What is the ASP file format?
Files with the .asp extension store Microsoft Active Server Pages web page source code. An .asp file is plain text and can be opened with any text editor. ASP files can contain:
- HTML markup that forms the web page structure,
- VBScript or JScript code placed inside
<% ... %>delimiters, - Page-level directives such as
<%@ Language="VBScript" %>, plus attribute definitions and instructions.
.asp files are processed server-side by IIS upon a client request. The ASP engine executes the embedded script, then sends the resulting HTML to the browser. In contrast to static HTML pages, which the browser downloads and renders directly, Classic ASP pages must be processed before delivery. The URL may show the .asp extension, but the response body delivered to the browser is always plain HTML. If a request results in the raw .asp source code being downloaded rather than rendered, it is almost always caused by a server misconfiguration.
The first ASP components were developed in 1996, and ASP 2.0 followed a year later. In 2000, Microsoft released ASP 3.0, the final classic version. ASP was the first dynamic web-page technology developed by Microsoft, conceived as an add-on to IIS for Windows NT. The technology is now considered legacy and has been superseded by ASP.NET, introduced in 2002, which uses the .aspx extension. Related application-level configuration is stored in .asa files. Classic ASP pages are no longer actively developed, though a large number of legacy sites and intranet applications continue to run them on modern Windows Server editions, where IIS still ships with Classic ASP available as an optional feature.
Security & safety
RISK: LOWThe .asp extension itself says nothing about safety - when it appears in a URL it is just a normal web page; treat the site as you would any website (watch for phishing on login pages). A downloaded .asp file is typically harmless HTML or a misnamed document, and opening it in a text editor is always safe. Caution only applies if a download you didn't expect arrives as .asp from an untrusted source - inspect it as text before renaming and opening, and never run anything it tries to launch.
Format details
in a nutshellPrograms that open ASP files
Windows4 apps
Visual Studio
Freemium For developers maintaining a Classic ASP site: open the project to edit and debug the .asp source. 
Visual Studio Code
Free Open the .asp as text to read or edit its HTML + VBScript/JScript. Free, cross-platform. 
Web browser (Chrome, Edge, Firefox)
Free Only useful if the .asp is actually a saved HTML page - drag it into the browser to view that HTML. It will NOT run server-side code or fetch live data. 
macOS3 apps
TextEdit / any text editor
Built-in Open the file as plain text (use Format > Make Plain Text). Fine for a quick look at the source.
Web browser (Safari, Chrome)
Built-in Only if the file is a saved HTML page - opens that static HTML, not the live ASP application. 
Linux2 apps
Technical details
deep spec| File nature | Plain-text, server-side script - no binary signature or magic bytes |
| MIME type | text/html |
| Script delimiters | <% ... %> for inline code; <%@ ... %> for page-level directives (e.g. <%@ Language="VBScript" %>) |
| Default scripting language | VBScript; switchable per file to JScript via <%@ Language="JScript" %> |
| Additional scripting engines | Any language with an installed ActiveX Script Engine (e.g. PerlScript via ActivePerl) |
| Web server | Microsoft IIS (Internet Information Services); enabled as an optional Windows Server feature under Application Development |
| Built-in objects | Request, Response, Server, Session, Application, ObjectContext |
| Database access | ADO (ActiveX Data Objects) via COM - typically ADODB.Connection and ADODB.Recordset |
| Application config file | global.asa in the application root - handles Application_OnStart, Application_OnEnd, Session_OnStart and Session_OnEnd events |
| File includes | Server-Side Includes: <!--#include file="path"--> or <!--#include virtual="/path"--> |
| Session management | Built-in Session object; default timeout 20 minutes; session ID transmitted via cookie |
| Error handling | On Error Resume Next with the Err object; custom error pages configurable per-site in IIS Manager |
| Processing model | Script executes on each request; only the generated HTML response is returned to the client browser |
| Current status | Legacy - no new versions since ASP 3.0 (2000); IIS still ships Classic ASP as an opt-in component on Windows Server |
| Released | 1996 (Active Server Pages 1.0, with IIS 3.0) |
| Specification | learn.microsoft.com |
ASP conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about ASP files.
