The basics
What is a RAR file?
A RAR file is an archive: files and folders compressed into one file. Eugene Roshal created the format in 1993; its best-known program, WinRAR, followed for Windows. RAR files are common for large downloads split into parts, game and software distribution, and file sharing, where its recovery records help with incomplete or damaged copies.
Like ZIP and 7z, RAR compression is lossless. Unlike them, it's proprietary. RARLAB publishes how to read the format, and gives away free tools and source code to extract it, but only RARLAB's own programs can create RAR files. WinRAR is shareware: the licence allows a 40-day trial, then asks you to buy a licence.
- Recovery records that can repair a damaged archive.
- Multi-volume sets that split one archive into numbered parts.
- Solid compression, optional, for smaller archives of similar files.
- AES-256 encryption that can also hide the file names.
Anatomy
What's inside a RAR file
A RAR5 file is a signature followed by a chain of blocks, each a header and, for files, the data after it. Every header starts with a CRC-32 of itself, its size and its type. Numbers inside headers are variable-length integers (vints): 7 bits per byte, with the top bit meaning "more bytes follow". Here are the blocks of our sample-archive.rar.
offset bytes block
0 52 61 72 21 1A 07 01 00 RAR5 signature "Rar!" 1A 07 01 00
8 DA 38 AB 30 0F 01 05 0B 0C … main archive header (type 1)
0C flags: solid + recovery record
0A 01 03 80 80 80 00 … locator: where the recovery record is
28 FF 13 3A 10 13 03 02 E7 00 … service header (type 3) "CMT"
+ 103 bytes the archive comment, stored
155 FC EF 1F 84 45 02 03 23 … file header (type 2): data/people.csv
C8 02 · 96 02 packed 328 bytes, unpacked 278
A4 83 02 attributes: Unix 0644
40 92 E0 6A mtime 2026-10-27 12:00:00 UTC
80 1D compression: method 5, 1 MB dictionary
01 0F 64 61 74 61 2F … host OS Unix; 15-byte UTF-8 name
22 02 00 AE 06 30 29 … extra area: BLAKE2sp hash
+ 328 bytes compressed data, starts the solid stream
557 2E B1 26 D6 43 02 03 23 … file: docs/guide.md, flag "solid"
833 2F 46 5B BE 45 … file: images/logo.png
4,088 C0 61 B4 60 40 … file: README.txt
4,608 CE D8 A5 70 51 … file: unicode/café-日本語.txt
4,810 CE CB B0 A0 14 02 02 00 03 … folder entries: data, docs,
images, unicode (no data)
4,915 C7 B0 77 58 12 03 07 03 … 52 52 service header "RR"
+ 1,096 bytes recovery record (Reed-Solomon)
6,034 1D 77 56 51 03 05 04 00 end of archive header (type 5)
6,042 end of file- 1
52 61 72 21 1A 07 01 00Signature
Rar!, then1A 07, then01 00for RAR5. A RAR4 file has00in place of01 00. Readers search for it within the first megabyte or so, because a self-extracting.exeputs a program in front of the archive. - 2
DA 38 AB 30 · 0F · 01Header CRC, size and type
Every block begins the same way: a CRC-32 of the header, its size (15 bytes here) and its type. Type 1 is the main archive header, 2 a file, 3 a service block, 4 the encryption header, 5 the end.
- 3
0CArchive flags
Bit
0x04says the archive is solid,0x08that it has a recovery record. Volumes set0x01and, after the first,0x02with a volume number. - 4
"CMT"The archive comment
A service block named
CMTholding the comment text in UTF-8. WinRAR shows it in a side panel;unrar lprints it before the list. - 5
40 92 E0 6AA file header
Name, size, attributes, a modification time (RAR5 stores UTC; RAR4 stored local time) and a checksum. This sample uses BLAKE2sp hashes (
-htb), kept in the header's extra area, instead of the default CRC-32. - 6
80 1DCompression information
One vint packs the algorithm version, the solid flag, the method (0 = stored to 5 = best) and the dictionary size: 128 KB × 2^3 = 1 MB here.
- 7
flag "solid"Solid files
From the second file on, the solid flag tells the extractor to carry on from the previous file's dictionary. So the README can't be decompressed without decompressing the three files before it.
- 8
"RR" + 1,096 bytesRecovery record
Reed-Solomon error correction data, about 5% of the archive here (
-rr5%). If part of the file is damaged,rar ror WinRAR's Repair can rebuild it. - 9
1D 77 56 51 03 05 04 00End of archive
The last block. In a multi-volume set its flags say whether another volume follows.
