An Object Linking and Embedding (.xls)
.xls file signature | application/vnd.ms-excel
An Object Linking and Embedding (OLE) Compound File (CF) (i.e.,OLECF)file format, known asCompound Binary File formatby Microsoft, used byMicrosoft Office 97-2003 applications (Word, Powerpoint, Excel, Wizard). Part ofMicrosoft'sStructured Storage (MSS)architecture for Component Object Model (COM)-basedoperating systems.[See also Excel, Outlook, PowerPoint, and Word "subheaders" at byte offset 512 (0x200).]There appear to several subheader formats and a dearth of documentation.There have been re
Magic Bytes
Offset 0
D0 CF 11 E0 A1 B1 1A E1
Sources: Apache Tika, Wikipedia, Gary Kessler
All Known Signatures
11 signature variants are documented for .xls files across multiple sources.
| Hex Signature | Offset | Sources |
|---|---|---|
| D0 CF 11 E0 A1 B1 1A E1 | 0 | Apache Tika, Wikipedia, Gary Kessler |
| 4D 69 63 72 6F 73 6F 66 74 20 45 78 63 65 6C 20 35 2E 30 20 57 6F 72 6B 73 68 65 65 74 | 2080 | Apache Tika |
| 46 6F 67 6C 69 6F 20 64 69 20 6C 61 76 6F 72 6F 20 4D 69 63 72 6F 73 6F 66 74 20 45 78 63 65 | 2080 | Apache Tika |
| 42 69 66 66 35 | 2114 | Apache Tika |
| 42 69 66 66 35 | 2121 | Apache Tika |
| 08 00 45 | 0 | Gary Kessler |
| 51 20 BE FF E0 08 10 00 00 06 05 00 | 0 | Gary Kessler |
| CF FA ED FE | 0 | Gary Kessler |
| 51 20 BE FF EF FF FF FF 00 | 0 | Gary Kessler |
| 51 20 BE FF EF FF FF FF 02 | 0 | Gary Kessler |
| 51 20 BE FF EF FF FF FF 20 00 00 00 | 0 | Gary Kessler |
Extension
.xls
MIME Type
application/vnd.ms-excel
Byte Offset
0
Risk Level
Safe
Validation Code
How to validate .xls files in Python
def is_xls(file_path: str) -> bool:
"""Check if file is a valid XLS by magic bytes."""
signature = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])
with open(file_path, "rb") as f:
return f.read(8) == signatureHow to validate .xls files in Node.js
function isXLS(buffer: Buffer): boolean {
const signature = Buffer.from([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);
return buffer.subarray(0, 8).equals(signature);
}How to validate .xls files in Go
func IsXLS(data []byte) bool {
signature := []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}
if len(data) < 8 {
return false
}
return bytes.Equal(data[:8], signature)
}API Endpoint
/api/v1/xls
curl https://filesignature.org/api/v1/xls
See the full API documentation for all endpoints and parameters.
Frequently Asked Questions
What is a .xls file?
A .xls file is a An Object Linking and Embedding file. An Object Linking and Embedding (OLE) Compound File (CF) (i.e.,OLECF)file format, known asCompound Binary File formatby Microsoft, used byMicrosoft Office 97-2003 applications (Word, Powerpoint, Excel, Wizard). Part ofMicrosoft'sStructured Storage (MSS)architecture for Component Object Model (COM)-basedoperating systems.[See also Excel, Outlook, PowerPoint, and Word "subheaders" at byte offset 512 (0x200).]There appear to several subheader formats and a dearth of documentation.There have been re
What are the magic bytes for .xls files?
The magic bytes for An Object Linking and Embedding files are D0 CF 11 E0 A1 B1 1A E1 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.
How do I validate a .xls file?
To validate a .xls file, read the first bytes of the file and compare them against the known magic bytes (D0 CF 11 E0 A1 B1 1A E1) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.
What is the MIME type for .xls files?
The primary MIME type for .xls files is application/vnd.ms-excel.
Is it safe to open .xls files?
An Object Linking and Embedding (.xls) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.