What is the CMD file format?
A .cmd file is a plain-text Windows NT command script executed by cmd.exe, the Windows Command Prompt interpreter. It is nearly identical to the older .BAT batch file format, with one important behavioral difference: a .cmd file always runs with command extensions enabled, giving access to enhanced IF/FOR syntax, CALL :label sub-routines, %~nx0 path expansions, and reliable ERRORLEVEL handling - without requiring registry configuration.
Introduced in 1993 with Windows NT 3.1 alongside the new cmd.exe interpreter, the .cmd extension was Microsoft's way to distinguish NT-native scripts from legacy DOS .bat files, which ran under COMMAND.COM. Both extensions remain fully supported through Windows 11.
A .cmd script consists of sequential cmd.exe commands, labels (:name), flow-control keywords (GOTO, CALL, IF, FOR), and variable expansions (%VAR%). SETLOCAL/ENDLOCAL blocks isolate environment-variable changes to the script's scope. There are no magic bytes - the file is plain text, typically saved in ANSI/Windows-1252 encoding; UTF-8 works but a byte-order mark (BOM) at the start can break the first command line.
.cmd files are executable: double-clicking one runs all commands immediately. Always inspect an untrusted .cmd file in a text editor before running it. For modern Windows automation, PowerShell scripts (.ps1) are preferred, though .cmd remains essential for legacy systems and lightweight task automation.
Security & safety
RISK: HIGHA .cmd file is EXECUTABLE: double-clicking it runs every command immediately with your user privileges. It can delete or encrypt files, change system settings, download additional malware, disable security tools, or exfiltrate data. It is a standard malware delivery format, often disguised as a "fix", "installer", "optimizer" or "activation crack", and is commonly sent as an email attachment or downloaded from fake support pages. SAFE HANDLING: never double-click an untrusted .cmd file. To inspect it, right-click > Show more options > Edit (opens in Notepad without executing). Look for these red flags: commands that call powershell/curl/bitsadmin/certutil to download files, base64-encoded strings, attempts to disable Windows Defender or UAC, writes to AppData/system folders, or long obfuscated strings of caret (^) escapes. If in doubt, upload the file to VirusTotal (it is a text file, safe to upload) and run it only inside a VM/sandbox. Note: .cmd files from well-known software (Gradle, Maven, Node.js wrappers) are safe but should still come from their official distributions, not third-party downloads.
Format details
in a nutshellPrograms that open CMD files
Windows5 apps
PSPad
Free Programmer's editor with batch syntax highlighting - opens and inspects .cmd for editing. 
Notepad
Open-source Open the .cmd in Notepad++ for syntax-highlighted inspection and editing before running. 
Notepad (to INSPECT - do not double-click)
Built-in Right-click the .cmd file > Show more options > Edit - opens in Notepad so you can READ the commands without executing them. 
Visual Studio Code
Free Open the .cmd as text in VS Code; batch syntax highlighting makes obfuscated or malicious lines easier to spot.
Command Prompt (cmd.exe) - to RUN
Built-in Only when trusted: open a Command Prompt, type the full path to the .cmd file. Running from a prompt keeps the window open so you see output and errors. 
macOS2 apps
Parallels Desktop
Paid Run a Windows VM on Mac, then execute the .cmd inside that Windows environment.
Any text editor (VS Code, TextEdit)
Free macOS can only READ a .cmd file as plain text - it cannot execute Windows cmd.exe commands. Open to inspect; run on Windows (or inside a Windows VM). 
Linux1 app
Any text editor (VS Code, gedit, nano)
Free Linux reads .cmd as text only; cmd.exe batch syntax is not natively executable. Inspect here, run on Windows (Wine's cmd handles simple scripts imperfectly). Technical details
deep spec| Encoding | Text - typically ANSI/Windows-1252 or ASCII; UTF-8 is supported but a BOM at the start can break the first command |
| Container | Plain text |
| Encryption | None (plain text; no built-in code-signing unlike PowerShell .ps1 scripts) |
| Typical size | 100 bytes - 100 KB |
| Structure | Sequential cmd.exe commands, labels (:name), IF/FOR/GOTO/CALL flow control, %VAR% expansions, SETLOCAL/ENDLOCAL blocks |
| Command extensions | Always enabled in .cmd files (unlike .bat, which depends on the EnableExtensions registry setting) |
| Interpreter | cmd.exe (not the legacy COMMAND.COM used for DOS .bat files) |
| Magic bytes | None - plain text; many files begin with @echo off, REM, or :: (comment line) |
| Associated OS | Windows NT 3.1 and all later versions, including Windows 11 |
| Superseded by | PowerShell (.ps1) for modern automation; .cmd and .bat remain fully supported as of Windows 11 |
| Execution behavior | Double-clicking runs all commands immediately; always inspect in a text editor before running untrusted files |
| Released | 1993 with Windows NT 3.1 / OS/2 as the NT-era sibling of the DOS .bat extension |
| Latest version | No versioned spec; behavior defined by the cmd.exe of each Windows release (Windows 11 as of 2026) |
| Specification | learn.microsoft.com |
CMD conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CMD files.