Versions
RAR4 vs RAR5
There are two RAR formats in use. RAR 5.0, in 2013, introduced a new one, RAR5, with a different signature and layout. The older one, used from RAR 1.5 to 4.x, is called RAR4 or RAR 2.9 (RAR 7 lists it as "RAR 1.5"). RAR 7.00 (2024) stopped creating RAR4 archives; it and later versions still extract them.
| RAR4 | RAR5 | |
|---|---|---|
| Signature | 52 61 72 21 1A 07 00 | 52 61 72 21 1A 07 01 00 |
| Encryption | AES-128 | AES-256 (CBC), key from PBKDF2 with HMAC-SHA256 |
| Checksums | CRC-32 | CRC-32 or BLAKE2sp |
| File times | Local time | UTC |
| File names | Legacy code page, plus optional Unicode | UTF-8 |
| Largest dictionary | 4 MB | 1 GB in RAR 5.0; up to 64 GB since RAR 7.0 |
| Recovery record | Sector-based | Reed-Solomon, more resistant to scattered damage |
| Special filters | x86, delta, text, audio, true colour, Itanium | x86 and delta |
| Created by current RAR | No | Yes, by default |
Archives only RAR 7 can open
RAR 7.0 added a second version of the RAR5 compression algorithm for dictionaries over 4 GB. Archives that use it can only be unpacked by RAR 7.0 or newer, and by other tools that have caught up. Archives with normal dictionary sizes stay readable by RAR 5.0 and later.
Features
Multi-volume archives and recovery records
Volumes. rar a -v100m splits an archive into parts of 100 MB. Current RAR names them name.part1.rar, name.part2.rar and so on, with leading zeros in larger sets (part001). Older sets used name.rar, name.r00, name.r01 …; current RAR still reads those. To extract, put every part in one folder and open the first. Our sample-volumes.part1.rar and .part2.rar hold one PNG split across both.
Recovery records. -rr5% adds error correction data of about 5% of the archive's size. Typically a recovery record of N% can repair up to about N% of continuous damage, for example a bad block on a disk or a corrupted section of a download. Recovery volumes (.rev files, made with -rv) do the same for a whole set: each .rev can replace one missing or damaged volume.
A recovery record repairs damage; it doesn't replace a backup. RARLAB's own documentation recommends keeping copies on different media for important data.
Comparison
RAR vs ZIP vs 7z
| RAR | ZIP | 7z | |
|---|---|---|---|
| Compression | Better than ZIP | Good | Usually the smallest |
| Opens without extra software | Recent Windows 11 only | Everywhere | Recent Windows 11 only |
| Free software can create it | No | Yes | Yes |
| Encryption | AES-256, can hide names | ZipCrypto (weak) or AES-256; names visible | AES-256, can hide names |
| Repair data | Recovery records and volumes | No | No |
| Split into parts | Yes, .partN.rar | Yes, .z01 … .zip | Yes, .7z.001 … |
| Specification | Published by RARLAB, proprietary | Public (PKWARE APPNOTE) | Public, no restrictions |
If you're creating an archive for others, ZIP is the safest choice and 7z the free choice for the best compression. RAR is worth it mainly for its recovery records and volume handling, if you already have WinRAR.
How to
How to open and create a RAR file
- Windows 11: double-click to browse it, then Extract all. An update in late 2023 added RAR support, through the open-source libarchive library. It can't open password-protected archives and can't create RAR files. Use 7-Zip (free) or WinRAR for those cases, and on Windows 10.
- macOS: The Unarchiver or Keka (free), or RARLAB's command-line RAR for macOS.
- Linux:
unrar x archive.rar(from theunrarpackage) or7z x archive.rar.unarand libarchive'sbsdtaralso extract most RAR files. - Android: RARLAB's RAR app, or another archive app. iPhone and iPad: an unarchiver app from the App Store.
- Creating RAR files: only WinRAR (Windows), RAR for Linux, macOS and FreeBSD (command line) and RAR for Android, all from rarlab.com.
rar a -ma5 -m5 archive.rar foldermakes a RAR5 archive with the best compression. - Programming: RARLAB's UnRAR source and
UnRAR.dll, Python'srarfile(which calls an extractor such asunrarfor the data) and libarchive can read RAR. None can write it.
