File extension
Also known as: filename extension, file type extension, file suffix
A file extension is the group of letters after the last dot in a file name, such as .docx for Word documents, .jpg for photos, .pdf for PDFs, and .exe for Windows programs.
Operating systems use extensions to decide which app opens a file and which icon to show. Windows hides common extensions by default, which scammers exploit by naming malware something like 'invoice.pdf.exe.' While extensions are a helpful label, they can be changed freely, so they don't guarantee what a file really contains.
File extension, explained at three levels
At home
A file extension is like the label on a jar in your pantry. It tells you, and your computer, what's inside and how to use it.
At work
Showing file extensions helps staff spot dangerous attachments disguised as harmless documents.
At home
In Windows File Explorer, choose View, then Show, then 'File name extensions' to see them. On a Mac, Finder settings has a similar option.
At work
Email filters often block risky extensions such as .exe, .js, .vbs, and .iso. Policies can show extensions on all managed PCs to improve phishing awareness.
At home
Renaming a file's extension doesn't convert it. In my opinion, use 'Save as' or a proper converter to change formats safely.
At work
Block or quarantine executable and script attachments, inspect file contents rather than trusting extensions, watch for double extensions and container formats like ISO or ZIP used to bypass filters, and set default apps for risky types to safe viewers.
Real-world examples
At home
Sophie received an email attachment called 'receipt.pdf.' After turning on file extensions, she saw it was really 'receipt.pdf.exe' and deleted it.
At work
Marcus's Calgary MSP enabled visible file extensions on every client PC and blocked executable attachments, reducing malware infections from email.
How it compares
| feature | Opens with | Risk |
|---|---|---|
| .docx / .xlsx | Word / Excel | Low, unless macros |
| PDF reader | Low to moderate | |
| .exe / .msi | Runs as a program | High from unknown senders |
| .zip / .iso | Archive or disk tool | Can hide risky files |
Program and container extensions deserve the most caution.
For analysts
In security awareness training, I'd show staff how to reveal file extensions. It's a five-second habit that defeats a very common phishing trick.
History & origin
Early operating systems such as CP/M in the 1970s and MS-DOS in 1981 used '8.3' file names: up to eight characters, a dot, and a three-letter extension, which is why many extensions are three letters long. Windows 95 introduced long file names and began hiding known extensions by default to simplify things for users. Classic Mac OS used hidden type and creator codes instead of extensions, while Mac OS X adopted extensions in 2001. Microsoft Office's 2007 release introduced four-letter extensions such as .docx and .xlsx for its new XML-based formats. In my view, turning on file extensions in Windows is one of the simplest anti-scam settings anyone can change.