RTF File Documentation

Summary

A Rich Text Format File is a portable, lightly formatted document that stores bold, italics, fonts, colours and simple tables as plain-text control words rather than binary data. Microsoft created it in 1987 as a universal interchange format, and almost every word processor opens a .rtf. Its MIME type is application/rtf. Open it in Microsoft Word, the free LibreOffice Writer, Apple TextEdit or Google Docs. On Windows 11, WordPad has been removed, so use one of those.

Technical details

FeatureValue
Full nameRich Text Format Document
File extension.rtf
MIME typeapplication/rtf (also text/rtf)
Format typePlain-text markup document
DeveloperMicrosoft
Introduced1987 (RTF 1.0)
Latest version1.9.1 (2008), specification frozen
Open standardPartial — published spec, Microsoft-controlled
Encoding7-bit ASCII text; non-ASCII escaped as \'hh or \uN
Opening bytes{\rtf1
Markup unitBackslash control words in brace-delimited groups
FormattingFonts, sizes, colours, bold/italic/underline, alignment, simple tables
ImagesEmbedded as hex- or binary-encoded data in a group
MacrosNone — RTF cannot store VBA code
Free editorLibreOffice Writer, Google Docs, Apple TextEdit/Pages
Common exports.pdf, .docx, .doc, .txt, .odt, .html
Related extensions.doc, .docx, .txt, .odt, .wri
Specificationlearn.microsoft.com (RTF 1.9.1)
Structure at a glance

RTF is plain 7-bit ASCII text, not a binary format, so it has no true magic number beyond the literal opening string {\rtf1 (open brace, backslash, rtf, version digit 1) at offset 0. Formatting is expressed as backslash control words such as \b (bold), \i (italic) and \par (new paragraph), grouped inside curly braces { }. Because it is human-readable markup, opening an .rtf in a plain text editor shows the control words directly rather than the formatted document.

What is an RTF file?

An .rtf file is a Rich Text Format Document, a formatted text document that stores its formatting as readable markup instead of binary data. Microsoft introduced RTF in 1987 as a cross-application, cross-platform way to move formatted text between programs. Unlike the binary DOC or the ZIP-and-XML DOCX, an RTF file is plain ASCII text: bold, italics, fonts, colours, paragraph alignment and simple tables are all expressed as backslash commands wrapped in curly braces. Because the whole file is human-readable, almost any program can read, write or even hand-edit it, which is exactly why RTF became the lowest-common-denominator interchange format.

Open an .rtf in a plain text editor and you see the raw markup; open it in a word processor and you see the formatted document. The rest of this article is about that markup: the control words, the brace groups, the header tables and the way characters outside 7-bit ASCII are escaped.

Control words, control symbols and groups

RTF has three building blocks. A control word is a backslash followed by lowercase letters, optionally with a numeric parameter and terminated by a space or any non-alphanumeric character: \b turns bold on, \b0 turns it off, \fs24 sets the font size to 24 half-points (12 point). A control symbol is a backslash followed by a single non-letter, such as \~ for a non-breaking space or \\ for a literal backslash. A group is text and control words enclosed in braces { }; groups nest, and formatting set inside a group is local to that group and reverts when the closing brace is reached.

{\rtf1\ansi\deff0
{\fonttbl{\f0 Times New Roman;}}
This is {\b bold} and {\i italic} text.\par
Back to normal.\par
}

The group scoping is the core mechanic. When a reader hits { it pushes the current formatting state onto a stack; when it hits } it pops that state back. So {\b bold} makes only the word “bold” bold, because the closing brace restores the previous, non-bold state. A backslash that is not followed by a valid control word, and any unmatched brace, is a structural error that can confuse a parser.

The header: \rtf1, character set and version

Every RTF document begins with the same opening: {\rtf1. The outermost brace opens the document group, \rtf declares the format, and the 1 is the RTF version. Immediately after comes a character-set declaration, most often \ansi (Windows-1252), sometimes \mac, \pc or \pca for older code pages. A \ansicpg control word can name the exact code page, and \deff0 sets the default font by index into the font table. This tiny header is enough for a reader to know how to interpret every byte that follows.

