What is the APPLICATION file format?
A .application file is a ClickOnce Deployment Manifest - an XML text document that Microsoft's ClickOnce technology uses to describe, distribute, and silently update Windows desktop applications served from a web server or network share.
When a user opens a .application file, the ClickOnce runtime (dfshim.dll) reads the manifest, contacts the publisher's download URL, fetches or updates the application files into a per-user cache under %LocalAppData%\Apps, then launches the real .exe. No administrator rights or traditional installer are required.
The manifest is UTF-8-encoded XML, typically 2-20 KB. Its root element is <asmv1:assembly>, governed by the urn:schemas-microsoft-com:asm.v2 schema. Key child elements include:
<assemblyIdentity>- names the application, version, processor architecture, and public key token<deployment>- specifies the update check URL and whether updates run before or after launch<dependentAssembly>- references the companion.manifest(.exe.manifest) that lists every file in the package with its hash
The file has no binary header; it opens as plain text beginning with a standard <?xml?> declaration.
Nearly all published .application files are digitally signed. The ClickOnce runtime enforces an XML-DSIG hash over the manifest body and an optional Authenticode publisher certificate, refusing deployment if either check fails. Signing is handled by Visual Studio's Publish wizard or the mage.exe / mageui.exe SDK tools.
ClickOnce remains supported through .NET 8 and later, though MSIX is now Microsoft's recommended packaging format for new desktop projects.
Security & safety
RISK: MEDIUMThe .application file itself is harmless XML and cannot execute on its own, but it is a launcher that downloads and runs a program from a URL - so the real risk is what it points to. ClickOnce historically let publishers deploy apps with relatively low user friction, which attackers have abused (a wave of malware in 2023-2024 used ClickOnce .application links to silently install payloads from attacker servers). Only run a .application from a publisher you trust, check the signature/publisher prompt, and be suspicious of one received by email or from an unfamiliar web page. Inspect the deployment URL in the XML if unsure. Never assume a .application is safe just because it is "only XML."
Format details
in a nutshellPrograms that open APPLICATION files
Windows3 apps
Visual Studio
Freemium Developer tool: generate/sign/edit ClickOnce manifests (Publish wizard) or open MyApp.application via mage.exe to inspect it. Not what end-users use to launch. 
ClickOnce runtime (Windows / .NET)
Built-in Double-click the .application; the .NET ClickOnce runtime downloads and launches the real app. This is the only way it 'runs'. Requires .NET installed and the publisher's server online.
Notepad++ / VS Code (inspect only)
Open-source Open the .application as XML to read the deployment URL, version and dependencies. Read-only; editing breaks the signature. Technical details
deep spec| Format type | XML deployment manifest (UTF-8 plain text, no binary header) |
| MIME type | application/x-ms-application |
| Root XML element | <asmv1:assembly> using the asm.v1 and asm.v2 Microsoft assembly namespaces |
| XML schema namespace | urn:schemas-microsoft-com:asm.v2 |
| Typical file size | 2 KB - 20 KB |
| Digital signature | XML-DSIG SHA-256 hash over manifest body, plus optional Authenticode publisher certificate |
| Signature enforcement | ClickOnce runtime rejects deployment if the manifest hash or publisher certificate fails validation |
| Runtime handler | dfshim.dll (Desktop Framework Shim); PresentationHost.exe for WPF-based apps |
| Per-user install cache | %LocalAppData%\Apps\2.0\ - no administrator rights required |
| Key XML elements | <assemblyIdentity>, <deployment>, <dependentAssembly>, <Signature> |
| Companion file | .exe.manifest (application manifest) listing all package files with their cryptographic hashes |
| Update policy declaration | <deployment> element with install attribute and beforeApplicationStartup / afterApplicationStartup update check mode |
| Authoring tools | Visual Studio Publish wizard, mage.exe, mageui.exe (.NET SDK command-line tools) |
| Associated platform | Windows only - ClickOnce runtime is not available on macOS or Linux |
| Encoding | UTF-8 XML text; opens in any text editor; standard <?xml?> declaration at offset 0 |
| Released | 2005 (.NET Framework 2.0 / Visual Studio 2005) |
| Latest version | ClickOnce for .NET 5+/.NET 8 (2020-2024); schema urn:schemas-microsoft-com:asm.v2 |
| Specification | learn.microsoft.com |
APPLICATION conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about APPLICATION files.
