Microsoft PowerPoint Presentation
PPT is Microsoft PowerPoint's legacy binary presentation format (PowerPoint 97-2003), built on the OLE2 Compound File Binary Format. It stores slides, speaker notes, embedded media, animations, and VBA macros in a proprietary binary container superseded by the XML-based PPTX in Office 2007.
Binary PowerPoint format requires Microsoft's proprietary rendering engine not available in browser WASM.
Common questions
What is the difference between PPT and PPTX?
PPT is a proprietary binary format (OLE2/CFBF) used by PowerPoint 97-2003. PPTX is a ZIP archive of XML files introduced in Office 2007 as an open standard (ECMA-376). PPTX produces smaller files, supports modern features like SmartArt and 3D models, and is the default for all current PowerPoint versions.
Is it safe to open PPT files from unknown sources?
No. PPT files can contain VBA macros that auto-execute malware, embedded OLE objects that run code, and Equation Editor exploits (CVE-2017-11882). Always open untrusted PPT files in Protected View or convert to PDF first via LibreOffice headless.
How do I convert PPT to PPTX without Microsoft Office?
Use LibreOffice from the command line: libreoffice --headless --convert-to pptx input.ppt. This works on Windows, macOS, and Linux without a GUI. Google Slides also converts PPT on upload, then you can download as PPTX.
Why do my PPT slides look different on another computer?
PPT files reference fonts by name. If the target machine lacks the font, the OS substitutes a different one, shifting text layout and line breaks. Converting to PDF embeds fonts and locks the layout for consistent rendering everywhere.
What makes .PPT special
What is a PPT file?
PPT is the older binary file format used by Microsoft PowerPoint from versions 97 through 2003. It stores slides, speaker notes, handouts, and multimedia in a binary compound document format. While superseded by PPTX, PPT files are still encountered in legacy archives and older documents.
Continue reading — full technical deep dive
How to open PPT files
- Microsoft PowerPoint (Windows, macOS) — Full support
- LibreOffice Impress (Windows, macOS, Linux) — Free
- Google Slides (Web) — Import and convert
- Apple Keynote (macOS, iOS) — Import support
Technical specifications
| Property | Value |
|---|---|
| Format | Microsoft Compound Binary (OLE) |
| Max File Size | 2 GB |
| PowerPoint Versions | 97, 2000, XP, 2003 |
| Macro Support | VBA macros |
| Successor | PPTX (Office Open XML) |
Common use cases
- Legacy files: Opening older presentation archives.
- Compatibility: Systems that require pre-2007 format.
- Macro presentations: VBA-enabled slideshows.
- Migration: Converting to modern PPTX format.
.PPT compared to alternatives
| Formats | Criteria | Winner |
|---|---|---|
| .PPT vs .PPTX | File size and openness PPTX is a ZIP archive of XML files, typically 30-60% smaller than equivalent PPT. PPTX is an open standard (ECMA-376); PPT is a proprietary binary format. | PPTX wins |
| .PPT vs .PDF | Presentation fidelity across platforms PDF renders identically on every device. PPT rendering varies based on installed fonts, PowerPoint version, and OS, causing layout shifts in slides. | PDF wins |
| .PPT vs .ODP | Open standard compliance ODP (OpenDocument Presentation) is an ISO-standardized format with full LibreOffice Impress support. PPT is proprietary and even Microsoft has moved to PPTX as the default. | ODP wins |
| .PPT vs .KEY | macOS ecosystem integration Apple Keynote's KEY format offers tighter macOS/iOS integration with iCloud sync and native animations. PPT requires Microsoft Office or compatibility-mode import in Keynote. | KEY wins |
Technical reference
- MIME Type
application/vnd.ms-powerpoint- Magic Bytes
D0 CF 11 E0 A1 B1 1A E1OLE2 header, same as DOC/XLS.- Developer
- Microsoft
- Year Introduced
- 1987
- Open Standard
- No
OLE2 header, same as DOC/XLS.
Binary Structure
PPT files use the OLE2 Compound File Binary Format (CFBF), identical at the container level to DOC and XLS. The file opens with the 512-byte CFBF header containing the magic signature D0 CF 11 E0 A1 B1 1A E1, sector size, FAT/DIFAT chain locations, and first directory sector pointer. Inside the CFBF container, the primary stream is 'PowerPoint Document', which holds a flat sequence of binary records. Each record has an 8-byte header: 4 bits for record version, 12 bits for instance info, 2-byte record type, and 4-byte record length. Key record types include DocumentContainer (root record holding slide dimensions and default text styles), SlideListWithText (contains all text content for slides, organized by SlideAtom references), SlideContainer (one per slide, holding shape tree, animations, and transition data), TextBytesAtom/TextCharsAtom (raw slide text in ASCII or UTF-16), and ExOleObjStg (embedded OLE objects like charts and media). A second stream 'Current User' stores the last-edit position and the offset of the UserEdit record in the PowerPoint Document stream. The UserEdit chain is a linked list of edit snapshots — following it from the Current User offset reveals the most recent version of every persist object.
| Offset | Length | Field | Example | Description |
|---|---|---|---|---|
0x00 | 8 bytes | CFBF Signature | D0 CF 11 E0 A1 B1 1A E1 | OLE2 magic bytes. Identifies CFBF container. Shared by DOC, XLS, PPT, and MSG files. |
0x08 | 16 bytes | CLSID | 00 00 00 00 ... (16x 00) | Class identifier. Typically all zeros for PPT files. |
0x18 | 2 bytes | Minor version | 3E 00 | Minor version of the CFBF specification. |
0x1A | 2 bytes | Major version | 03 00 | 3 = CFBF v3 (512-byte sectors). 4 = CFBF v4 (4096-byte sectors). |
0x1C | 2 bytes | Byte order | FE FF | Always FE FF (little-endian). CFBF does not support big-endian. |
0x1E | 2 bytes | Sector size power | 09 00 | Sector size as power of 2. 9 = 512 bytes (v3). 12 = 4096 bytes (v4). |
0x30 | 4 bytes | First directory sector | 00 00 00 00 | Location of the first directory sector containing stream and storage entries. |
Attack Vectors
- VBA macros — PPT files can contain auto-executing macros that download and run malware on open
- OLE2 embedded objects — ActiveX controls and OLE objects inside PPT can execute arbitrary code when opened
- Equation Editor exploits — CVE-2017-11882 targets the legacy Equation Editor embedded in PPT files, enabling remote code execution without user interaction
- Malicious hyperlinks and action buttons in slides can redirect to phishing or drive-by download sites
Mitigation: FileDex does not open or parse PPT files in the browser. PPT is a reference-only page. Users should open untrusted PPT files in Protected View (Microsoft PowerPoint) or convert to PDF via LibreOffice headless before viewing.