What is the PKG file format?
The .pkg extension is used, among others, within the macOS operating system, developed by Apple. .pkg files contain packages of compressed installer files with the XAR internal format, whose purpose is to install an application on Mac computers. .pkg files are actually XAR archives with a different extension and a strictly defined hierarchy of files: a Table of Contents in XML, a compressed CPIO payload carrying application files, and optional install scripts.
The aim of the XAR project is to create an easily expandable archive format, and this makes .pkg a flexible delivery vehicle for macOS software. While developing the .pkg format, the main aim was to create a mechanism that would facilitate work during the installation process - and this priority has been achieved. Installation and updating using .pkg files can be performed easily through the built-in macOS Installer app or the installer command in Terminal. Installation of software can be performed individually, or along with a pre- or post-install script responsible for such a process.
The current flat .pkg format was introduced in Mac OS X 10.5 Leopard (2007). Modern packages must be signed with an Apple Developer certificate and notarized for distribution outside the Mac App Store.
.pkg files are currently used as listed below:
- as installation packages in Apple systems - both on computers running macOS and on iPhones (distributed via MDM or Apple Configurator)
- by Sony, for installing software and applications on PlayStation 3, PlayStation 4, and PlayStation 5 consoles
- historically by Symbian systems to hold configuration information within installation packages
Related formats include .DMG disk images used for app distribution, .MPKG meta-packages that bundle multiple .pkg installers, and .XIP signed archives used by Xcode.
Security & safety
RISK: MEDIUMA macOS .pkg can run preinstall/postinstall scripts with elevated privileges, so it is more dangerous than a drag-to-Applications app - malware and adware have been distributed as .pkg installers. Only run packages from trusted sources; macOS Gatekeeper warns about unsigned/non-notarized packages, and you should heed that. Inspect anything uncertain with Suspicious Package (it shows the scripts and the signer) before installing.
Format details
in a nutshell- PlayStation Package - Encrypted, console-specific game/DLC/update package for PS3/PS4/PS5/Vita; installs only on the matching console, not a computer.
- Symbian Installer Script (.pkg) - Obsolete text build script used by old Symbian/Nokia SIS packaging.
- Apple Newton Package - Rare, obsolete package format for the discontinued Apple Newton platform (the old DB name for this extension).
Programs that open PKG files
Windows1 app
7-Zip
Open-source Open a macOS .pkg as a XAR archive to extract its contents - you can read files but CANNOT install Mac software on Windows. 
macOS4 apps
Installer (built-in)
Built-in Double-click the .pkg; Apple's Installer app guides you through installation (may ask for your admin password).
Suspicious Package
Free Open the .pkg to inspect every file, script and the signer/notarization BEFORE installing - includes a Quick Look preview.
Pacifist
Paid Open the .pkg to browse and extract individual files/apps without running the full installer.
installer (Terminal)
Built-in Run 'sudo installer -pkg file.pkg -target /' to install from the command line (for scripts/automation). 
Linux1 app
xar / cpio (command line)
Open-source Run 'xar -xf file.pkg' then unpack the Payload (gzip|cpio) to extract files - for inspection only, not installation. Technical details
deep spec| Internal format | XAR (eXtensible ARchive) binary archive |
| Magic bytes | `78 61 72 21` (`xar!`) at file offset 0; identifies a modern flat package - older bundle packages are directories with no single file signature |
| MIME type | `application/x-xar` |
| Table of Contents | XML document stored uncompressed inside the XAR header, indexing every file's checksum, compression method, and metadata |
| Payload format | CPIO archive compressed with gzip, bzip2, or lzma inside the XAR container |
| Bill of Materials | `Bom` file inside the package listing installed paths, file owners, permissions, and sizes |
| Install scripts | `preinstall` and `postinstall` shell scripts executed as root before and after payload installation |
| Code signing | Signed with an Apple Developer ID Installer certificate; signature verified by macOS Gatekeeper on launch |
| Notarization | Apple notarization required for packages distributed outside the Mac App Store on macOS 10.15 and later |
| Package variants | Flat `.pkg` is a single XAR file; legacy bundle `.pkg` (pre-10.5) is a directory structure - both share the same extension |
| Command-line install | `sudo installer -pkg file.pkg -target /` |
| Extraction without install | `xar -xf file.pkg` unpacks the archive to the current directory without running install scripts |
| Distribution XML | Optional `Distribution` file at the root of a product archive controls multi-choice or multi-package installs with embedded JavaScript logic |
| Component vs. product archive | A `.pkg` may be a simple component package or a product archive bundling multiple component packages into one installer |
| Released | macOS flat .pkg (XAR-based) since Mac OS X 10.5 Leopard (2007); earlier bundle .pkg since NeXTSTEP/Mac OS X 10.0 |
| Open standard | Yes · royalty-free |
| Specification | github.com |
PKG conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about PKG files.