Why no one else can create RAR files
The UnRAR source licence allows anyone to use it to extract RAR archives, free of charge, but forbids using it to re-create the RAR compression algorithm or build a RAR-compatible archiver. That's why 7-Zip extracts RAR but can't make it.
Troubleshooting
Common RAR problems and fixes
- "Unexpected end of archive": the download is incomplete or a volume is missing. Check every
.partN.raris present and complete. If the archive has a recovery record, try Repair in WinRAR orrar r archive.rar. - "You need to have the following volume to continue extraction": one part of the set is missing or named differently. All parts must sit in the same folder with their original names.
- "Checksum error" or "CRC failed": the data is damaged, or a wrong password was used on an archive whose names aren't encrypted. A recovery record may fix damage; a password can't be recovered.
- Windows says the file is invalid or asks for a password: File Explorer doesn't handle encrypted RAR files. Open it with 7-Zip or WinRAR.
- "Unsupported compression method" in an old tool: the archive is RAR5, or uses RAR 7's large dictionaries, and the tool is too old. Update it.
- WinRAR keeps asking you to buy it: that's the trial reminder. Extraction keeps working; 7-Zip is a free alternative for opening RAR files.
Security
Is it safe to open a RAR file? WinRAR's security flaws
RAR files are a favourite way to deliver malware, for the same reasons as ZIP: they bundle anything, and encrypted ones with hidden names can't be scanned. They also have their own history of serious flaws in WinRAR, the most common program for opening them:
- Path traversal. A crafted archive can try to write files outside the folder you extract to, for example into Windows' Startup folder so they run at the next sign-in. WinRAR 7.12 and 7.13 (2025) each fixed a flaw of this kind, and RAR 7.23 (June 2026) fixed a related one with symbolic links.
- CVE-2025-8088. Found by ESET in July 2025: WinRAR could be tricked through NTFS alternate data streams into writing files to a path chosen by the attacker. The Russia-aligned RomCom group and at least one other group used it in phishing attacks. Fixed in WinRAR 7.13 on 30 July 2025; the Windows versions of RAR, UnRAR and UnRAR.dll were affected too.
- CVE-2023-38831. Exploited from April 2023: an archive held a harmless-looking file and a folder with the same name, and double-clicking the file in WinRAR ran a script from the folder instead. Group-IB found it being used against traders on cryptocurrency and stock forums. Fixed in WinRAR 6.23, released on 2 August 2023.
Staying safe
Check your WinRAR version under Help, About, and update from rarlab.com if it's old: a copy from before 7.13 is vulnerable to CVE-2025-8088. Prefer an up-to-date 7-Zip or your system's own extractor for archives you didn't expect, and never run a program, script or shortcut from an archive someone sent you unless you're sure what it is.
Free downloads
Sample RAR files to download
Free sample RAR files for testing extractors, upload validation and parsers. The RAR5 samples were made with RAR 7.23 for Linux and the RAR4 one with RAR 6.24, both from RARLAB. Each passed rar t, unrar t and 7-Zip's 7zz t. The password for the encrypted ones is 99helpers.
Browsers can't show this kind of file in a page. Download it to open it in the app it belongs to.
What's inside sample-archive.rar
A small RAR5 archive with most of the format's features in 6 KB. Browsers can't show what's inside an archive, so there's no live preview; unrar l or WinRAR shows the comment and the files.
Folders
data/,docs/,images/andunicode/, stored as directory entries after the files.Solid compression
Created with
-s: every file after the first carries the solid flag.rar ltreports "RAR 5, solid, recovery record".A recovery record
1,096 bytes of Reed-Solomon data (
-rr5%), sorar rcould repair a small amount of damage.BLAKE2sp checksums
Made with
-htb: each file has a 256-bit BLAKE2sp hash instead of a CRC-32.rar ltshows them.An archive comment
A two-line comment with the sample's origin, in a
CMTservice block.A UTF-8 file name
unicode/café-日本語.txt. RAR5 stores names as UTF-8.Fixed dates and Unix permissions
Every file is dated 2026-10-27 12:00:00 UTC, with Unix permissions, because it was made on Linux (host OS: Unix).
All sample RAR files
RAR5 archive with folders
sample-archive.rar · 5.9 KB (6,042 bytes)
5 files in 4 folders, solid, with a recovery record, BLAKE2sp checksums, an archive comment and a UTF-8 file name.
