RAR File Documentation

Summary

A RAR (Roshal ARchive) file is a compressed archive that bundles one or more files into a single container, often split into parts or password-protected. It was created by Eugene Roshal in 1993 and its MIME type is application/vnd.rar. RAR is proprietary: the decompressor is public, so many tools extract a .rar, but only RARLAB’s WinRAR can create one. Free extractors include 7-Zip, Keka and unrar.

Technical details

FeatureValue
Full nameRAR Archive (Roshal ARchive)
File extension.rar
MIME typeapplication/vnd.rar
Format typeProprietary compressed archive container
DeveloperEugene Roshal; published by win.rar GmbH (RARLAB)
Introduced1993 (RAR 1.0); RAR4 ~2002; RAR5 in 2013 (WinRAR 5.0)
Open standardNo — extraction public, compression proprietary
Byte orderLittle-endian
CompressionProprietary LZ + prediction; RAR5 adds a larger dictionary
Solid archivesYes — files treated as one stream for higher ratio
EncryptionAES-128 (RAR4), AES-256 (RAR5); optional header/name encryption
Recovery recordOptional redundancy to repair damage; recovery volumes (.rev)
Multi-volumeYes — .partN.rar (RAR5) or .rar/.r00/.r01 (RAR4)
Magic number (RAR5)52 61 72 21 1A 07 01 00
Magic number (RAR4)52 61 72 21 1A 07 00
Creates .rarWinRAR / RARLAB RAR only
Extracts .rar7-Zip, PeaZip, Keka, The Unarchiver, unrar, unar
Related extensions.r00, .r01, .rev, .cbr, .001, .zip, .7z
Specificationrarlab.com/technote.htm
File signature (magic bytes)
52 61 72 21 1A 07 01 00

Offset 0. The first six bytes spell Rar! followed by 1A 07. The next byte is the version marker: 01 00 is RAR5 (the 8-byte signature shown above, used since 2013), while a single 00 gives the 7-byte RAR4 signature 52 61 72 21 1A 07 00. A reader checks this byte to choose which block format to parse. All multi-byte fields are little-endian.

What is a RAR file?

RAR stands for Roshal ARchive, after its author, the Russian developer Eugene Roshal, who released the first version in 1993. A .rar file is a compressed archive: a single container that bundles one or more files and folders together and shrinks them. The compressor is WinRAR, published by win.rar GmbH (RARLAB). Like a ZIP, RAR packs many files into one, but it adds features ZIP lacks: usually higher compression, strong AES encryption, recovery records that can repair a damaged archive, solid compression, and easy splitting into multi-volume parts. Its MIME type is application/vnd.rar.

RAR is a closed format, and that shapes everything about how it is used. The decompression algorithm is documented and RARLAB ships a free extractor, so many tools can open a .rar. The compression algorithm is proprietary, so only RARLAB’s own WinRAR and RAR can create one. There have been two main generations: the older RAR4 and the current RAR5 (introduced with WinRAR 5.0 in 2013), which use different signatures and block layouts. The sections below describe the on-disk structure, the block types, and the features that distinguish RAR from a plain ZIP.

The signature and how RAR4 and RAR5 differ

A RAR archive opens with a fixed marker. The first six bytes are always the ASCII string Rar! followed by 1A 07 (hex 52 61 72 21 1A 07). The very next byte selects the generation:

52 61 72 21 1A 07 00        RAR4  (7-byte signature)   "Rar!" 1A 07 00
52 61 72 21 1A 07 01 00     RAR5  (8-byte signature)   "Rar!" 1A 07 01 00

A reader inspects that byte before parsing anything else, because the two generations use incompatible block layouts. RAR4 and RAR5 also differ in capability: RAR5 raised the maximum dictionary size, moved to AES-256 for encryption, and reworked the header format to be more extensible. All integer fields are stored little-endian. RAR5 additionally uses variable-length integers (a base-128 “vint” encoding) for many size fields so small values cost few bytes.

The block structure: marker, headers, data and end block

A RAR archive is a sequence of blocks, each with a header that records its type, size and flags, so a parser can walk the file block by block and skip what it does not need. The overall order is fixed:

[ marker block ]        the "Rar!" signature identifying the version
[ archive header ]      archive-wide flags: solid, volume, encryption, recovery
[ file header ]  ─┐     name, sizes, CRC, timestamps, method for one file
[ file data     ] │     the compressed bytes for that file
[ file header ]  ─┤     ... one header+data pair per stored file ...
[ file data     ] │
[ recovery record ]     optional redundancy for repair (if present)
[ end block ]    ─┘     marks end of archive; flags continuation for volumes

The archive header (called the main header) carries flags that apply to the whole archive: whether it is solid, whether it is one volume of a set, whether headers are encrypted, and whether a recovery record is present. Each stored file then contributes a file header followed by its compressed data. The file header records the file name (UTF-8 in RAR5), the uncompressed and packed sizes, a CRC-32 of the original data for integrity checking, the modification time, OS attributes, and the compression method and dictionary size used. The archive closes with an end-of-archive block, which for a multi-volume set also flags that the archive continues in the next volume. In RAR5 every block header itself begins with a CRC-32 so that header corruption is detectable, not just data corruption.

