What is the CGI file format?
The .cgi extension stands for Common Gateway Interface - a standard approach to generate web applications and dynamic content on web pages. The .cgi extension, when applied on a web server, provides an interface between executable programs and the web server that generates the website content. All such programs are called CGIs or CGI scripts.
These files are generally written using a scripting language such as Perl, Python, or shell script, though a .cgi file can equally be a compiled binary (for example, a C program). The extension itself says nothing about the language inside - the shebang line at the very top of the script, such as #!/usr/bin/perl or #!/usr/bin/python3, tells the web server which interpreter to invoke.
A CGI script runs on the server once per incoming HTTP request. It reads request data from environment variables (QUERY_STRING, REQUEST_METHOD, CONTENT_TYPE) and accepts POST body data via stdin, then writes an HTTP response - headers followed by body content - directly to stdout. To function, the file must be placed in a CGI-enabled directory (traditionally /cgi-bin/) and have the executable permission set on the server.
.cgi is an interface standard, not a programming language. Several other file formats share the .cgi extension: .pl, .py, or .sh scripts are often renamed to .cgi so the web server routes them through the CGI mechanism. Because CGI spawns a new process for every request it is slow at scale, and it has largely been superseded by FastCGI, mod_php, WSGI, and modern application servers - though it remains supported on most web servers today.
Security & safety
RISK: MEDIUMReading a .cgi in a text editor is safe - it won't run by being opened. The risk is in EXECUTION on a server: CGI scripts run with the server's privileges and historically are a major web-vulnerability surface (the 2014 Shellshock bug was exploited largely through CGI shell scripts; poorly written CGIs enable command injection, path traversal and arbitrary code execution). Never deploy a downloaded .cgi you don't understand, keep interpreters and the server patched, restrict /cgi-bin/ permissions, and prefer FastCGI/app-server alternatives for new work. Treat unknown CGI source as untrusted code to be reviewed before running.
Format details
in a nutshell- EToys / niche app data using .cgi - A few unrelated applications have reused .cgi for their own data files; on a web server a .cgi is almost always a gateway script.
Programs that open CGI files
Windows3 apps
Notepad
Open-source Open the .cgi to read/edit the source with syntax highlighting (Perl/Python/shell). The right tool to inspect or modify a script. 
Visual Studio Code
Free Open the .cgi for full editing with language extensions, linting and Git; the modern editor for web scripts. 
Apache HTTP Server (to run it)
Open-source To EXECUTE a CGI: place it in a CGI-enabled directory (mod_cgi, /cgi-bin/), ensure the interpreter is installed and the file is executable, then request its URL. 
macOS2 apps
Visual Studio Code
Free Edit the .cgi with language support and run it via a local Apache/Python http server. 
Linux2 apps
The interpreter / web server
Open-source Run directly with its interpreter (perl script.cgi) for testing, or serve it via Apache mod_cgi / a CGI-capable server. Make it executable with chmod +x. Technical details
deep spec| MIME type | application/x-httpd-cgi |
| Alternate MIME types | text/plain, application/octet-stream |
| File encoding | Plain text (ASCII/UTF-8) for scripts; native binary for compiled executables |
| File signature | No fixed magic bytes - text scripts open with a shebang line (#!/usr/bin/perl, #!/usr/bin/python3, #!/bin/sh, etc.); compiled CGI binaries carry the platform executable header (ELF on Linux, MZ on Windows) |
| Execution model | Web server forks a new OS process per HTTP request to run the script or binary; process exits after the response is sent |
| Input mechanism | Request data delivered via environment variables (QUERY_STRING, REQUEST_METHOD, CONTENT_TYPE, HTTP_* headers); POST body passed via stdin |
| Output mechanism | Script writes HTTP response headers (Name: value lines) followed by a blank line and the response body directly to stdout |
| Required deployment | File must reside in a CGI-enabled directory (conventionally /cgi-bin/) with the executable bit set; web server user needs read and execute permission |
| Typical scripting languages | Perl, Python, Bash/shell, Ruby, C (compiled to a native binary) |
| Typical file size | 1 KB - 100 KB for text scripts; larger for compiled binaries |
| Compression | None within the file itself; the HTTP response body may be gzip-compressed separately by the script or server |
| Platform support | Linux, Unix, macOS, Windows - any OS running a CGI-capable web server |
| Common web servers | Apache HTTP Server, Nginx (via FastCGI wrapper), lighttpd, Microsoft IIS |
| Performance characteristic | Slow at scale - each request spawns and destroys a new process; superseded by FastCGI, WSGI, and ASGI for high-traffic deployments |
| Security consideration | Script source is readable on disk; protect with strict file permissions and avoid exposing the CGI directory via a direct URL outside the designated /cgi-bin/ path |
| Released | 1993 (NCSA HTTPd); formalized as CGI/1.1 in RFC 3875 (2004) |
| Latest version | CGI/1.1 (RFC 3875, October 2004) |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
CGI conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CGI files.
