File types · Explainer

The EOT file (.eot)

An EOT file is an Embedded OpenType font, the web font format of Internet Explorer: a TrueType or OpenType font with a header that ties it to a website. This guide explains what's inside one, why it's no longer needed, how to handle old ones, and has free sample EOT files to download for testing.

At a glance

Full name
Embedded OpenType
Extensions
.eot
MIME type
application/vnd.ms-fontobject
Kind
Binary; a little-endian header followed by a TrueType or OpenType font, optionally compressed and obfuscated
Owner
Microsoft; published as a W3C Member Submission in 2008, never a W3C standard
First released
1997, with Internet Explorer 4
Opens with
Internet Explorer only; small converters such as ttf2eot and libeot's eot2ttf
Compression
Optional MicroType Express (MTX), plus an optional XOR with the byte 0x50
Browser support
None today: Chrome, Firefox, Safari and Edge never supported it
Magic number
None at the start; bytes 4C 50 (MagicNumber 0x504C) at offset 34

The basics

What is an EOT file?

An EOT file is a web font for Internet Explorer. Microsoft introduced Embedded OpenType with Internet Explorer 4 in 1997, years before other browsers could load fonts from the web, and it was the only format IE accepted until Internet Explorer 9 added WOFF support in 2011.

Inside is a regular TrueType or OpenType font, often cut down to the characters a site needed and compressed. In front of it sits a header with the font's names and properties and, optionally, a list of web addresses allowed to use it. That list was the point of the format: font makers were wary of putting fonts online at all, and EOT promised that a font embedded in one site couldn't simply be reused on another.

No current browser reads EOT, and Microsoft retired Internet Explorer: support for the desktop app ended on most versions of Windows in June 2022. You'll still find .eot files in older websites, WordPress themes, icon font kits and font download packages, usually next to WOFF, TTF and SVG versions of the same font.

Anatomy

What's inside an EOT file

An EOT file is a header describing the font, followed by the font itself. Below is our sample-regular.eot. Unlike TTF and WOFF, the header is little-endian: the low byte comes first, so 20 2E 00 00 is 0x2E20, which is 11,808.

sample-regular.eot (hex)
offset  bytes                            meaning
000000  20 2E 00 00                      EOTSize: 11,808 bytes
000004  44 2D 00 00                      FontDataSize: 11,588 bytes
000008  01 00 02 00                      Version 0x00020001
00000C  00 00 00 00                      Flags: not compressed, not XOR-ed
000010  02 0B 05 03 00 00 00 00 00 00    PANOSE classification
00001A  01                               Charset: default
00001B  00                               Italic: no
00001C  90 01 00 00                      Weight: 400
000020  00 00                            fsType: installable embedding
000022  4C 50                            MagicNumber 0x504C
000024  03 00 00 00 … (24 bytes)         Unicode and code page ranges
00003C  E4 4F 4F 71                      CheckSumAdjustment, from head
000040  00 00 00 00 … (16 bytes)         Reserved
000050  00 00 20 00                      padding, FamilyNameSize: 32
000054  39 00 39 00 68 00 65 00 …        "99helpers Sample" (UTF-16)
000074  00 00 0E 00 52 00 65 00 …        StyleName "Regular"
000086  00 00 1A 00 56 00 65 00 …        VersionName "Version 1.000"
0000A4  00 00 30 00 39 00 39 00 …        FullName "99helpers Sample Regular"
0000D8  00 00 00 00                      padding, RootStringSize: 0
0000DC  00 01 00 00 00 0A 00 80 …        FontData: a complete TTF
002E20                                   end of file: 11,808 bytes
  1. 120 2E 00 00

    The total size

    The whole file: header, names and font data. Because the file starts with its own length rather than a fixed signature, EOT files have no recognisable first bytes.

  2. 244 2D 00 00

    The font data size

    How long the embedded font is: 11,588 bytes, exactly the size of our sample-regular.ttf.

  3. 301 00 02 00

    The version

    0x00020001 (read backwards, as little-endian). Version 0x00010000 had no root string; 0x00020001 added it; 0x00020002 added a signature and support for end-user-defined characters (EUDC).

  4. 400 00 00 00

    The flags

    Bits for a subset font (0x1), MicroType Express compression (0x4) and XOR obfuscation (0x10000000). All off in our samples, so the font data is readable as is.

  5. 502 0B 05 03 … / 90 01 00 00 / 00 00

    Copied font details

    PANOSE classification, charset, italic flag, weight (0x190 = 400) and the fsType embedding permissions, copied from the font's OS/2 table so a browser could check them without unpacking the font.

  6. 64C 50

    The magic number

    0x504C, stored little-endian as the bytes 4C 50 (ASCII LP) at offset 34. It's a corruption check, and the most reliable way to recognise an EOT file. The Unix file command looks for it.

  7. 700 00 20 00 39 00 39 00 …

    The names

    Family, style, version and full name, each as a 2-byte padding field, a 2-byte length and UTF-16 text.

  8. 800 00 00 00

    The root string

    A list of web addresses allowed to use the font. Empty here, so any site may; sample-root-string.eot carries https://99helpers.com/.

