receipt.pdf.exe' and deleted it.
At work
Marcus's Calgary MSP enabled visible file extensions on every client PC and blocked executable attachments, reducing malware infections from email.
How it compares
| feature | Opens with | Risk |
|---|---|---|
| .docx / .xlsx | Word / Excel | Low, unless macros |
| PDF reader | Low to moderate | |
| .exe / .msi | Runs as a program | High from unknown senders |
| .zip / .iso | Archive or disk tool | Can hide risky files |
Program and container extensions deserve the most caution.
For analysts
In security awareness training, I'd show staff how to reveal file extensions. It's a five-second habit that defeats a very common phishing trick.
History & origin
Early operating systems such as CP/M in the 1970s and MS-DOS in 1981 used '8.3' file names: up to eight characters, a dot, and a three-letter extension, which is why many extensions are three letters long. Windows 95 introduced long file names and began hiding known extensions by default to simplify things for users. Classic Mac OS used hidden type and creator codes instead of extensions, while Mac OS X adopted extensions in 2001. Microsoft Office's 2007 release introduced four-letter extensions such as .docx and .xlsx for its new XML-based formats. In my view, turning on file extensions in Windows is one of the simplest anti-scam settings anyone can change.