What is the AXD file format?
Files with the .axd extension are used by ASP.NET Web Forms applications running on Microsoft IIS. Unlike most web file types, .axd is not a document stored on disk - it is a virtual URL endpoint mapped in web.config to a built-in IHttpHandler class that generates its response on the fly.
.axd endpoints do not store instructions on client machines; instead, the handler streams embedded assembly resources - scripts, images, and other assets - directly from compiled .dll assemblies to the requesting browser.
By default, .axd resource endpoints are named either WebResource.axd or ScriptResource.axd. Although very similar, each serves a distinct role: WebResource.axd handles general embedded resources such as images and binary assets, while ScriptResource.axd is typically used with the ASP.NET AJAX framework and offers additional features such as script combination and compression. A third built-in endpoint, Trace.axd, displays per-request trace diagnostics for debugging.
Handlers registered through .axd can serve JavaScript files, CSS stylesheets, images, and HTML trace output. .axd endpoints are also commonly used client-side for retrieving image, text, or script files embedded in server-side assemblies. The d= query string parameter used by WebResource.axd is HMAC-signed with the application's machineKey, protecting the endpoint against unauthorized resource enumeration. .axd is a classic ASP.NET Web Forms feature and is not used in ASP.NET Core, which replaces it with static web assets and bundling middleware.
Security & safety
RISK: LOWAn .axd by itself is not a file and not dangerous to "have." Two real points: (1) On the server side, leaving Trace.axd enabled in production can leak request data (headers, session, query values) to anyone who browses to it - it should be disabled in production web.config. (2) WebResource.axd has historically been tied to ASP.NET security advisories (notably the 2010 padding-oracle vulnerability, MS10-070, which abused the encrypted d= token) - keep the .NET Framework patched. For ordinary users, a saved .axd file is just script/image text and is safe to inspect in an editor.
Format details
in a nutshellPrograms that open AXD files
Windows3 apps
Visual Studio
Freemium For developers: open the ASP.NET project; .axd handlers are configured in web.config, not edited as standalone files. Use this to manage/disable them. 
Visual Studio Code / any text editor
Free If you saved an .axd response, open it as text to see what it is (usually JavaScript). Then rename to .js/.css as appropriate.
Web browser (developer tools)
Built-in To see what an .axd returns, open it in the browser or the Network tab - it's served live by the server, not stored locally. Technical details
deep spec| Format type | Virtual server-side HTTP handler endpoint; no file exists on disk - the `.axd` URL is resolved at runtime by a registered IHttpHandler class |
| Handler interface | Implements `System.Web.IHttpHandler` or `IHttpAsyncHandler`; the `ProcessRequest(HttpContext)` method writes the response directly to the HTTP output stream |
| Handler registration | Declared in `<httpHandlers>` (IIS 6 / .NET 2.0) or `<handlers>` (IIS 7+ integrated pipeline) in `web.config` |
| Developer / platform | Microsoft; part of ASP.NET Web Forms on the .NET Framework (introduced 2002); absent from ASP.NET Core |
| Common endpoint names | `WebResource.axd` (general embedded resources), `ScriptResource.axd` (ASP.NET AJAX scripts), `Trace.axd` (request diagnostics) |
| MIME type | Varies by handler response - `application/javascript`, `text/css`, `image/png`, `text/html`, and others; set dynamically per request |
| Resource source | Embedded resources compiled into `.dll` assemblies with build action `EmbeddedResource`; retrieved via `Assembly.GetManifestResourceStream` at request time |
| Security mechanism | `WebResource.axd` `d=` query parameter is HMAC-signed using the application's `machineKey`; invalid signatures return HTTP 400, preventing resource enumeration |
| Caching behavior | Responses carry `Cache-Control: public` and a far-future `Expires` header; IIS output-caching stores repeated responses in memory for performance |
| Compression | IIS can apply HTTP-level gzip or Brotli compression to `.axd` responses in transit; `ScriptResource.axd` also supports server-side script combination |
| Client access method | HTTP GET with an encrypted and HMAC-signed query string (e.g. `?d=<token>&t=<timestamp>`); the browser receives the response as a normal resource |
| `Trace.axd` output | Renders per-request ASP.NET trace data as HTML - timing breakdown, HTTP headers, cookies, form values, server variables, and control tree |
| Superseded by | ASP.NET Core's static web assets pipeline and bundling/minification middleware; no `.axd` handlers exist in ASP.NET Core |
| Released | 2002 (ASP.NET 1.0, .NET Framework) |
| Latest version | ASP.NET Web Forms / Framework 4.8 (classic; not used in ASP.NET Core) |
| Specification | learn.microsoft.com |
AXD conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about AXD files.
