What is the HTA file format?
.hta (HTML Application) is a type of HTML document file that bundles HTML markup, JScript, and VBScript script into a self-contained desktop application for Windows. Unlike .html files, .hta is not run by web browsers - instead, it is executed on the local machine by mshta.exe, the Microsoft HTML Application Host built into Windows. Microsoft introduced the format in 1999 alongside Internet Explorer 5 as a way to build lightweight GUI tools using familiar web technologies, but with full, trusted access to the operating system rather than a browser's sandboxed environment.
The key distinction from ordinary web pages is privilege: an .hta runs with the same permissions as the logged-in user, with unrestricted access to the Windows registry, file system, COM objects, and ActiveX controls. Window appearance - title, icon, border style, and resize behavior - is configured through the Microsoft-specific <HTA:APPLICATION> element placed inside the document <head>. The file is plain text with no binary magic number; it is identified by its .hta extension and that tag.
Potential risks. Using .hta files from unknown sources carries many risks. Although operating systems and antivirus tools employ various techniques to mitigate those risks, many attacks are conducted purely due to user irresponsibility. Many computer viruses and malware use .hta to change entries in the Windows registry, open backdoors for unwanted access, or download further payloads - and modern antivirus scanners routinely flag untrusted .hta files as suspicious. Because mshta.exe is a legitimate Windows binary, attackers frequently abuse it in living-off-the-land techniques to bypass security controls.
Security & safety
RISK: HIGHAn HTA is a FULL-PRIVILEGE Windows program, not a sandboxed web page. Double-clicking an .hta RUNS it via mshta.exe with your user rights - it can read/write files, change the registry, download payloads and launch other programs. mshta.exe is a well-known "living off the land" malware technique and HTAs are a common phishing-attachment vector. Rules: never open an .hta that arrived by email/chat/download unless you wrote it or fully trust it; to inspect one, ALWAYS right-click > Edit (open as text) so it doesn't execute; watch for double extensions like 'invoice.pdf.hta'. Many organisations block .hta and restrict mshta.exe outright. If you received one unexpectedly, treat it as hostile and delete it.
Format details
in a nutshellPrograms that open HTA files
Windows5 apps
Adobe Dreamweaver
Paid A web-design IDE that can edit the HTML/script of an .hta. Overkill for most; Notepad++/VS Code are simpler. 
Notepad
Open-source Open the .hta for syntax-highlighted reading/editing - the safe way to inspect it before deciding whether to run it. 
Microsoft HTML Application Host (mshta.exe)
Built-in To RUN a TRUSTED .hta: double-click it (mshta.exe launches it) or run 'mshta file.hta'. Only do this for files you fully trust - it runs with your full privileges.
Notepad (built-in)
Built-in To READ the code safely WITHOUT running it: right-click the .hta > Edit, or open Notepad first and File > Open the .hta. 
Visual Studio Code
Free Open the file to read/edit the HTML+script with highlighting; good for understanding or maintaining an HTA. 
macOS1 app
Any text editor (TextEdit, VS Code)
Free macOS can only READ an HTA's source - there is no HTA runtime. Open in TextEdit or VS Code to inspect. 
Linux1 app
Any text editor (VS Code / gedit)
Free Linux has no HTA runtime; you can only read the source. Open it in a text editor to see what it does. Technical details
deep spec| Developer | Microsoft |
| Introduced | 1999, with Internet Explorer 5 |
| Execution engine | mshta.exe (Microsoft HTML Application Host), a Windows built-in component |
| Privilege level | Fully trusted - runs outside the browser sandbox with user-level OS privileges |
| Scripting languages | JScript and VBScript |
| Rendering engine | Internet Explorer's Trident (MSHTML) engine |
| MIME type | application/hta |
| File encoding | Plain text (UTF-8 or Windows ANSI); no binary magic bytes |
| Distinguishing marker | <HTA:APPLICATION> element in the document <head>; no fixed byte-level signature |
| Window customization | Title bar text, icon, border style, resize, and scroll behavior set via <HTA:APPLICATION> attributes |
| System access | Full read/write access to Windows registry, file system, COM objects, and ActiveX controls |
| Platform support | Windows only; no native support on macOS or Linux |
| Security classification | Commonly flagged by antivirus as potentially malicious; frequently abused in living-off-the-land attacks via mshta.exe |
| Deployment | Entire application contained in one .hta file; no installer or runtime installation required |
| Released | 1999 (Internet Explorer 5) |
| Specification | en.wikipedia.org |
HTA conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about HTA files.
