{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/xlsx",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "xlsx",
    "extension": ".xlsx",
    "aliases": [],
    "name": "Office Open XML Workbook (Excel)",
    "shortName": "XLSX",
    "category": "devtools-security",
    "tier": 1,
    "summary": "ZIP-packaged XML spreadsheet container (`[Content_Types].xml` + `xl/workbook.xml`). Frequently misdiagnosed when backend export endpoints fail and save HTML/JSON error pages as `.xlsx`.",
    "technicalNotes": "Shares `50 4B 03 04` with all ZIP files; true validation requires confirming `xl/workbook.xml` in the Central Directory (and rejecting legacy OLE2 `D0 CF 11 E0` `.xls` or HTML `3C 21 44 4F`).",
    "mimeTypes": [
      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
    ],
    "identifiers": {
      "pronomPuid": "fmt/214",
      "specUrl": "https://ecma-international.org/publications-and-standards/standards/ecma-376/"
    },
    "binarySignature": {
      "endianness": "little",
      "magicBytes": [
        {
          "offset": 0,
          "hex": "50 4B 03 04",
          "ascii": "PK..",
          "description": "PKZIP container verified via xl/workbook.xml entry"
        }
      ],
      "containerFamily": "zip",
      "headerLayout": [
        {
          "offset": "0x00 - 0x03",
          "byteOffset": 0,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32_le",
          "fieldName": "zip_sig",
          "description": "0x04034B50 PKZIP Local File Header"
        },
        {
          "offset": "0x1E+",
          "byteOffset": 30,
          "byteLength": 19,
          "lengthLabel": "var",
          "dataType": "utf8",
          "fieldName": "content_types",
          "description": "Typically '[Content_Types].xml'"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "medium",
      "allowsArbitraryCodeOrMacros": false,
      "xxeRisk": true,
      "polyglotPrependRisk": true,
      "pickleDeserializationRisk": false,
      "uploadValidationNotes": "Disable XML DTD / external entity resolution (XXE) in server-side XLSX parsers, enforce Zip Bomb decompression limits, and reject `xl/vbaProject.bin` macro blobs."
    },
    "codeSnippets": {
      "python": "import sys, zipfile\nwith zipfile.ZipFile(sys.argv[1], \"r\") as zf:\n    names = set(zf.namelist())\n    assert \"xl/workbook.xml\" in names, \"Missing xl/workbook.xml\"\n    print(f\"Valid OOXML .xlsx ({len(names)} parts)\")",
      "typescript": "export async function hasZipMagic(file: File) {\n  const dv = new DataView(await file.slice(0, 4).arrayBuffer());\n  return dv.getUint32(0, true) === 0x04034b50;\n}",
      "rust": "use std::{fs::File, io::Read};\nfn main() -> std::io::Result<()> {\n    let mut b = [0u8; 4];\n    File::open(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?.read_exact(&mut b)?;\n    assert_eq!(&b, b\"PK\\x03\\x04\");\n    println!(\"XLSX ZIP magic verified\");\n    Ok(())\n}",
      "go": "package main\nimport (\"archive/zip\"; \"fmt\"; \"os\")\nfunc main() {\n    r, err := zip.OpenReader(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"open zip:\", err)\n        os.Exit(1)\n    }\n    defer r.Close()\n    fmt.Printf(\"XLSX parts: %d\\n\", len(r.File))\n}"
    },
    "relatedFormats": [
      "csv",
      "parquet",
      "pdf"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "xlsx-minimal",
      "filename": "minimal-sheet.xlsx",
      "variant": "minimal",
      "title": "Minimal Valid OOXML Workbook (.xlsx)",
      "description": "Real single-cell workbook written by openpyxl with Content_Types, rels, workbook.xml and sheet1.xml.",
      "localPath": "/fixtures/v1/xlsx/minimal-sheet.xlsx",
      "cdnUrl": "https://fileformat.co/fixtures/v1/xlsx/minimal-sheet.xlsx",
      "sizeBytes": 4843,
      "sha256": "872a54723dd14451428342c5f097a0c3c7d5097a7d7fb28a86905e0df685a9f7",
      "expectValid": true
    },
    {
      "id": "xlsx-realistic",
      "filename": "quarterly-revenue.xlsx",
      "variant": "realistic",
      "title": "Financial Metrics OOXML Spreadsheet",
      "description": "Real openpyxl workbook: 4 quarterly revenue rows with USD floats for tabular import tests.",
      "localPath": "/fixtures/v1/xlsx/quarterly-revenue.xlsx",
      "cdnUrl": "https://fileformat.co/fixtures/v1/xlsx/quarterly-revenue.xlsx",
      "sizeBytes": 5037,
      "sha256": "d5ab69cbec81720b5a6399b0d77de88308017bad09e0b3919b15c0e4cf8afe3e",
      "expectValid": true
    },
    {
      "id": "xlsx-edge-case",
      "filename": "spoofed-gateway-error.xlsx",
      "variant": "edge-case",
      "title": "Spoofed HTML 502 Error Saved as `.xlsx`",
      "description": "Real-world debugging classic: filename ends .xlsx but bytes are an HTML gateway error page — openpyxl must raise.",
      "localPath": "/fixtures/v1/xlsx/spoofed-gateway-error.xlsx",
      "cdnUrl": "https://fileformat.co/fixtures/v1/xlsx/spoofed-gateway-error.xlsx",
      "sizeBytes": 203,
      "sha256": "22cceb2a5564d2877e94960a59b434289c9f4aa0c56e346c0aa9ce8bf361cceb",
      "expectValid": false,
      "edgeCaseTag": "HTML Spoofed as .xlsx"
    }
  ]
}