The TAR file (.tar)

A TAR file is many files and folders glued into one, with a short header before each file saying its name, size, permissions, owner and date. That's all it does: it doesn't compress anything. A folder of 10 MB becomes a TAR file of slightly more than 10 MB.

The name means tape archive. tar was written in 1979 to copy files to magnetic tape, which can only be read and written from start to end. That's why the format has no table of contents and just writes one file after another. It suits anything that works as a stream: piping between programs, backups, and network copies such as tar -cf - folder | ssh server tar -xf -.

Compression is a separate step on top. A `.tar.gz` or `.tgz` is a TAR file compressed with gzip; .tar.bz2 uses bzip2 and .tar.xz uses XZ. Splitting the jobs like this is the Unix habit of one tool per task, and it lets the compressor see all the files as one stream.

Plain, uncompressed .tar files are less common to download, but you meet them in container images saved with docker save, in backup systems, and whenever the data is already compressed (photos, videos) so compressing again would gain nothing.

• Everything is in 512-byte blocks. A header is one block. File data fills as many blocks as needed, padded with zeros. So the archive's size is always a multiple of 512.
• Headers are text. Numbers are written as octal digits in ASCII, which made the format readable on any machine in 1979 and still makes it easy to inspect in a hex viewer.
• There's no index. To list a TAR file, a tool reads the first header, skips over the data, reads the next header, and so on to the end. Uncompressed, that skip is fast; inside a .tar.gz it means decompressing everything.
• The end is two zero blocks, followed by padding to a whole record (10,240 bytes by default in GNU tar, bsdtar and Python).
• Appending is easy. tar -rf archive.tar newfile writes over the end marker and adds a new one. If a name appears twice, the later copy wins on extraction.

The 512-byte header has been extended several times. Most tools read all the variants; what they write differs.

The extensions are designed to degrade gracefully. An old ustar reader that meets a pax archive extracts the extended headers as small text files called something like PaxHeaders.1234/name, and an old reader of GNU archives creates a file called ././@LongLink. The real files still come out, with shortened names.

tar was built to back up Unix systems, so it records what a Unix file system needs to put a file back exactly:

• Permissions, including the execute bit that makes scripts and programs runnable.
• Owner and group, as numbers and names. A normal user extracting an archive becomes the owner of everything; root gets the original owners back.
• Symbolic links as links, not as copies of the file they point to.
• Hard links: a second name for the same file is stored once, with a link entry for the other name.
• Device files, FIFOs and empty folders.
• Extended attributes and ACLs, in pax headers, if you ask for them (--xattrs, --acls in GNU tar).

That's why Linux software, source code and server backups travel as compressed tar files. On Windows most of this metadata has nowhere to go: permissions and owners are ignored, and creating symbolic links needs Developer Mode or administrator rights.

• This does not look like a tar archive: the file isn't tar at all (a ZIP, an HTML error page) or it's compressed in a way tar didn't detect. Run file archive.tar to see what it is.
• Removing leading '/' from member names: the archive was made with absolute paths. GNU tar strips the / and extracts relative to the current folder, which is what you want. It's a warning, not an error.
• Ignoring unknown extended header keyword: an archive made on macOS or with another tool contains pax keys GNU tar doesn't know, such as LIBARCHIVE.xattr entries. The files are fine.
• ._ files everywhere: macOS's tar stores Finder metadata as extra ._name files. Create the archive with COPYFILE_DISABLE=1 tar -cf … to leave them out.
• A tiny archive is 10 KB: the end marker and padding to a 10,240-byte record. sample-gnu.tar holds about 430 bytes of text and is 10,240 bytes.
• Files land all over the current folder: the archive has no top-level folder (a "tarbomb"). List it first with tar -tf, and extract into a new folder with tar -xf archive.tar -C newfolder.
• Names that are invalid on Windows, such as ones containing : or ?, or two names that differ only in upper and lower case, fail or overwrite each other when extracted on Windows.

Listing a tar file (tar -tvf) is safe. Extracting one from an untrusted source is the risky part, because a header can say almost anything:

• Path traversal. An entry named with ../ components can climb out of the folder you extract to and overwrite a file elsewhere, such as a shell startup script.
• Absolute paths. An entry named /etc/something would be written to that exact place if the tool honoured it.
• Symbolic link tricks. An archive can contain a link dir pointing to /home/user/.ssh, followed by a file dir/authorized_keys. A naive extractor creates the link, then writes the file through it, outside the target folder. Hard links can point outside in the same way.
• Permissions and ownership. Extracted as root, an archive can create setuid programs, device files, or files owned by other users.
• Tarbombs and size. An archive can scatter thousands of files in the current folder, and a compressed one can expand enormously (see gzip bombs).

GNU tar and bsdtar refuse .. paths, strip leading slashes, and handle links with care unless told otherwise (-P or --absolute-names turns that off). Libraries are another matter. Python's tarfile followed .. paths by default for years (CVE-2007-4559); Python 3.12 added extraction filters, and Python 3.14 made the safe data filter the default.

• Linux: GNU tar is installed everywhere; file managers open .tar files too.
• macOS: double-click to extract with Archive Utility, or use tar in Terminal (it's bsdtar, from the libarchive project, with the same basic options).
• Windows: Windows 10 (from version 1803) and 11 include tar.exe, also bsdtar, so the commands above work in Command Prompt and PowerShell. Recent Windows 11 versions also open and create tar archives in File Explorer. 7-Zip opens them on any version.
• Programming: Python's tarfile, Go's archive/tar, Node packages such as tar, and libarchive for C.