PowerPoint presentation subheader (.ppt)
.ppt file signature | application/vnd.ms-powerpoint
PowerPoint presentation subheader identifies legacy Microsoft PowerPoint files based on the OLE Compound File format, created by Microsoft for its office document architecture. It is used for PowerPoint presentations and related Office 97–2003 documents stored in the older binary format. This format is obsolete in favor of Office Open XML, and files from untrusted sources should still be handled cautiously because legacy Office documents can contain macros or embedded objects.
Magic Bytes
Offset 0
D0 CF 11 E0 A1 B1 1A E1
Sources: Apache Tika, Wikipedia, Gary Kessler
All Known Signatures
5 signature variants are documented for .ppt files across multiple sources.
| Hex Signature | Offset | Sources |
|---|---|---|
| D0 CF 11 E0 A1 B1 1A E1 | 0 | Apache Tika, Wikipedia, Gary Kessler |
| 00 6E 1E F0 | 512 | Gary Kessler |
| 0F 00 E8 03 | 512 | Gary Kessler |
| A0 46 1D F0 | 512 | Gary Kessler |
| FD FF FF FF 00 00 | 512 | Gary Kessler |
Extension
.ppt
MIME Type
application/vnd.ms-powerpoint
Byte Offset
0
Risk Level
Safe
Validation Code
How to validate .ppt files in Python
def is_ppt(file_path: str) -> bool:
"""Check if file is a valid PPT by magic bytes."""
signature = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])
with open(file_path, "rb") as f:
return f.read(8) == signatureHow to validate .ppt files in Node.js
function isPPT(buffer: Buffer): boolean {
const signature = Buffer.from([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);
return buffer.subarray(0, 8).equals(signature);
}How to validate .ppt files in Go
func IsPPT(data []byte) bool {
signature := []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}
if len(data) < 8 {
return false
}
return bytes.Equal(data[:8], signature)
}API Endpoint
/api/v1/ppt
curl https://filesignature.org/api/v1/ppt
See the full API documentation for all endpoints and parameters.
Related Formats
Frequently Asked Questions
What is a .ppt file?
A .ppt file is a PowerPoint presentation subheader file. PowerPoint presentation subheader identifies legacy Microsoft PowerPoint files based on the OLE Compound File format, created by Microsoft for its office document architecture. It is used for PowerPoint presentations and related Office 97–2003 documents stored in the older binary format. This format is obsolete in favor of Office Open XML, and files from untrusted sources should still be handled cautiously because legacy Office documents can contain macros or embedded objects.
What are the magic bytes for .ppt files?
The magic bytes for PowerPoint presentation subheader files are D0 CF 11 E0 A1 B1 1A E1 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.
How do I validate a .ppt file?
To validate a .ppt file, read the first bytes of the file and compare them against the known magic bytes (D0 CF 11 E0 A1 B1 1A E1) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.
What is the MIME type for .ppt files?
The primary MIME type for .ppt files is application/vnd.ms-powerpoint.
Is it safe to open .ppt files?
PowerPoint presentation subheader (.ppt) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.