The BMP file (.bmp)

A BMP file stores a picture as a grid of pixels, almost always without compression. Microsoft and IBM designed it in the 1980s for Windows and OS/2, so that a program could load an image straight into memory and draw it on screen with very little processing. The file layout is the in-memory layout Windows uses for a device-independent bitmap (DIB), with a small file header in front.

That simplicity is both BMP's strength and its weakness. Any program can read and write it with a few dozen lines of code, and decoding is close to free. But the files are big: our 640 × 400 sample-24bit.bmp is 768,054 bytes, while the same picture is 458,129 bytes as PNG (lossless) and 41,904 bytes as a quality-85 JPEG.

Where you still meet BMP:

• Inside Windows: the clipboard passes images as DIBs, and icons (.ico) and cursors (.cur) store their images as BMP-style bitmaps (or PNGs) without the file header.
• Embedded devices and hobby electronics: small screens, printers and microcontrollers often read BMP because it needs no decompression library.
• Older software and test pipelines: scientific instruments, image-processing tutorials and legacy business apps.

It's a poor choice for the web or for sending images to people, even though every browser shows it: PNG is lossless too and usually much smaller.

Three rules explain most BMP bugs:

1. 1Rows are stored bottom-up. With a positive height, the first row in the file is the bottom row of the picture. A negative height means top-down, the order almost every other format uses. Compressed BMPs must be bottom-up.
2. 2Every row is padded to a multiple of 4 bytes. A 24-bit image 301 pixels wide has 903 bytes of pixels per row, so each row gets 1 byte of padding, making 904. A reader that forgets the padding draws a picture that slants diagonally.
3. 3Colours are in blue, green, red order, and 32-bit pixels are blue, green, red, then an unused byte or alpha. Read them as RGB and red and blue swap.

The size of a row (the stride) is the row's bits rounded up to a whole number of 32-bit words:

// bytes per row, padding included
const stride = Math.floor((width * bitsPerPixel + 31) / 32) * 4;
const pixelDataSize = stride * Math.abs(height);

Images with 1, 4 or 8 bits per pixel have a colour table (palette) between the header and the pixels: up to 2, 16 or 256 entries of 4 bytes (blue, green, red, zero). The pixels are then palette numbers, packed several to a byte at 1 and 4 bits.

BMP has no version number. Instead, the information header grew as Windows did, and a reader tells the versions apart by the header's size, the first 4 bytes after the file header. Each Windows version adds fields to the end of the previous one.

Many programs write the 40-byte header for ordinary images and a V4 or V5 header when they need alpha or colour management. Our sample-32bit-alpha.bmp uses a V5 header with an alpha mask and the sRGB colour space.

The compression field (offset 30) is usually BI_RGB (0): none. The other values:

• BI_RLE8 (1) and BI_RLE4 (2): run-length encoding for 8- and 4-bit images. Runs of one colour are stored as a count and a palette index. Our sample-rle8.bmp, a flat-colour chart, is 11,948 bytes; uncompressed, the same 640 × 400 image would take 257,078 bytes. On photos, RLE barely helps.
• BI_BITFIELDS (3): not compression but a description of the pixel layout, with bit masks saying where red, green, blue (and in V4 and V5 headers, alpha) sit in each 16- or 32-bit pixel.
• BI_JPEG (4) and BI_PNG (5): a JPEG or PNG image in place of the pixels. Windows only accepts these when sending images to a printer, so you won't meet them in files.

Converting a BMP to PNG loses nothing and almost always makes the file smaller; for flat graphics like sample-rle8.bmp the PNG is 2,093 bytes. The one advantage BMP keeps is that it needs no decompression, which matters on tiny devices, not on computers or phones.

• The image is upside down. A reader ignored the sign of the height: it read a top-down file as bottom-up, or the other way round. Test with sample-top-down.bmp, whose arrow must point up.
• The image slants or is striped diagonally. The reader didn't skip the row padding. It only shows when the width times the bytes per pixel isn't a multiple of 4, which is why sample-top-down.bmp is 301 pixels wide.
• Red and blue are swapped. The pixels were read as RGB instead of BGR.
• The transparent areas are black or white. Many programs treat the fourth byte of a 32-bit pixel as unused, especially with the 40-byte header. A V4 or V5 header with an alpha mask is the most widely understood way to store alpha, and support is still uneven. For transparency, use PNG.
• 16-bit colours look green or purple. 555 and 565 layouts were mixed up; the bit masks say which one the file uses.
• The file is huge. It's uncompressed. Convert to PNG for an exact copy at a fraction of the size.

• Open it: double-click. Windows Photos and Paint, macOS Preview, Linux image viewers and every browser show BMPs.
• Edit it: Paint, GIMP, Photoshop, Paint.NET or any image editor. Paint's Save as > BMP offers monochrome, 16-colour, 256-colour and 24-bit; GIMP's export dialog offers RLE and 16, 24 and 32-bit layouts.
• Convert to PNG or JPG: File > Export in Preview, Save as in Paint, or magick image.bmp image.png with ImageMagick.
• Make a BMP for an old program: magick image.png BMP3:image.bmp writes the plain 40-byte header that old readers expect; for a device that needs 24-bit, add -type TrueColor.
• Inspect it: identify -verbose image.bmp (ImageMagick) shows the size, bit depth and compression, and file image.bmp the header version; the headers are short enough to read in any hex editor.

Yes, in general. A BMP has no scripts, macros or links, and RFC 7903, which registered image/bmp, describes bitmaps as having "a mostly unremarkable security history". Two cautions remain:

• Malformed headers. A file can claim dimensions, offsets or palette sizes that don't match its contents. Decoders that trust those numbers have had bugs; keep your software updated, and check dimensions before decoding uploaded files, since a small RLE file can declare a very large image.
• A BMP that isn't one. A file named image.bmp.exe is a program, not an image. Windows hides known extensions by default, so turn them on in File Explorer.

On privacy, BMP is unusually clean: there's no Exif, no GPS and no text field, so a BMP carries only its pixels, size, resolution and colour space.