  9. 900 01 00 00 00 0A 00 80 …

    The font data

    An ordinary TrueType font, starting with its own 00 01 00 00 signature. In most EOT files made for real sites, this part is MicroType Express-compressed and unreadable without decoding.

Under the hood

How an EOT file works

The layout is described in Microsoft's 2008 W3C Member Submission. Four features set EOT apart from a plain font file:

  • Subsetting. Microsoft's WEFT tool scanned a site's pages and kept only the characters they used, which made files small and the fonts less useful to anyone who copied them. Flag 0x1 marks a subset font.
  • MicroType Express compression. A compression scheme for fonts developed by Agfa Monotype, which understands glyph outlines rather than treating them as generic bytes. Flag 0x4 marks it. The specification noted that Monotype held patents on it, one reason other browsers didn't adopt EOT.
  • XOR obfuscation. With flag 0x10000000 set, every byte of the font data is XOR-ed with 0x50. It keeps the font from being recognised at a glance, nothing more: undoing it is one line of code.
  • Root strings. One or more full URLs, in UTF-16 and separated by null characters. Internet Explorer compared them with the address of the page using the font, and refused the font on other sites.

Why the protection didn't hold

None of these features stop a determined copier: anyone can decompress the data, undo the XOR and remove the root string. They worked as a statement of intent, much like the licence field in a WOFF file. That, plus patent concerns and the fact that EOT was tied to one browser, is why the W3C standardised WOFF instead.

Related formats

EOT vs WOFF2, WOFF and TTF

EOTWOFF / WOFF2TTF / OTF
Made forInternet ExplorerEvery browserInstalling on computers
StatusObsoleteW3C Recommendations (2012, 2018)OpenType specification, ISO/IEC 14496-22
CompressionOptional MicroType Expresszlib / BrotliNone
Site restrictionRoot stringsNone; CORS controls cross-site loadingNone
Byte order of headerLittle-endianBig-endianBig-endian
SignatureNone at offset 0; 4C 50 at offset 34wOFF / wOF200 01 00 00 / OTTO
MIME typeapplication/vnd.ms-fontobjectfont/woff, font/woff2font/ttf, font/otf

On the web, cross-site use of fonts is now controlled by CORS: browsers fetch fonts in CORS mode, so a font server decides which sites may load its fonts with the Access-Control-Allow-Origin header. That does on the server what root strings tried to do inside the file.

Legacy code

The ?#iefix trick and other old @font-face code

If a stylesheet mentions .eot, it probably uses the bulletproof @font-face syntax that font services and generators produced around 2010. Its strange ?#iefix is a workaround: Internet Explorer 6 to 8 couldn't parse a src list with several fonts and format() hints, and requested the whole rest of the line as one URL. The question mark turned that rest into a query string, so the server still returned the EOT file.

fonts.css
/* The "bulletproof" syntax from around 2010. Only the first
   two lines were ever for EOT; current browsers skip them. */
@font-face {
  font-family: "Example";
  src: url("example.eot"); /* IE 9 in compatibility modes */
  src: url("example.eot?#iefix") format("embedded-opentype"), /* IE 6 to 8 */
       url("example.woff2") format("woff2"),
       url("example.woff") format("woff");
}

/* What the same rule needs today */
@font-face {
  font-family: "Example";
  src: url("example.woff2") format("woff2");
}
  • Removing the EOT lines is safe for any site that doesn't support Internet Explorer. Current browsers ignore format("embedded-opentype") sources and don't download them.
  • Delete the .eot files once nothing refers to them, together with any SVG font files (format("svg")) from the same era, a deprecated format mainly needed for early iPhones.
  • Keep the WOFF2 file, and WOFF only if you still support browsers from before about 2016.

How to

How to open and convert an EOT file

No current browser or operating system opens EOT files, so to use or inspect the font, convert it back to TTF and then to WOFF2 for the web:

  • Uncompressed EOT (like our samples): the font is the last FontDataSize bytes of the file. Cut it out and you have a working TTF, as below.
  • Compressed or obfuscated EOT: use libeot's eot2ttf, which understands MicroType Express and the XOR step, or an online font converter.
  • Making new EOT files is only worth it for testing or for a site that must support old Internet Explorer; ttf2eot writes uncompressed EOT files from a TTF.
  • Better: get the original. EOT files from web font kits are usually subsets. The foundry's TTF, OTF or WOFF2 will have more characters and features.
Terminal
# FontData sits at the end of an uncompressed EOT file,
# and FontDataSize (offset 4) says how long it is:
tail -c 11588 sample-regular.eot > extracted.ttf
ttx -l extracted.ttf

Check the licence before converting an EOT you found on a website. A web licence for a font rarely allows desktop installation, and a font extracted from someone else's site is still their licensed copy.

Rights and risks

Licences and security

EOT was built around font licensing. The header copies the font's fsType embedding permissions from its OS/2 table, the root string ties the font to named sites, and Internet Explorer installed EOT fonts privately, so other programs and other sites couldn't use them. None of this changes what the licence allows: a font extracted from an EOT file is still covered by the licence it was sold under.