Proprietary compression and solid archives

RAR’s compression is a proprietary blend: an LZ-style dictionary matcher (finding repeated byte sequences and replacing them with references) combined with predictive modelling and entropy coding, plus special filters for certain data types such as executables, audio and delta-friendly tables. The exact algorithm is not published, which is the technical reason no third-party tool can produce a RAR: reproducing the compressor bit-for-bit would require the closed source. RAR5 enlarged the maximum dictionary (up to 1 GB), which lets it find matches across far greater distances and so compress large, repetitive data sets more tightly than RAR4.

A solid archive is a key RAR option. Normally each file is compressed independently. In a solid archive the files are concatenated and compressed as a single continuous stream, so the compressor can reuse matches from earlier files when packing later ones. This raises the compression ratio substantially when an archive holds many similar files (source trees, many small documents). The trade-off is random access: to extract one file near the end of a solid archive, the decompressor must process everything before it, because the shared dictionary state is built up sequentially. Solid compression is flagged in the archive header.

The recovery record and recovery volumes

One feature that sets RAR apart from ZIP and 7Z is built-in error recovery. A recovery record is optional redundancy data, added at creation time, that stores error-correction information about the archive’s contents. If part of the archive is later damaged, WinRAR’s repair function can use the recovery record to reconstruct the corrupted bytes, up to the amount of protection the record provides. The record is stored as its own block near the end of the archive.

For multi-volume sets there is a stronger companion: recovery volumes, separate files with the .rev extension. Recovery volumes apply error-correction across the whole set of volumes, so if some volumes of a split archive are entirely lost, an equal number of .rev files can regenerate the missing volumes. This is why RAR became popular for distributing large data over unreliable transfers, where ZIP would simply fail on a single bad byte.

AES encryption and header encryption

RAR supports strong, password-based encryption of the file data. RAR4 uses AES-128; RAR5 uses AES-256, with the key derived from the password through a slow key-derivation function (PBKDF2 with a high iteration count in RAR5) to resist brute forcing. Two levels of protection exist. In the default mode the file contents are encrypted but the file names remain visible in the headers, so someone can list the archive without the password. With header encryption enabled (WinRAR’s “encrypt file names” option), the block headers themselves are encrypted, so even the list of file names and sizes is hidden and the whole archive appears as opaque ciphertext until the password is supplied.

Multi-volume archives

RAR can split a large archive across several files, each a volume. In RAR5 the volumes are named archive.part1.rar, archive.part2.rar, and so on. The older RAR4 scheme names the first volume archive.rar and the continuations archive.r00, archive.r01, in sequence. Each volume is a self-contained block stream whose end block flags that the archive continues; a file’s compressed data can span the boundary from one volume into the next. To extract, all volumes must be present in the same folder and you open the first one; the extractor pulls in the rest automatically. If any volume is missing, extraction stops at the gap unless recovery volumes can fill it. Comic-book archives use the same container under the .cbr name.

Security: malicious archives, path traversal and the ACE history

The RAR format itself is passive data, but archives are a well-worn malware delivery mechanism, and a few attack surfaces are specific enough to name.

Content concealment. An archive hides the real types of the files inside it until extraction, so a .rar attachment can smuggle an executable or script past filters that only look at the outer file. AES-encrypted, password-protected RARs make this worse: because the contents cannot be scanned without the password, attackers ship a password-protected archive with the password in the email body specifically to blind antivirus engines. Treat an unsolicited password-protected RAR with suspicion, and scan extracted contents before running anything.

Path traversal (“zip-slip”). Each file header stores a path. A malicious archive can store a path containing ../ sequences (or an absolute path) so that a naive extractor writes the file outside the intended output folder, overwriting a system or startup file. Well-behaved extractors sanitise stored paths; the vulnerability arises when they do not.

The ACE/CVE history. For years WinRAR could also open the old ACE archive format through a bundled third-party library, unacev2.dll. In 2019 a path-traversal flaw in that library, CVE-2018-20250, let a crafted ACE file (renamed to .rar) write an executable into the Windows Startup folder, achieving code execution on extraction. WinRAR responded by dropping ACE support entirely. The episode is a reminder that the risk in an archiver is often in its parsing code, not the compression, so keeping the extractor updated matters. Self-extracting RAR files (SFX) are executables by design and run code when launched, so open them only from sources you trust.

Frequently asked questions

Why can free tools open a RAR but not create one?

Because RAR is a closed format. RARLAB documents and freely licenses the decompressor, so 7-Zip, Keka, unrar and others can extract a .rar, but the compressor is proprietary and unpublished, so only WinRAR and RARLAB’s RAR tool can produce one. If you do not specifically need RAR, compress to ZIP or 7Z instead, both of which free tools can create.

How do I extract a split archive (.part1.rar or .r00 / .r01)?

Put every part in the same folder and open the first one (.part1.rar, or the plain .rar for the old .r00 scheme). The extractor reads the end block of each volume and pulls in the next automatically. If any volume is missing the extraction fails at that point, unless the set includes .rev recovery volumes that can regenerate the gap.

My RAR says it is corrupt — can it be repaired?

If the archive was created with a recovery record, WinRAR’s Repair function can reconstruct the damaged bytes up to the amount of redundancy stored. For a multi-volume set with .rev recovery volumes, an equal number of lost volumes can be rebuilt. Without either, a genuinely damaged archive usually has to be re-downloaded.

References