The basics
What is an EOT file?
An EOT file is a web font for Internet Explorer. Microsoft introduced Embedded OpenType with Internet Explorer 4 in 1997, years before other browsers could load fonts from the web, and it was the only format IE accepted until Internet Explorer 9 added WOFF support in 2011.
Inside is a regular TrueType or OpenType font, often cut down to the characters a site needed and compressed. In front of it sits a header with the font's names and properties and, optionally, a list of web addresses allowed to use it. That list was the point of the format: font makers were wary of putting fonts online at all, and EOT promised that a font embedded in one site couldn't simply be reused on another.
No current browser reads EOT, and Microsoft retired Internet Explorer: support for the desktop app ended on most versions of Windows in June 2022. You'll still find .eot files in older websites, WordPress themes, icon font kits and font download packages, usually next to WOFF, TTF and SVG versions of the same font.
Anatomy
What's inside an EOT file
An EOT file is a header describing the font, followed by the font itself. Below is our sample-regular.eot. Unlike TTF and WOFF, the header is little-endian: the low byte comes first, so 20 2E 00 00 is 0x2E20, which is 11,808.
offset bytes meaning
000000 20 2E 00 00 EOTSize: 11,808 bytes
000004 44 2D 00 00 FontDataSize: 11,588 bytes
000008 01 00 02 00 Version 0x00020001
00000C 00 00 00 00 Flags: not compressed, not XOR-ed
000010 02 0B 05 03 00 00 00 00 00 00 PANOSE classification
00001A 01 Charset: default
00001B 00 Italic: no
00001C 90 01 00 00 Weight: 400
000020 00 00 fsType: installable embedding
000022 4C 50 MagicNumber 0x504C
000024 03 00 00 00 … (24 bytes) Unicode and code page ranges
00003C E4 4F 4F 71 CheckSumAdjustment, from head
000040 00 00 00 00 … (16 bytes) Reserved
000050 00 00 20 00 padding, FamilyNameSize: 32
000054 39 00 39 00 68 00 65 00 … "99helpers Sample" (UTF-16)
000074 00 00 0E 00 52 00 65 00 … StyleName "Regular"
000086 00 00 1A 00 56 00 65 00 … VersionName "Version 1.000"
0000A4 00 00 30 00 39 00 39 00 … FullName "99helpers Sample Regular"
0000D8 00 00 00 00 padding, RootStringSize: 0
0000DC 00 01 00 00 00 0A 00 80 … FontData: a complete TTF
002E20 end of file: 11,808 bytes- 1
20 2E 00 00The total size
The whole file: header, names and font data. Because the file starts with its own length rather than a fixed signature, EOT files have no recognisable first bytes.
- 2
44 2D 00 00The font data size
How long the embedded font is: 11,588 bytes, exactly the size of our
sample-regular.ttf. - 3
01 00 02 00The version
0x00020001 (read backwards, as little-endian). Version 0x00010000 had no root string; 0x00020001 added it; 0x00020002 added a signature and support for end-user-defined characters (EUDC).
- 4
00 00 00 00The flags
Bits for a subset font (0x1), MicroType Express compression (0x4) and XOR obfuscation (0x10000000). All off in our samples, so the font data is readable as is.
- 5
02 0B 05 03 … / 90 01 00 00 / 00 00Copied font details
PANOSE classification, charset, italic flag, weight (0x190 = 400) and the
fsTypeembedding permissions, copied from the font'sOS/2table so a browser could check them without unpacking the font. - 6
4C 50The magic number
0x504C, stored little-endian as the bytes
4C 50(ASCIILP) at offset 34. It's a corruption check, and the most reliable way to recognise an EOT file. The Unixfilecommand looks for it. - 7
00 00 20 00 39 00 39 00 …The names
Family, style, version and full name, each as a 2-byte padding field, a 2-byte length and UTF-16 text.
- 8
00 00 00 00The root string
A list of web addresses allowed to use the font. Empty here, so any site may;
sample-root-string.eotcarrieshttps://99helpers.com/. - 9
00 01 00 00 00 0A 00 80 …The font data
An ordinary TrueType font, starting with its own
00 01 00 00signature. In most EOT files made for real sites, this part is MicroType Express-compressed and unreadable without decoding.
Under the hood
How an EOT file works
The layout is described in Microsoft's 2008 W3C Member Submission. Four features set EOT apart from a plain font file:
- Subsetting. Microsoft's WEFT tool scanned a site's pages and kept only the characters they used, which made files small and the fonts less useful to anyone who copied them. Flag 0x1 marks a subset font.
- MicroType Express compression. A compression scheme for fonts developed by Agfa Monotype, which understands glyph outlines rather than treating them as generic bytes. Flag 0x4 marks it. The specification noted that Monotype held patents on it, one reason other browsers didn't adopt EOT.
