Temporary File

No specification governs the .tmp extension. It is not registered in the IANA media type registry, the Library of Congress Format Description Database, or the UK National Archives PRONOM. The default MIME type application/octet-stream applies by convention because the content is unknown without inspection.

How Windows creates temporary files

The Win32 API function GetTempFileName generates filenames in the pattern <prefix><uuuu>.TMP, where <prefix> is the first three characters of a caller-provided string and <uuuu> is a hexadecimal value. When the caller passes zero for the unique parameter, the function uses the current system time, checks for collisions, and increments until it finds an unused name. It then creates an empty file and returns. Only the lower 16 bits of the hex value are used, limiting any single prefix+directory combination to 65,535 unique filenames.

The companion function GetTempPath resolves the temp directory by checking environment variables in priority order: TMP first, then TEMP, then USERPROFILE, then the Windows directory as a final fallback. The returned path always ends with a backslash. The function does not verify the directory exists or test write permissions — if the first variable points to a nonexistent path, file creation fails downstream.

The typical per-user temp directory on Windows is C:\Users\<name>\AppData\Local\Temp. System-level temp files go to C:\Windows\Temp. Both accumulate orphaned .tmp files over time because GetTempFileName does not auto-delete.

How Unix creates temporary files

POSIX defines two safe approaches. tmpfile() opens a unique temp file in read/write binary mode and deletes it automatically when the file is closed or the process exits. The caller never sees a filename — just a file descriptor. This is the cleanest method when the file does not need to be visible to other processes.

mkstemp() takes a template string ending in six X characters (e.g., /tmp/myapp.XXXXXX), replaces the Xs with a unique string, and creates the file atomically using the O_EXCL flag with permissions 0600 (owner read/write only). The atomic creation eliminates the time-of-check-to-time-of-use (TOCTOU) race condition that plagues the deprecated tmpnam() function. The man page for tmpnam states explicitly: "Never use these functions. Use mkstemp(3) or tmpfile(3) instead."

Linux provides two standard temp directories. /tmp is typically mounted as tmpfs — a RAM-backed filesystem that defaults to 50% of physical memory and loses all contents on reboot. /var/tmp is disk-backed and survives reboots, intended for files that should persist longer but are still temporary. macOS uses $TMPDIR, which points to per-session randomized paths under /var/folders/.

Why .tmp files persist

Four conditions cause accumulation. First, application crashes — the cleanup code never runs, leaving orphaned files. Second, developers who forget to add deletion logic. Third, the API design: GetTempFileName and mkstemp do not auto-delete. Only tmpfile() handles automatic cleanup. Fourth, cleanup services are conservative — Windows Disk Cleanup and Linux systemd-tmpfiles check file age before deleting, and recently-modified files are skipped even if they are orphaned.

On Windows, Storage Sense can be configured to delete temp files older than a threshold (1, 14, 30, or 60 days). On Linux, systemd-tmpfiles-clean.timer runs daily by default, removing files in /tmp that exceed the configured maximum age (typically 10 days). macOS runs periodic maintenance scripts but does not aggressively clean /var/folders/ temp paths.

How to identify what created a .tmp file

Run file -bi mystery.tmp to detect the MIME type from magic bytes. Word autosave files show as application/vnd.openxmlformats-officedocument.wordprocessingml.document. ZIP-based files show application/zip. Plain text scratch files show text/plain. Binary database swap pages show application/octet-stream.

The file's creation timestamp correlated with application activity often reveals the creator. Some applications embed identifiable strings — a hex editor or xxd mystery.tmp | head can reveal embedded application signatures, document titles, or user data.

Safe deletion rules

Close all applications before cleaning the temp directory. A locked file (cannot be deleted) means an application is actively using it — skip it. Files older than 7 days with no process holding a handle are almost certainly safe to remove. Windows Disk Cleanup and systemd-tmpfiles enforce these rules automatically.

Never delete files from /var/tmp or application-specific temp directories without understanding what uses them. Database engines, video editors, and long-running builds may hold files open for hours or days.

Security: race conditions and symlink attacks

The deprecated tmpnam() function generates a filename, then the caller creates the file in a separate step. In the gap between those two operations, an attacker on a shared system can create a symlink at that path, redirecting the application's write to an arbitrary file — including /etc/passwd or other sensitive targets. This is a classic TOCTOU vulnerability.

mkstemp() eliminates this by creating the file atomically with O_EXCL, which fails if the path already exists. Combined with 0600 permissions, the resulting file is readable and writable only by the creating user. Sensitive data written to temp files (session tokens, decrypted content, credentials) still poses a risk if the file survives the process — disk forensics can recover deleted files from non-tmpfs storage.