RAR Archive
RAR is a proprietary archive format created by Eugene Roshal in 1993, offering high compression via PPMd/LZSS, AES-256 encryption, solid compression, and error recovery records. Two versions exist: RAR4 (52 61 72 21 1A 07 00) and RAR5 (52 61 72 21 1A 07 01 00).
RAR uses proprietary compression algorithms. Decompression requires unrar library not available in browser WASM.
Common questions
What is the difference between RAR4 and RAR5?
RAR5 (released 2013) uses AES-256 encryption (vs. AES-128 in RAR4), supports dictionary sizes up to 4 GB (vs. 4 MB), uses variable-length integer encoding for smaller headers, and improves error recovery. RAR5 archives are not backward-compatible with older unrar versions.
Is RAR better than ZIP for compression?
RAR typically produces archives 10-30% smaller than ZIP with Deflate, especially with solid compression enabled. However, 7z with LZMA2 often matches or exceeds RAR compression while being fully open-source. ZIP's advantage is universal OS-level support.
Can I extract RAR files without WinRAR?
Yes. 7-Zip (free, open-source) extracts RAR v4 and v5 on Windows. On macOS, use The Unarchiver. On Linux, install unrar or p7zip from your package manager. Windows 11 also added native RAR extraction in 2023.
Are RAR files safe to open?
RAR files themselves are data containers, but they can carry malware inside. CVE-2018-20250 demonstrated a path traversal attack that persisted in WinRAR for 19 years. Always keep your extraction tool updated, scan contents with antivirus, and never run self-extracting RAR (SFX) archives from untrusted sources.
What makes .RAR special
What is a RAR file?
RAR (Roshal Archive) is a proprietary archive format created by Eugene Roshal. It typically achieves better compression ratios than ZIP and includes features like solid compression, error recovery records, and multi-volume archives.
Continue reading — full technical deep dive
How to open RAR files
- WinRAR (Windows) — Native support
- 7-Zip (Windows) — Free, open-source
- The Unarchiver (macOS) — Free
- PeaZip (Windows, Linux) — Free, open-source
- unrar (Linux) — Command-line tool
Technical specifications
| Property | Value |
|---|---|
| Compression | RAR proprietary algorithm |
| Encryption | AES-256 |
| Recovery | Error recovery records |
| Solid | Solid compression mode |
| Multi-volume | Split archive support |
Programs that open RAR files
- WinRAR — Official RAR tool
- 7-Zip — Free alternative (extract only)
- The Unarchiver — Free macOS extractor
- PeaZip — Free cross-platform archiver
Common use cases
- File sharing: Better compression for large files
- Game mods: Common format for game modifications
- Software distribution: Split archives for download
.RAR compared to alternatives
| Formats | Criteria | Winner |
|---|---|---|
| .RAR vs .ZIP | Compression ratio RAR's solid compression and PPMd algorithm typically produce archives 10-30% smaller than ZIP with Deflate. ZIP's advantage is universal OS-level support without third-party software. | RAR wins |
| .RAR vs .7Z | Compression ratio and openness 7z with LZMA2 matches or exceeds RAR compression in most scenarios, and the format is fully open-source with no licensing restrictions. RAR creation requires a WinRAR license. | 7Z wins |
| .RAR vs .ZIP | Error recovery RAR supports built-in recovery records that can reconstruct damaged sections of an archive. ZIP has no native error recovery mechanism — a single corrupted byte can make the archive unextractable. | RAR wins |
| .RAR vs .TAR.GZ | Platform support TAR.GZ is natively supported by every Unix/Linux distribution and macOS. RAR extraction requires WinRAR, unrar, or 7-Zip — none are pre-installed on standard Unix systems. | TAR.GZ wins |
Technical reference
- MIME Type
application/vnd.rar- Magic Bytes
52 61 72 21 1A 07Rar! signature. RAR5 adds 01 00 after.- Developer
- Alexander Roshal (RARLAB)
- Year Introduced
- 1993
- Open Standard
- No
Rar! signature. RAR5 adds 01 00 after.
