What is the RPM file format?
Files with the .rpm extension are package files used on Linux-based operating systems. Originally the .rpm format was developed by Red Hat for its own Linux distribution, but today it is widely used across Fedora, RHEL, CentOS, openSUSE, Mageia, and many other distributions.
An .rpm file is a software package that contains everything needed to install a specific application on a compatible Linux system. RPM originally stood for Red Hat Package Manager; the project is now maintained by the open-source community at RPM.org and the command-line tool is simply called rpm. The format was designed to make the installation and distribution of Linux applications straightforward, so the end user does not have to manage individual files required for installation.
Internally, an .rpm has a binary structure made up of a lead section, a GPG signature header, a tagged metadata header, and a compressed .cpio payload holding the actual files. Modern packages compress that payload with XZ/LZMA; gzip, bzip2, and Zstd are also supported. Packages are installed via dnf (Fedora/RHEL) or zypper (openSUSE), which resolve dependencies automatically. A .src.rpm variant carries source code and build instructions instead of ready-to-run binaries. On Windows or macOS, tools like 7-Zip can extract .rpm contents for inspection, though install scripts cannot run outside a native RPM-based Linux system. The closest equivalent on Debian-based systems is the .deb format.
Security & safety
RISK: MEDIUMRPM packages run install/uninstall scripts as root, so a malicious .rpm can fully compromise a system. Only install RPMs from trusted vendors/repositories, and verify the GPG signature first: rpm --checksig package.rpm (and import the vendor's key). Distros warn before installing unsigned packages. On Windows/macOS an .rpm can't run, so inspecting it there is harmless. Avoid random 'rpm to exe' or 'rpm opener' sites - they're misleading (RPMs don't run on Windows) and often bundle adware.
Format details
in a nutshellPrograms that open RPM files
Windows2 apps
7-Zip
Open-source Right-click → 7-Zip → Open archive to inspect/extract the cpio payload. Cannot install - Windows can't run Linux packages. 
macOS2 apps
The Unarchiver
Free Extract the .rpm payload to inspect its files on macOS; cannot install the package. 
Homebrew rpm2cpio
Open-source rpm2cpio package.rpm | cpio -idmv to extract files from the package on macOS for inspection. 
Linux5 apps
Alien
Open-source On Debian/Ubuntu: sudo alien -i package.rpm converts and installs as .deb. Use with care - native .deb is preferred.
dnf / DNF (Fedora, RHEL, CentOS Stream)
Open-source sudo dnf install ./package.rpm - installs the package and resolves dependencies automatically. Preferred over raw rpm.
zypper (openSUSE / SUSE)
Open-source sudo zypper install ./package.rpm - installs with dependency resolution on SUSE systems.
rpm (Red Hat Package Manager)
Open-source Low-level tool: sudo rpm -ivh package.rpm to install, rpm -qlp to list files, rpm --checksig to verify. Won't auto-resolve deps.
GNOME Software / Discover
Open-source Double-click the .rpm in the file manager to install via the graphical software center (on RPM distros). Technical details
deep spec| MIME type | application/x-rpm (also accepted: application/x-redhat-package-manager) |
| File magic bytes | ED AB EE DB at offset 0 - the "edabeedb" RPM lead signature |
| Internal structure | Lead section → GPG signature header → tagged metadata header → compressed cpio payload |
| Payload compression | XZ/LZMA (modern default on Fedora/RHEL), gzip, bzip2, or Zstd; selectable per package build |
| Header byte order | Big-endian; each tag entry stores a 4-byte type, 4-byte count, and offset into the data store |
| Package signing | GPG signature embedded in the signature header; verified with `rpm --checksig` |
| Dependency metadata | Requires, Provides, Conflicts, and Obsoletes tags stored in the main header for automatic resolution |
| Install scriptlets | Pre- and post-install (%pre/%post) and pre- and post-uninstall (%preun/%postun) scripts embedded in the package |
| Per-file integrity | SHA-256 digests per file stored in the header (MD5 on older packages); checked after installation |
| Package format version | v4 (current, RPM 4.x toolchain); RPM v6 format in active development at RPM.org |
| Associated package managers | `dnf` (Fedora, RHEL, CentOS Stream), `zypper` (openSUSE/SUSE), `rpm` (low-level command) |
| Source package variant | `.src.rpm` (SRPM) contains the source tarball and `.spec` build recipe instead of compiled binaries |
| Supported install platforms | RPM-based Linux distributions: Red Hat, Fedora, RHEL, CentOS, openSUSE, Rocky Linux, AlmaLinux, Mageia |
| Typical file size | Tens of KB (small utilities) to several hundred MB (large applications, dev toolchains, or firmware) |
| Relocatability | Packages can be flagged relocatable, permitting installation to a user-defined prefix path |
| Released | 1997 (RPM, with Red Hat Linux 5.0; rpm-software-management is the current upstream) |
| Latest version | RPM v4 package format (RPM 4.20.x, 2024); RPM v6 format in development |
| Open standard | Yes · royalty-free |
| Specification | rpm-software-management.github.io |
RPM conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about RPM files.
Frequently asked questions
How do I install an .rpm file on Linux?
sudo dnf install ./file.rpm; on openSUSE: sudo zypper install ./file.rpm. These resolve dependencies automatically. The low-level sudo rpm -ivh file.rpm works too but won't fetch missing dependencies.How do I open an .rpm file on Windows?
How do I install an .rpm on Ubuntu/Debian?
sudo alien -i file.rpm, but it's safer to look for a native .deb, Flatpak or AppImage of the same program.What's the difference between RPM and DEB?
How do I see what's inside an .rpm without installing it?
rpm -qlp file.rpm lists its files and rpm -qip file.rpm shows its info; or run rpm2cpio file.rpm | cpio -idmv to extract them. On Windows, open it with 7-Zip.Why do I get 'failed dependencies' when installing an RPM?
dnf install ./file.rpm (or zypper) instead of raw rpm, so the package manager pulls in the dependencies from your repositories.