- XOR obfuscation. With flag 0x10000000 set, every byte of the font data is XOR-ed with 0x50. It keeps the font from being recognised at a glance, nothing more: undoing it is one line of code.
- Root strings. One or more full URLs, in UTF-16 and separated by null characters. Internet Explorer compared them with the address of the page using the font, and refused the font on other sites.
Why the protection didn't hold
None of these features stop a determined copier: anyone can decompress the data, undo the XOR and remove the root string. They worked as a statement of intent, much like the licence field in a WOFF file. That, plus patent concerns and the fact that EOT was tied to one browser, is why the W3C standardised WOFF instead.
Related formats
EOT vs WOFF2, WOFF and TTF
| EOT | WOFF / WOFF2 | TTF / OTF | |
|---|---|---|---|
| Made for | Internet Explorer | Every browser | Installing on computers |
| Status | Obsolete | W3C Recommendations (2012, 2018) | OpenType specification, ISO/IEC 14496-22 |
| Compression | Optional MicroType Express | zlib / Brotli | None |
| Site restriction | Root strings | None; CORS controls cross-site loading | None |
| Byte order of header | Little-endian | Big-endian | Big-endian |
| Signature | None at offset 0; 4C 50 at offset 34 | wOFF / wOF2 | 00 01 00 00 / OTTO |
| MIME type | application/vnd.ms-fontobject | font/woff, font/woff2 | font/ttf, font/otf |
On the web, cross-site use of fonts is now controlled by CORS: browsers fetch fonts in CORS mode, so a font server decides which sites may load its fonts with the Access-Control-Allow-Origin header. That does on the server what root strings tried to do inside the file.
Legacy code
The ?#iefix trick and other old @font-face code
If a stylesheet mentions .eot, it probably uses the bulletproof @font-face syntax that font services and generators produced around 2010. Its strange ?#iefix is a workaround: Internet Explorer 6 to 8 couldn't parse a src list with several fonts and format() hints, and requested the whole rest of the line as one URL. The question mark turned that rest into a query string, so the server still returned the EOT file.
/* The "bulletproof" syntax from around 2010. Only the first
two lines were ever for EOT; current browsers skip them. */
@font-face {
font-family: "Example";
src: url("example.eot"); /* IE 9 in compatibility modes */
src: url("example.eot?#iefix") format("embedded-opentype"), /* IE 6 to 8 */
url("example.woff2") format("woff2"),
url("example.woff") format("woff");
}
/* What the same rule needs today */
@font-face {
font-family: "Example";
src: url("example.woff2") format("woff2");
}- Removing the EOT lines is safe for any site that doesn't support Internet Explorer. Current browsers ignore
format("embedded-opentype")sources and don't download them. - Delete the
.eotfiles once nothing refers to them, together with any SVG font files (format("svg")) from the same era, a deprecated format mainly needed for early iPhones. - Keep the WOFF2 file, and WOFF only if you still support browsers from before about 2016.
How to
How to open and convert an EOT file
No current browser or operating system opens EOT files, so to use or inspect the font, convert it back to TTF and then to WOFF2 for the web:
- Uncompressed EOT (like our samples): the font is the last
FontDataSizebytes of the file. Cut it out and you have a working TTF, as below. - Compressed or obfuscated EOT: use libeot's
eot2ttf, which understands MicroType Express and the XOR step, or an online font converter. - Making new EOT files is only worth it for testing or for a site that must support old Internet Explorer;
ttf2eotwrites uncompressed EOT files from a TTF. - Better: get the original. EOT files from web font kits are usually subsets. The foundry's TTF, OTF or WOFF2 will have more characters and features.
# FontData sits at the end of an uncompressed EOT file,
# and FontDataSize (offset 4) says how long it is:
tail -c 11588 sample-regular.eot > extracted.ttf
ttx -l extracted.ttfCheck the licence before converting an EOT you found on a website. A web licence for a font rarely allows desktop installation, and a font extracted from someone else's site is still their licensed copy.
Rights and risks
Licences and security
EOT was built around font licensing. The header copies the font's fsType embedding permissions from its OS/2 table, the root string ties the font to named sites, and Internet Explorer installed EOT fonts privately, so other programs and other sites couldn't use them. None of this changes what the licence allows: a font extracted from an EOT file is still covered by the licence it was sold under.
Like every font format, EOT has had parser bugs. In July 2009, Microsoft's bulletin MS09-029 fixed flaws in the Windows Embedded OpenType Font Engine (T2EMBED.DLL) that let a crafted font run code (CVE-2009-0231), and further fixes for the same engine followed. Since no current browser loads EOT from web pages, that risk now applies mainly to old, unpatched systems.
Treat an .eot file from an unknown source like any other untrusted binary. Converting it with a maintained tool on an up-to-date system is safe; opening it in an old, unpatched Internet Explorer is not.