Binary Structure
RAR archives begin with a version-specific signature block. RAR4 files start with the 7-byte signature 52 61 72 21 1A 07 00 (ASCII 'Rar!' followed by 1A 07 00). RAR5 files use an 8-byte signature: 52 61 72 21 1A 07 01 00 (the extra 01 byte distinguishes v5). After the signature, the archive contains a sequence of header blocks. In RAR4, each header has a fixed structure: 2-byte CRC16 of header data, 1-byte header type (0x72=marker, 0x73=archive, 0x74=file, 0x75=comment, 0x76=extra info, 0x77=subblock, 0x78=recovery, 0x7B=end), 2-byte flags, and 2-byte header size. The archive header (0x73) stores global flags: solid archive, volume (split), recovery record presence, encrypted filenames, and new-format numbering. File headers (0x74) contain the compressed size, uncompressed size, host OS identifier, CRC32 of uncompressed data, timestamp, compression method/version, filename length, and file attributes. Compressed data follows immediately after each file header. RAR5 restructured the header format to use variable-length integers (vint encoding): each header starts with a CRC32 (4 bytes), header size (vint), header type (vint), and header flags (vint). RAR5 header types differ from RAR4: 1=main archive, 2=file, 3=service, 4=encryption, 5=end-of-archive. RAR5 uses a modified LZSS dictionary up to 4 GB (vs. 4 MB max in RAR4) and supports AES-256 in CBC mode with PBKDF2-HMAC-SHA256 key derivation.
| Offset | Length | Field | Example | Description |
|---|---|---|---|---|
0x00 | 7 bytes (RAR4) / 8 bytes (RAR5) | Signature | 52 61 72 21 1A 07 00 | RAR4: 'Rar!\x1a\x07\x00'. RAR5: 'Rar!\x1a\x07\x01\x00'. The 7th/8th byte distinguishes format version. |
0x07 (RAR4) | 2 bytes | Header CRC16 | CF 90 | CRC16 of the archive header data. Used to detect header corruption before parsing. |
0x09 (RAR4) | 1 byte | Header type | 73 | 0x73 = archive header. Contains global archive flags like solid mode and volume status. |
0x0A (RAR4) | 2 bytes | Archive flags | 00 01 | Bit flags: 0x0001=volume, 0x0002=comment, 0x0004=locked, 0x0008=solid, 0x0010=new naming, 0x0020=authentication, 0x0040=recovery, 0x0080=encrypted headers. |
File header + 0x07 | 4 bytes | Compressed size | varies | Size of compressed data following this file header. Used to locate the next header. |
File header + 0x0B | 4 bytes | Uncompressed size | varies | Original file size before compression. Combined with CRC32 for integrity verification. |
File header + 0x13 | 4 bytes | CRC32 | varies | CRC32 checksum of the uncompressed file data. Verified after extraction. |
Attack Vectors
- Path traversal — CVE-2018-20250 exploited WinRAR's ACE format handling to write files outside the extraction directory, used by APT groups for targeted attacks
- Encrypted archives hiding malware — password-protected RAR files bypass antivirus scanners that cannot decrypt the contents for inspection
- Executable payloads — RAR self-extracting archives (SFX) are Windows executables that run code on double-click, commonly used in malware distribution
- Social engineering via split volumes — multi-part RAR archives force users to download all parts from potentially malicious sources
- Filename spoofing — Unicode right-to-left override characters in archived filenames can disguise executable extensions (e.g., making .exe appear as .doc)
Mitigation: FileDex does not open or parse RAR files in the browser. RAR is a reference-only page. Extract untrusted RAR files in a sandboxed environment. Keep WinRAR and 7-Zip updated to patch path traversal and parsing vulnerabilities. Never run SFX archives from untrusted sources.