The RTF file (.rtf)

RTF is a document format Microsoft created in the 1980s so that formatted text could move between word processors and operating systems. An RTF file holds the text plus its fonts, sizes, colours, paragraph styles, tables, lists, images and page layout, all written as readable control words in a plain-text file.

It's no longer the main format of any big word processor, but it hasn't gone away. TextEdit on the Mac saves formatted documents as RTF by default. Copying formatted text between apps often travels as RTF on the clipboard. Many programs export reports, letters and templates as RTF because it's simple to generate and opens in almost every word processor.

• It's text, not a package. Open an RTF file in a plain-text editor and you see the control words and the text between them. A DOCX is a ZIP of XML files instead.
• It's not a fixed layout. Like DOCX, the reading app lays out the lines and pages, so the same file can paginate differently in Word and LibreOffice.
• It's frozen. Microsoft stopped extending RTF after version 1.9.1 (2008). Features added to Word since then have no RTF equivalent and are lost when you save as RTF.

A reader goes through the file one character at a time and keeps a current state: font, size, bold, colour, paragraph settings. Control words change that state, an opening brace saves it and a closing brace restores it. That's why {\b bold} only affects one word.

• Control words are a backslash, lowercase letters and an optional number: \b, \fs24, \cf2, \li720. A space after a control word ends it and isn't part of the text.
• Control symbols are a backslash and one other character: \~ for a non-breaking space, \- for an optional hyphen, \{ for a literal brace.
• Destinations are groups whose content isn't ordinary text: the font table, the colour table, headers and footers, footnotes, document information, images. A destination that starts with \* can be skipped by readers that don't know it.
• Fields hold things that are calculated, such as page numbers and hyperlinks: an instruction (\fldinst) and its last result (\fldrslt), which readers without field support display as is.

RTF files are almost always pure ASCII. Every other character is written as an escape, in one of two ways:

• \'hh: one byte in the document's code page, set by \ansicpg. In Windows-1252, \'e9 is é. Readers that assume the wrong code page show the wrong letters.
• \uN: a Unicode character as a signed 16-bit decimal number, followed by a fallback for readers that don't know \u. \uc1 says the fallback is one character long, usually ? or the nearest code-page character. Characters beyond 65535, such as emoji, take two \u escapes (a UTF-16 surrogate pair), and numbers above 32767 are written as negatives: 🙂 is \u-10179?\u-8638?.

Images are stored inside a \pict group as hexadecimal text, with a control word for their format: \pngblip, \jpegblip, \emfblip or \wmetafile. Hex takes two characters per byte, so an image doubles in size: the 4,864-byte PNG in sample-image.rtf takes 9,728 characters. Word often stores a second, WMF copy of each picture for older readers as well, which is why RTF files with photos can be many times larger than the same document as DOCX.

In practice: use DOCX or ODT for documents you keep editing, PDF for final versions, and RTF when a program can only produce or accept RTF, or when the reader's word processor is unknown and the formatting is simple. For text without formatting, TXT or Markdown is simpler still.

• It shows code like {\rtf1\ansi. The file opened in a plain-text editor, or a browser showed it as text. Open it in a word processor instead. If a word processor shows the code too, the file was saved as plain text with an .rtf name, and the code is part of the text.
• The file is huge. Images are stored as hex text, often twice. Save it as DOCX, or remove and re-insert the images as compressed JPEGs before saving as RTF.
• Letters are wrong (é instead of é). Some tool wrote UTF-8 bytes straight into the file instead of escaping them. RTF readers expect ASCII with \'hh or \u escapes.
• Formatting is lost after saving as RTF. Word features newer than RTF 1.9.1, as well as some layout features, have no RTF form. Keep the DOCX as your master copy.
• Images are missing in TextEdit. The pictures were in an .rtfd package and only the RTF file inside it was sent.
• WordPad is gone. Microsoft removed WordPad, the RTF editor that came with Windows, starting with Windows 11 version 24H2. Use Word, Word for the web or LibreOffice instead.

• Windows: Microsoft Word, or LibreOffice Writer for free. Older Windows versions still include WordPad.
• macOS: TextEdit opens and saves RTF out of the box; Word, Pages and LibreOffice open it too.
• Linux: LibreOffice Writer or AbiWord.
• In a browser or on a phone: browsers can't render RTF. Google Docs opens it after upload to Google Drive and can download a document as RTF.
• Convert to DOCX or PDF: in Word, File, Save As. On a server: soffice --headless --convert-to docx file.rtf (or pdf). On a Mac: textutil -convert docx file.rtf.
• Convert to text or Markdown: soffice --headless --convert-to txt file.rtf, textutil -convert txt file.rtf on a Mac, or pandoc -f rtf -t markdown file.rtf with a recent pandoc. Test the result: in our tests pandoc 3.1.3 dropped some letters after \u escapes in sample-unicode.rtf, which LibreOffice read correctly.

RTF can't contain macros, which makes it look harmless. But it can embed OLE objects (the \object and \objdata destinations hold another program's data as hex), and Word's RTF reader is complex old code. For years RTF was one of attackers' favourite ways into Office:

• CVE-2017-0199. An RTF file, often renamed to .doc, contained a linked OLE object that made Word download an HTA file from the attacker's server and run it. Exploited in the wild in April 2017 before Microsoft's fix.
• CVE-2017-11882. A memory bug in Office's old Equation Editor, reached through an equation object embedded in a document. Patched in 2017, it was still used in RTF email campaigns years later, and Microsoft removed Equation Editor from Office.
• CVE-2023-21716. A heap corruption bug in Word's RTF parser, triggered by a font table with an excessive number of fonts. Rated 9.8 out of 10, it could be triggered just by previewing the file in the Preview Pane. Fixed in February 2023.