The font table and colour table

Before the body, an RTF file declares the resources the text refers to by number. The font table {\fonttbl ...} lists each font once, giving it an index (\f0, \f1) that the body then uses; each entry can note a font family (\froman, \fswiss) and the typeface name. The colour table {\colortbl ...} lists colours as red/green/blue triples, and the body references them by position with \cf (foreground) and \cb or \highlight (background).

{\colortbl ;\red255\green0\blue0;\red0\green0\blue255;}
\cf1 This text is red.\cf2  This text is blue.\cf0  Default again.

The leading semicolon in the colour table is deliberate: it makes colour index 0 the “auto/default” colour, so \cf1 is the first real colour. This indirection through numbered tables keeps the body compact, because a repeated font or colour is a two-character reference rather than a full name each time.

Paragraph and character formatting

Formatting control words split into paragraph-level and character-level. Paragraph properties are set and then applied at the paragraph mark \par: \ql, \qr, \qc, \qj set left, right, centre and justified alignment; \li and \ri set left and right indents in twips (twentieths of a point, so 1440 per inch); \sb and \sa set space before and after. Character properties toggle inline: \b/\b0 bold, \i/\i0 italic, \ul/\ulnone underline, \fs size in half-points, \f font index. The consistent on/off convention (\b sets, \b0 clears) plus group scoping is the whole formatting model.

Character escaping and Unicode

RTF was designed for 7-bit ASCII transport, so any byte above 127 is escaped rather than written raw. A single high byte is written as \'hh, where hh is two hexadecimal digits in the declared code page. Full Unicode arrived later through the \u control word: \uN gives a signed decimal UTF-16 code unit, followed by one or more “replacement” characters that a reader too old to understand \u will show instead. So an em dash might appear as 舒 ?, where a modern reader takes the character 8212 and an old reader falls back to the ?. This escaping is why RTF files stay pure ASCII on disk even when they contain accented or non-Latin text.

Embedded images and OLE objects

Pictures live in a {\pict ...} group. The group names the image type (\wmetafile, \pngblip, \jpegblip) and its dimensions, then stores the image bytes as ASCII hexadecimal, two characters per byte, so the binary image survives inside a text file. OLE objects use {\object ...} with an embedded result. These groups are what let an RTF carry a logo or a screenshot, and they are also, historically, where the format’s security problems lived, because an \objupdate or an embedded object can instruct a reader to fetch or activate external content.

Why RTF has no macros, and where the real risk is

A plain RTF cannot contain a macro. There is no control word for embedded VBA, so unlike a .doc or .docm an RTF cannot carry auto-running code, and that is one reason it is favoured for interchange. The real, documented risk is not in the document’s own content but in the parser that reads it. Maliciously crafted RTF files have repeatedly been used to exploit bugs in Microsoft Word’s RTF reader, using tricks such as malformed embedded OLE objects, remote-template references and \objupdate to trigger memory corruption or fetch a remote payload. That makes RTF a recurring email-attachment attack vector even though the format itself has no scripting. Treat an unexpected .rtf attachment with the same caution as any document: do not open it from untrusted senders, keep Office patched, and consider opening unknown ones in LibreOffice or Google Docs, where Word’s RTF engine is not involved.

Frequently asked questions

Why does my RTF show codes like \rtf1 and \b?

You opened it in a plain text editor such as Notepad, which shows the raw RTF markup rather than rendering it. The backslash sequences are control words: \rtf1 is the format declaration, \b is bold, \par is a paragraph break. Open the file in a word processor (Word, LibreOffice Writer, TextEdit) to see the formatted document instead.

How do I open RTF on Windows 11 now that WordPad is gone?

Microsoft deprecated WordPad in 2023 and removed it from Windows 11 version 24H2, so current Windows has no built-in RTF editor. Use Microsoft Word, the free LibreOffice Writer or WPS Office, or upload the file to Google Docs. All of them open and edit .rtf and can export it to PDF or DOCX.

References