Free downloads
Sample EOT files to download
Free sample EOT files for testing legacy font pipelines, converters, format detection and upload filters. They're uncompressed Embedded OpenType (version 0x00020001, no MicroType Express, no XOR) wrapping 99helpers Sample, an original geometric typeface we drew for these pages. Browsers can't preview EOT, so there's no live specimen; the same font is shown on the TTF page.
Browsers can't show this kind of file in a page. Download it to open it in the app it belongs to.
What's inside sample-regular.eot
We wrote the header byte by byte following the W3C submission, then read it back with a separate parser to check every field.
Sizes
EOTSize 11,808 and FontDataSize 11,588, little-endian, at offsets 0 and 4.
Version and flags
Version 0x00020001, flags 0: not subset, not compressed, not XOR-ed.
Font properties
PANOSE
02 0B 05 03 …(sans serif, medium weight), weight 400,fsType0 and the Unicode ranges, all copied from the font'sOS/2table.Magic number
4C 50at offset 34, which is how tools such asfilerecognise the format.Names
"99helpers Sample", "Regular", "Version 1.000" and "99helpers Sample Regular" in UTF-16, then an empty root string.
Font data
A complete TrueType font from offset 0xDC to the end, with the licence and a link back to this page in its
nametable.
All sample EOT files
Regular weight, uncompressed
sample-regular.eot · 11.5 KB (11,808 bytes)
99helpers Sample Regular as EOT version 0x00020001, no compression, no XOR, no root string. The embedded TTF can be cut out with
tail.- Testing EOT parsers and converters
- Checking format detection by the `4C 50` magic number
Bold weight, uncompressed
sample-bold.eot · 11.3 KB (11,576 bytes)
The same family at weight 700: the header's Weight field is 700 (
BC 02 00 00) and the PANOSE weight byte is 8.- Testing that converters keep weight and style
- Legacy `@font-face` set-ups with two weights
EOT with a root string
sample-root-string.eot · 11.6 KB (11,854 bytes)
The regular font with a root string of
https://99helpers.com/(46 bytes of UTF-16 including the closing null), which in Internet Explorer limited the font to pages on that site.- Testing parsers that read or strip root strings
- Seeing how the header grows with a root string
Ways to test with them
- Format detection: EOT has no signature at offset 0. A detector should check for
4C 50at offset 34, and that the first four bytes equal the file size. - Converters: convert
sample-regular.eotto TTF and compare withttx -l; you should get the ten tables of the TTF sample. - Extraction:
tail -c 11588 sample-regular.eotgives a valid TTF, because the font data is stored uncompressed at the end. - Browsers: load
sample-regular.eotwith@font-faceor the FontFace API in a current browser: it is rejected (Chromium reports invalid font data), which confirms nothing still depends on it.
Free to use for testing, teaching and demos, commercially or not, with no attribution needed. A link back to this page is always appreciated.
Put it online
Have an EOT file? Give it a link.
Drop an EOT file on 99helpers and it gets its own address in seconds. Opening the link downloads the file, since browsers don't display font files on their own; a page you host on 99helpers can still reference it with @font-face for old Internet Explorer.
Questions
EOT files, frequently asked
What is an EOT file?
An Embedded OpenType font: Internet Explorer's web font format. It contains a TrueType or OpenType font behind a header, often compressed and restricted to particular websites.
How do I open an EOT file?
No current app or browser opens it directly. Convert it to TTF with a tool such as libeot's eot2ttf or an online converter, then install or inspect the TTF.
Do I still need EOT fonts on my website?
No. EOT was only needed for Internet Explorer 8 and earlier, and Microsoft no longer supports Internet Explorer. WOFF2 works in every current browser.
What does ?#iefix mean in @font-face?
A workaround for a parsing bug in Internet Explorer 6 to 8, which requested the whole src list as one URL. The question mark made the rest a harmless query string.
Can I convert EOT to WOFF2?
Yes: convert it to TTF first, then to WOFF2 with fontTools or woff2_compress. If you can, start from the original font instead, as EOT files are often subsets.
What is the MIME type of an EOT file?
application/vnd.ms-fontobject. RFC 8081, which created the font/ media types, doesn't cover EOT.
Does EOT protect fonts from copying?
Not really. Its root strings, XOR step and compression make copying less convenient, but they can all be undone. The licence is what protects a font.
Related formats
Other file types explained
Keep going
Related
Sources
- W3C Member Submission: Embedded OpenType (EOT) File Format
- Microsoft: About font embedding (Internet Explorer)
- Wikipedia: Embedded OpenType
- MDN: @font-face src
- W3C: WOFF File Format 1.0
- CVE-2009-0231: Embedded OpenType Font Engine (MS09-029)
Last reviewed 27 October 2026.