- Testing extraction, listing and previews
- Checking RAR5 support
Password-protected RAR, names visible
sample-encrypted.rar · 523 bytes
Two files and a folder, AES-256 encrypted with
-p. Password:99helpers. The file list can be read without the password.- Password prompts and wrong-password errors
- Upload filters that should flag encrypted archives
Password-protected RAR, headers encrypted
sample-encrypted-headers.rar · 670 bytes
The same files with
-hp: an archive encryption header (type 4) follows the signature and everything after it is encrypted. Password:99helpers.- Tools that must ask for a password before listing
- Scanners that should report an unreadable archive
Multi-volume set, part 1 of 2
sample-volumes.part1.rar · 60 KB (61,440 bytes)
The first volume of a two-part RAR5 set made with
-v60k: a README and the first 61,087 bytes of a 71,270-byte PNG.- Testing multi-volume extraction
- Checking the error when a part is missing
Multi-volume set, part 2 of 2
sample-volumes.part2.rar · 10.3 KB (10,527 bytes)
The second volume: the rest of the PNG. Download both parts into one folder and open part 1.
- Testing multi-volume extraction
- Upload tools that must keep a set together
RAR4 archive
sample-rar4.rar · 3.8 KB (3,850 bytes)
Three files in the older RAR 1.5–4.x format (signature
52 61 72 21 1A 07 00), with CRC-32 checksums and a comment, made with RAR 6.24's-ma4. RAR 7 can no longer create this format.- Checking old-format support in extractors
- File type detection for both signatures
Ways to test with them
- Format support: extract both
sample-archive.rar(RAR5) andsample-rar4.rar(RAR4). A tool that only opens one of them is missing a format. - Encryption:
sample-encrypted.rarshould list without a password and ask for one on extraction;sample-encrypted-headers.rarshould ask before listing anything. Use99helpers. - Volumes: extract the set with both parts, then again with part 2 missing, and check the error message makes sense.
- Detection: check your upload filter recognises both signatures,
Rar!\x1A\x07\x01\x00andRar!\x1A\x07\x00, and doesn't rely on the extension alone.
Free to use for testing, teaching and demos, commercially or not, with no attribution needed. A link back to this page is always appreciated.
Put it online
Have a RAR file? Give it a link.
Drop a RAR on 99helpers and it gets its own download link, so you can share a large set of files without attachment limits. Anyone with the link downloads the archive and opens it with their own tools.
Questions
RAR files, frequently asked
How do I open a RAR file?
On Windows 11, double-click it: File Explorer opens RAR files since a late-2023 update, though not password-protected ones. Otherwise use 7-Zip or WinRAR on Windows, The Unarchiver or Keka on a Mac, or unrar x file.rar on Linux.
Is WinRAR free?
No. It's shareware with a 40-day trial, after which the licence requires you to buy it, although it keeps working with a reminder. 7-Zip is free and opens RAR files, but can't create them.
Can I create a RAR file without WinRAR?
Only with RARLAB's other programs: RAR for Linux, macOS or FreeBSD, or RAR for Android. No free or third-party tool can create RAR files, because the format's compression is proprietary.
What is the difference between RAR4 and RAR5?
RAR5, introduced with RAR 5.0 in 2013, uses AES-256 instead of AES-128, larger dictionaries, UTF-8 names, UTC times and a stronger recovery record. Current RAR versions only create RAR5.
How do I open a multi-part RAR (part1, part2 …)?
Download every part into the same folder without renaming them, then open the .part1.rar file. The extractor reads the rest in order. If one part is missing, extraction stops there.
Is RAR better than ZIP?
It usually compresses better and can repair damage with a recovery record, but ZIP opens everywhere and can be made with free tools. For sharing, ZIP is usually the better choice.
Can a RAR file contain a virus?
Yes. A RAR can hold any file, and flaws in WinRAR itself have been exploited, such as CVE-2023-38831 and CVE-2025-8088. Keep WinRAR or 7-Zip updated and don't run files from archives you didn't expect.
What is a recovery record?
Extra error correction data stored in the archive. If part of the file gets damaged, WinRAR's Repair command or rar r can use it to restore the data, up to about the record's size.
Related formats
Other file types explained
Keep going
Related
Sources
- RARLAB: RAR 5.0 archive format (technical note)
- Library of Congress: RAR Archive File Format Family
- IANA: application/vnd.rar
- RARLAB: WinRAR what's new
- ESET: RomCom and others exploiting WinRAR zero-day (CVE-2025-8088)
- BleepingComputer: WinRAR zero-day exploited since April (CVE-2023-38831)
Last reviewed 27 October 2026.