Like every font format, EOT has had parser bugs. In July 2009, Microsoft's bulletin MS09-029 fixed flaws in the Windows Embedded OpenType Font Engine (T2EMBED.DLL) that let a crafted font run code (CVE-2009-0231), and further fixes for the same engine followed. Since no current browser loads EOT from web pages, that risk now applies mainly to old, unpatched systems.

Treat an .eot file from an unknown source like any other untrusted binary. Converting it with a maintained tool on an up-to-date system is safe; opening it in an old, unpatched Internet Explorer is not.

Free downloads

Sample EOT files to download

Free sample EOT files for testing legacy font pipelines, converters, format detection and upload filters. They're uncompressed Embedded OpenType (version 0x00020001, no MicroType Express, no XOR) wrapping 99helpers Sample, an original geometric typeface we drew for these pages. Browsers can't preview EOT, so there's no live specimen; the same font is shown on the TTF page.

sample-regular.eot · 11.5 KBDownload

Browsers can't show this kind of file in a page. Download it to open it in the app it belongs to.

What's inside sample-regular.eot

We wrote the header byte by byte following the W3C submission, then read it back with a separate parser to check every field.

  1. Sizes

    EOTSize 11,808 and FontDataSize 11,588, little-endian, at offsets 0 and 4.

  2. Version and flags

    Version 0x00020001, flags 0: not subset, not compressed, not XOR-ed.

  3. Font properties

    PANOSE 02 0B 05 03 … (sans serif, medium weight), weight 400, fsType 0 and the Unicode ranges, all copied from the font's OS/2 table.

  4. Magic number

    4C 50 at offset 34, which is how tools such as file recognise the format.

  5. Names

    "99helpers Sample", "Regular", "Version 1.000" and "99helpers Sample Regular" in UTF-16, then an empty root string.

  6. Font data

    A complete TrueType font from offset 0xDC to the end, with the licence and a link back to this page in its name table.

All sample EOT files

  • Regular weight, uncompressed

    sample-regular.eot · 11.5 KB (11,808 bytes)

    99helpers Sample Regular as EOT version 0x00020001, no compression, no XOR, no root string. The embedded TTF can be cut out with tail.

    • Testing EOT parsers and converters
    • Checking format detection by the `4C 50` magic number
  • Bold weight, uncompressed

    sample-bold.eot · 11.3 KB (11,576 bytes)

    The same family at weight 700: the header's Weight field is 700 (BC 02 00 00) and the PANOSE weight byte is 8.

    • Testing that converters keep weight and style
    • Legacy `@font-face` set-ups with two weights
  • EOT with a root string

    sample-root-string.eot · 11.6 KB (11,854 bytes)

    The regular font with a root string of https://99helpers.com/ (46 bytes of UTF-16 including the closing null), which in Internet Explorer limited the font to pages on that site.

    • Testing parsers that read or strip root strings
    • Seeing how the header grows with a root string

Ways to test with them

  • Format detection: EOT has no signature at offset 0. A detector should check for 4C 50 at offset 34, and that the first four bytes equal the file size.
  • Converters: convert sample-regular.eot to TTF and compare with ttx -l; you should get the ten tables of the TTF sample.
  • Extraction: tail -c 11588 sample-regular.eot gives a valid TTF, because the font data is stored uncompressed at the end.
  • Browsers: load sample-regular.eot with @font-face or the FontFace API in a current browser: it is rejected (Chromium reports invalid font data), which confirms nothing still depends on it.

Free to use for testing, teaching and demos, commercially or not, with no attribution needed. A link back to this page is always appreciated.

Put it online

Have an EOT file? Give it a link.

Drop an EOT file on 99helpers and it gets its own address in seconds. Opening the link downloads the file, since browsers don't display font files on their own; a page you host on 99helpers can still reference it with @font-face for old Internet Explorer.

Questions

EOT files, frequently asked

What is an EOT file?

An Embedded OpenType font: Internet Explorer's web font format. It contains a TrueType or OpenType font behind a header, often compressed and restricted to particular websites.

How do I open an EOT file?

No current app or browser opens it directly. Convert it to TTF with a tool such as libeot's eot2ttf or an online converter, then install or inspect the TTF.

Do I still need EOT fonts on my website?

No. EOT was only needed for Internet Explorer 8 and earlier, and Microsoft no longer supports Internet Explorer. WOFF2 works in every current browser.

What does ?#iefix mean in @font-face?

A workaround for a parsing bug in Internet Explorer 6 to 8, which requested the whole src list as one URL. The question mark made the rest a harmless query string.

Can I convert EOT to WOFF2?

Yes: convert it to TTF first, then to WOFF2 with fontTools or woff2_compress. If you can, start from the original font instead, as EOT files are often subsets.

What is the MIME type of an EOT file?

application/vnd.ms-fontobject. RFC 8081, which created the font/ media types, doesn't cover EOT.

Does EOT protect fonts from copying?

Not really. Its root strings, XOR step and compression make copying less convenient, but they can all be undone. The licence is what protects a font.

Related formats

Other file types explained

Keep going

Related

Sources

Last reviewed 27 October 2026.