What is the NULL file format?
Files with the .null extension do not belong to a single defined format - the extension acts as a generic placeholder or error artifact used by various programs and scripts. Some Windows programs use .null for empty or corrupted/damaged files to mark "no data" or reserve a filename. Files with the .null extension can also be produced by ransomware (notably the STOP/Djvu family) for encrypted files, replacing the original extension with .null; these files are not recoverable simply by renaming.
Three situations account for most .null files you will encounter:
- An empty zero-byte placeholder created by a program or script to flag a state or reserve a path.
- A mislabeled file whose extension was incorrectly set to
.nullby a bug or misconfiguration - the actual content may be an image, a DAT file, a TMP file, or any other format. - A file encrypted by STOP/Djvu ransomware, which appends
.nullto targeted files using AES-128-CBC encryption; decryption requires an official decryptor, not a rename.
If a .null file cannot be opened by the expected application, inspect its contents in Notepad or any plain-text editor, which can open simple text-based variants. Examining the file in a hex editor - such as HxD or Hex Fiend - or running the file command on Linux/macOS reveals the first bytes (the header section), which may contain useful information about the original file type. Tools such as TrID and FileAlyzer can also suggest the real format hidden under the .null extension.
Security & safety
RISK: MEDIUMThe .null extension itself is inert, but it is a known RANSOMWARE marker: the STOP/Djvu family appends .null to files it encrypts (AES-256), so a sudden crop of .null files plus a ransom note means an active infection - disconnect the machine, don't pay, run reputable anti-malware, and check for a free decryptor (e.g. Emsisoft's STOP/Djvu tool) or restore from clean backups. For benign cases the risk is low: an empty placeholder is harmless, and a mislabeled file is only as risky as its true type once renamed (so identify it before opening - a mislabeled executable renamed and run could be malware). Never blindly rename a .null to .exe; inspect its bytes first.
Format details
in a nutshell- STOP/Djvu '.null' ransomware-encrypted file - A variant of the STOP/Djvu ransomware (active since ~2017) appends .null to victims' files after AES-256 encryption; these cannot be opened by renaming and require ransomware recovery, not a viewer.
- /dev/null redirect artifact (Unix) - On Unix-like systems 'null' is the bit-bucket device; a literal file called 'null' is sometimes created by accident (e.g. a mistyped redirect) and is just whatever was written to it.
Programs that open NULL files
Windows3 apps
FileAlyzer
Free Open the .null to inspect its header, size and properties and identify whether it's empty, mislabeled, or encrypted. (db's listed tool - it's an analyzer, the correct approach.)
TrID
Free Run TrID on the .null to auto-detect the underlying file type from its bytes, so you know what to rename it to.
HxD (hex editor)
Free Open the .null in a hex editor and read the first bytes; match them to a known signature to find the real format, then rename the file accordingly. 
macOS2 apps
Hex Fiend
Open-source Open the .null to inspect its bytes; identify the real format from the header and rename it, or confirm it's empty.
file (Terminal)
Built-in Run 'file yourfile.null' to have macOS guess the real type from the content, then rename accordingly. 
Linux1 app
file command
Open-source Run 'file yourfile.null' to detect the true type from magic bytes; rename to the reported extension to open it. Technical details
deep spec| Format category | Generic placeholder / error artifact - not a designed file format |
| File identification | First bytes reveal the true origin: original format header (mislabeled file), empty content (placeholder), or encrypted data (ransomware) |
| Typical file size | Zero bytes when used as a placeholder; arbitrary size when a real file was mislabeled or encrypted |
| MIME type | application/octet-stream - no registered or dedicated MIME type exists for .null |
| Content encoding | Fully dependent on origin: plain text, binary, or AES-128-CBC encrypted data in the ransomware variant |
| Header structure | Inherited from the original format in mislabeled files; absent entirely in zero-byte placeholder files |
| Ransomware association | STOP/Djvu ransomware appends .null to targeted files encrypted with AES-128-CBC; renaming does not restore them |
| Identification method | Run `file filename.null` on Linux/macOS or open in a hex editor to read the first 8-16 bytes |
| Recovery approach | Rename to the correct extension if mislabeled; use an official STOP/Djvu decryptor if ransomware-encrypted |
| Platform origin | Cross-platform - produced by scripts and programs on Windows, macOS, and Linux |
| Common producers | Build scripts, package managers, CI pipelines, and software installers that create flag or lock files |
| Zero-byte usage | A zero-byte .null acts as a flag file: its presence signals a state to the OS or script, not its content |
| Related placeholder roles | Functionally similar to .tmp, .bak, and .000 files used as transient or leftover artifacts |
| Detection tools | TrID and FileAlyzer (Windows), Hex Fiend (macOS), and the `file` command (Linux/macOS) |
| Released | N/A - '.null' is used ad hoc by programs/scripts, not a designed format |
NULL conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about NULL files.
