Office Open XML Workbook (Excel)
ZIP-packaged XML spreadsheet container (`[Content_Types].xml` + `xl/workbook.xml`). Frequently misdiagnosed when backend export endpoints fail and save HTML/JSON error pages as `.xlsx`.
Shares `50 4B 03 04` with all ZIP files; true validation requires confirming `xl/workbook.xml` in the Central Directory (and rejecting legacy OLE2 `D0 CF 11 E0` `.xls` or HTML `3C 21 44 4F`).
Drop any .xlsx file (even 100 GB+) to inspect locally
Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded
.xlsx Magic Bytes & Header Offset Map
PKZIP container verified via xl/workbook.xml entry
| Byte Offset | Length | Data Type | Field Name | Engineering Description |
|---|---|---|---|---|
| 0x00 - 0x03 | 4 B | uint32_le | zip_sig | 0x04034B50 PKZIP Local File Header |
| 0x1E+ | var | utf8 | content_types | Typically '[Content_Types].xml' |
.xlsx Security & Polyglot Risk Matrix
Disable XML DTD / external entity resolution (XXE) in server-side XLSX parsers, enforce Zip Bomb decompression limits, and reject `xl/vbaProject.bin` macro blobs.
Read .xlsx Header & Metadata Without Heavy Dependencies
import sys, zipfile
with zipfile.ZipFile(sys.argv[1], "r") as zf:
names = set(zf.namelist())
assert "xl/workbook.xml" in names, "Missing xl/workbook.xml"
print(f"Valid OOXML .xlsx ({len(names)} parts)")Deterministic .xlsx Sample Files & Edge Cases
minimal-sheet.xlsx
Real single-cell workbook written by openpyxl with Content_Types, rels, workbook.xml and sheet1.xml.
curl -fsSL https://fileformat.co/fixtures/v1/xlsx/minimal-sheet.xlsx -o minimal-sheet.xlsx \
&& echo "872a54723dd14451428342c5f097a0c3c7d5097a7d7fb28a86905e0df685a9f7 minimal-sheet.xlsx" | shasum -a 256 -cquarterly-revenue.xlsx
Real openpyxl workbook: 4 quarterly revenue rows with USD floats for tabular import tests.
curl -fsSL https://fileformat.co/fixtures/v1/xlsx/quarterly-revenue.xlsx -o quarterly-revenue.xlsx \
&& echo "d5ab69cbec81720b5a6399b0d77de88308017bad09e0b3919b15c0e4cf8afe3e quarterly-revenue.xlsx" | shasum -a 256 -cspoofed-gateway-error.xlsx
Real-world debugging classic: filename ends .xlsx but bytes are an HTML gateway error page — openpyxl must raise.
curl -fsSL https://fileformat.co/fixtures/v1/xlsx/spoofed-gateway-error.xlsx -o spoofed-gateway-error.xlsx \
&& echo "22cceb2a5564d2877e94960a59b434289c9f4aa0c56e346c0aa9ce8bf361cceb spoofed-gateway-error.xlsx" | shasum -a 256 -cRelated Specifications & Alternatives
Plain-text tabular interchange format notorious for real-world parser edge cases: optional UTF-8 BOMs (`EF BB BF`), multiline quoted cells, doubled quote escapes (`""`), and formula injection.
De-facto standard hybrid columnar storage format for modern data lakes (Iceberg, Delta, DuckDB, Spark), placing Thrift Compact Protocol schema and statistics in the file trailer.
Object-graph document format parsed bottom-up from its trailing `startxref` and `%%EOF` markers—primary battleground for AI RAG table extraction and active `/JavaScript` upload sanitization.