RAR5 file format
A RAR archive using the RAR 5.0 format.
- MIME type
- application/x-rar-compressed
- Extensions
- .rar
- Category
- Archives & compression
Magic-number signature
| 0x00000000 | 526172211A070100 | Rar!···· | 'Rar!' RAR5 signature |
About the RAR5 format
RAR 5.0 is the current proprietary WinRAR format, offering recovery records and strong encryption. Its eight-byte signature ends in 01 00, distinguishing it from the older 4.x layout. Past that signature the format is a chain of typed blocks, and almost every field in them is a variable-length integer — seven data bits per byte with the top bit as a continuation flag — so beyond offset 12 nothing sits at a fixed position. That design keeps small archives small, and it means a byte-level reader has to decode its way forward rather than index into the file.
Header layout, byte by byte
| Offset | Length | Field | Meaning |
|---|---|---|---|
| 0 | 8 | RAR 5.0 signature | 52 61 72 21 1A 07 01 00 — the letters 'Rar!' then 1A 07 01 00. The 1A is a DOS end-of-file character, so typing the archive to a terminal stops there rather than dumping binary. |
| 8 | 4 | Header CRC-32 | The specification defines it as the CRC32 of the header data starting from the header size field and up to and including the optional extra area — so it covers everything after itself, not the block as a whole. |
| 12 | 1-10 | Header size (variable-length integer) | The first variable-length field, and the last one at a fixed offset. The encoding is little-endian base 128: the low seven bits of each byte carry data and the high bit means another byte follows. Every offset after this depends on how many bytes it took. |
| variable | 1+ | Header type | 1 main archive header, 2 file header, 3 service header, 4 archive encryption header, 5 end of archive header. In an ordinary archive the block at offset 8 is type 1; in one with encrypted headers it is type 4 instead, and nothing further can be read without the password. |
| variable | 1+ | Header flags | Common to every block type. 0x0001 means an extra-area size field follows the flags, and 0x0002 means a data-area size field does — so these two bits decide whether the next two variable-length integers exist at all. |
| variable | 1+ | Archive flags (main header only) | 0x0001 the archive is one volume of a multi-volume set, 0x0002 a volume number field is present, 0x0004 solid archive, 0x0008 a recovery record is present, 0x0010 the archive is locked against modification. |
| variable | variable | File headers (type 2) | One block per stored file, each carrying its own CRC-32 of the file contents, packed and unpacked sizes, attributes, modification time and compression information, immediately followed by that file's data area. |
| variable | variable | End of archive header (type 5) | The last block in the file. Its own flag 0x0001 means this volume is not the last one in a multi-volume set, which is exactly how an extractor knows to ask for the next part rather than report a truncated archive. |
Telling it apart from its neighbours
| Easily confused with | How to tell |
|---|---|
| RAR (4.x) | The distinction the two catalog entries exist for, and it is one byte plus one of length. RAR 4.x is the seven-byte 52 61 72 21 1A 07 00; RAR 5.0 is the eight-byte 52 61 72 21 1A 07 01 00. Both spell 'Rar!' then 1A 07, and the seventh byte — 00 versus 01 — decides. Nothing below the signature is shared: the block layouts, the field encodings and the compression are all different, so a reader must branch on that byte before parsing anything. |
| 7-Zip | The other high-ratio Windows archiver, opening 37 7A BC AF 27 1C. They are used interchangeably and their extensions get swapped, but only RAR has recovery records and native multi-volume splitting, and only 7z is free to implement. |
| ZIP | 50 4B 03 04 against 52 61 72 21. WinRAR reads and writes both, so a .rar that is really a ZIP is common; the first four bytes always settle it, and unlike ZIP a RAR keeps no directory at a fixed distance from the end. |
| Self-extracting .exe | The specification allows any data before the signature — the SFX module's size and contents are explicitly undefined — and tells readers to search from the beginning up to the maximum SFX module size, recommending that not exceed one megabyte. So a RAR signature may legitimately appear tens of kilobytes into a file that begins 4D 5A ('MZ'). |
| Multi-volume parts | Every volume of a set carries the same eight-byte signature, so .part1.rar, .part2.rar and the older .r00 files all identify as complete RAR archives. Only the main header's archive flags — bit 0x0001 for volume, 0x0002 for a volume number — and the end-of-archive block's flag distinguish a part from a whole. |
How these files break
- A missing volume in a multi-volume set. The final block is not an end-of-archive header, or its volume flag says more parts follow, so the extractor asks for the next file rather than declaring damage. It is the most common 'broken RAR' report and usually nothing is broken at all.
- Bit rot in an archive that has a recovery record. RAR is one of the very few formats with built-in forward error correction: when the archive was created with a recovery record, the repair command really can reconstruct the damaged sectors in place. Without one, the per-file CRC-32 in each file header detects the damage but nothing can undo it.
- Solid archives amplifying local damage. When the main header's 0x0004 flag is set the files were compressed as one continuous stream, so a bad byte destroys every file after it in the solid group rather than one entry.
- Encrypted headers mistaken for an empty archive. When the block at offset 8 is type 4, the file names themselves are encrypted and nothing can be listed without the password, so tools show an empty tree. The archive is intact and simply refusing to answer.
- Text-mode transfer or prepended bytes. Prepending is legal for self-extracting archives and a reader that scans for the signature copes, but a detector pinned to offset 0 reports the file as unknown, and line-ending translation inside the compressed data leaves the signature and headers perfectly readable while every extracted file fails its CRC.
Where the format stands today
RAR's position is unusual: it is technically strong and permanently niche, because it is proprietary in a way that matters. Only RARLAB may write the format — the unrar decoder is source-available but carries a clause forbidding its use to build a compressor — so it could never become a default the way ZIP did, and no operating system ships a writer for it. What keeps it alive is a genuinely large body of existing archives plus two features nothing common matches: recovery records, which add real forward error correction to an archive, and first-class multi-volume splitting, which is why large downloads were distributed as numbered parts for two decades. For new work almost everything has moved on — ZIP for interchange, 7z when ratio matters on Windows, tar.zst or tar.xz on Unix — and the practical reason to know the format now is that you will still be handed .rar files and need to open them.
Open RAR5 files on this site
Every one of these runs in your browser — the file never leaves your machine.
Related formats
Formats that are easy to confuse with RAR5 — compare their leading bytes.