What is the WSF file format?
Files with the .wsf extension are scripts for the Microsoft Windows Script Host (WSH). These are text files that comply with XML format. They can be opened for editing in any text editor, but it is advisable to use a dedicated tool such as Visual Studio Code. A single .wsf file can include multiple scripting jobs and support various scripting languages within one document.
Default scripting languages supported in .wsf files include JScript and VBScript. However, the format is designed to be independent of the scripting language - after installing a compatible engine in WSH, it can also support languages such as:
- PerlScript,
- Python,
- BASIC,
- Ruby,
- PHP,
- Object REXX.
By integrating different scripting languages, it is possible to use functions defined in one language alongside constants from declared objects. This brings the creation of .wsf scripts closer to traditional programming methods.
.wsf script files are used for logging and system administration, and are commonly used for automating various system tasks. Scripts can be run in GUI mode via WScript.exe, in console mode via CScript.exe, or accessed programmatically as a COM object through WShom.ocx. Debugging tools are also available.
PowerShell scripts have largely replaced .wsf for modern Windows automation since Windows 7, but WSH remains present on all current Windows versions. Important security note: .wsf files are a known malware delivery mechanism - ransomware and downloaders have widely abused .wsf email attachments. Treat any unsolicited .wsf file with extreme caution.
Security & safety
RISK: HIGHWSF files are a major malware delivery vector on Windows. Windows Script Host executes .wsf natively without any special installation, and the XML container allowed early email filters to miss them as plain text. Ransomware campaigns (Locky 2016, Cerber, Sage 2017, Nemucod downloader) used malicious .wsf email attachments extensively. Risk factors: (1) .wsf can download and execute further payloads via WScript.Shell and XMLHTTP objects; (2) can modify registry, create files, and invoke system commands; (3) no UAC elevation required for many destructive actions; (4) executes silently via wscript.exe double-click. Mitigation: block .wsf at email gateways; disable WSH via Group Policy (HKLM\Software\Microsoft\Windows Script Host\Settings → Enabled = 0); never execute an unexpected .wsf. Use a text editor to inspect before running.
Format details
in a nutshellPrograms that open WSF files
Windows5 apps
Windows Notepad
Built-in Right-click the .wsf file → Open with → Notepad to view source without executing. 
Notepad
Open-source Open the .wsf file in Notepad++ to read, edit, or inspect it safely without executing. 
Windows Script Host (wscript.exe)
Built-in Double-click the .wsf file to execute via wscript.exe (GUI mode). WARNING: only run trusted files.
Windows Script Host Console (cscript.exe)
Built-in Open Command Prompt and run: cscript filename.wsf - executes in console mode with text output. 
Visual Studio Code
Open-source Open the file; VS Code recognizes XML and provides syntax highlighting. Debug WSH with appropriate extension. Technical details
deep spec| File format | Well-formed XML document; <package> root element (optional) contains one or more <job id="..."> elements, each grouping one or more <script> blocks |
| Encoding | Text; UTF-8 or Windows-1252 (ANSI); character encoding specified in the XML declaration at the file head |
| XML job elements | Each <job> can contain <script language="VBScript|JScript">, <reference> (type library constants), <object> (COM instantiation), <include> (external .vbs/.js files), and <runtime> (argument docs) |
| Built-in script engines | JScript and VBScript are built into WSH on all Windows versions; additional engines (PerlScript, Python, Object REXX) require separate installation and registry registration |
| Multi-language per job | A single <job> block can mix JScript and VBScript <script> sections, sharing COM objects and constants across language boundaries |
| Execution modes | GUI mode: wscript.exe (dialogs allowed, no console); console mode: cscript.exe (stdout/stderr available); COM object access: WShom.ocx |
| WSH host versions | WSH 5.8 ships with Windows 7 through Windows 11 and is the version on all current systems; WSH 5.6 ran on Windows XP |
| Typical file size | 1 KB - 200 KB; most scripts are compact single-purpose files |
| Security classification | High-risk executable; WSH runs .wsf files natively on double-click with no user confirmation; widely exploited for ransomware (Locky, Cerber, Sage) and malware dropper delivery via email attachments |
| Platform | Windows only; Windows Script Host is not available on macOS or Linux |
| Default execution handler | Windows associates .wsf with wscript.exe by default; the association can be changed to cscript.exe or disabled entirely via Group Policy for security hardening |
| Modern successor | PowerShell (.ps1) has largely replaced .wsf for Windows system administration since Windows 7; WSH remains present on all current Windows but is not actively developed by Microsoft |
| Released | 1999 with Windows Script Host 2.0 (shipped with Windows 2000; downloadable for Windows 98/NT) |
| Latest version | WSH 5.8 (Windows 7 / Server 2008 R2; version in all later Windows editions) |
| Specification | learn.microsoft.com |
WSF conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about WSF files.
