The EPS file (.eps, .epsf)

EPS stands for Encapsulated PostScript. PostScript is the page description language Adobe created in the 1980s for laser printers and typesetters: a document is a program, and the printer runs it to draw the page. An EPS file is a PostScript program with rules that make it safe to place inside another document: it draws a single picture, says how big that picture is, and doesn't change the printer's settings.

For about twenty years EPS was how logos, charts and illustrations travelled between design programs, page layout software and print shops. It's vector, so it prints sharp at any size, and every PostScript printer understood it. Scientific publishers and LaTeX workflows also used it for figures. Many logo packages and stock graphics still include an .eps version.

Today it is a legacy format. According to the Library of Congress, Adobe has said there will be no new PostScript or EPS versions, PDF has replaced EPS in many contexts, and Adobe recommends EPS only for importing older artwork. Three things follow from that:

• It's a program, not a picture. To show it, software has to run PostScript code, which is why few apps open EPS directly and why it carries security risks (see below).
• It's often vector, but not always. An EPS can hold shapes, text and embedded bitmaps. An EPS exported from Photoshop, or converted from a JPG, is just a bitmap in a PostScript wrapper and won't scale any better than the original.
• It has no transparency. PostScript can't describe see-through objects, so exporters flatten transparency into opaque pieces or bitmaps.

A layout program such as QuarkXPress or PageMaker traditionally didn't need to understand the PostScript inside an EPS. It read the comments, showed a preview on screen and passed the code on to the printer:

1. 1It reads %%BoundingBox to find out how big the picture is, without running anything.
2. 2It shows the preview, if the file has one, so the designer sees the picture in place. Without a preview, older programs showed a grey box with the file name. The file still printed correctly.
3. 3When printing, it wraps the EPS code in its own: save the printer's state, move and scale the coordinate system to the frame on the page, redefine showpage to do nothing, run the EPS, then restore the state.
4. 4The printer's PostScript interpreter draws the picture at the printer's full resolution.

That's why the specification forbids some PostScript operators in EPS files, such as initgraphics, erasepage, setpagedevice and exitserver: they would reset or wipe the page of the document the EPS is placed in.

When a printer or a client asks for "vector artwork", a PDF is now usually the better answer: it holds the same vectors, keeps transparency and embedded fonts, and every device can show it. For a website or an app, export SVG. Keep EPS for the few systems that still require it, such as some sign-cutting, embroidery and older publishing pipelines.

• Adobe Illustrator opens EPS files as editable artwork. Affinity Designer and Affinity Photo also open and export EPS.
• Inkscape (free, Windows, macOS, Linux) imports EPS and PostScript, but only when Ghostscript is installed, because it converts the file through it first. It also exports EPS.
• LibreOffice imports EPS too, but when we converted our example to PDF with it, the picture came out as a bitmap rather than vectors.
• Ghostscript (free, command line) runs the PostScript itself. gs -dSAFER -dEPSCrop -sDEVICE=pdfwrite -o out.pdf in.eps makes a PDF the size of the bounding box; -sDEVICE=png16m -r300 instead makes a PNG at 300 dpi. eps2eps cleans up an EPS, or turns PostScript or PDF into one.
• On a Mac: Preview could open EPS files until macOS 12. In macOS 13 Ventura Apple removed that, and in macOS 14 Sonoma it removed the system's built-in PostScript-to-PDF converter and the pstopdf command. Use Illustrator, Affinity, Inkscape or Ghostscript.
• In a browser: browsers can't display EPS, so a link to one downloads it. Online converters exist, but they run the file on someone else's server: don't use them for confidential artwork.

Microsoft Office used to accept EPS images, converting them to its own EMF format on insertion. Attackers abused the EPS import filter with booby-trapped documents, so with the security update of 11 April 2017 Microsoft turned EPS insertion off in Office 2010 to 2016 and Microsoft 365 (Office 2007 had lost it in 2015).

• Microsoft 365 and Office 2019, 2021 and 2024: there is no way to insert EPS files. The registry setting that switched it back on was removed in 2018.
• Office 2010, 2013 and 2016: a registry change can re-enable it, which Microsoft advises against.
• Existing documents: EPS images inserted earlier were already converted to EMF, so they still show.
• The fix: convert the EPS to SVG (Office 2019 and later) or EMF, or to PNG, and insert that.

Opening an EPS means running a program written in PostScript, a complete programming language with loops, file operations and, in Ghostscript, a way to start other programs. Interpreters run it in a sandbox, and the sandbox has been broken more than once:

• CVE-2023-36664: Ghostscript up to 10.01.2 mishandled permissions for the %pipe% device and the | prefix, so a crafted PostScript or PDF file could run shell commands. Fixed in 10.01.3.
• CVE-2024-29510: a format-string flaw in Ghostscript up to 10.03.0 let a file switch off the -dSAFER sandbox. Codean Labs showed it with a valid EPS, and attackers exploited it with EPS files disguised as JPGs. Fixed in 10.03.1 (May 2024).
• Microsoft Office: EPS exploits in Word documents led Microsoft to disable EPS import in 2017.

For people, the advice is simpler: open EPS files from sources you trust, in up-to-date software. Viewing an EPS's preview image runs no code; rendering the PostScript does.