What is the XZ file format?
.xz is a compressed archive file format that uses the XZ compression method. The format is native to XZ Utils, the reference software tool developed as part of The Tukaani Project (a GNU/Linux distribution based on Slackware).
XZ and TAR
An .xz archive can store only a single compressed stream and carries no directory tree of its own. Because of that, .xz files are commonly used in combination with TAR archives - TAR collects selected files into a single archive, and the XZ algorithm is then applied for compression. The resulting file carries the suffix .tar.xz or .txz.
LZMA2 compression algorithm
XZ compression is based on the LZMA2 algorithm - an evolution of the original LZMA standard. It allows for high compression ratios and results in significantly reduced file sizes: XZ archives are typically 30% smaller than GZIP and 15% smaller than BZIP2 archives. XZ offers lossless compression to prevent any information loss.
Additional notes
- Compared to other compression methods, the XZ compression process is rather slow, but decompression is significantly faster.
- XZ archives are widely used for distributing Linux software packages, including Slackware and most major kernel source tarballs.
- The
.xzformat identifies itself with the fixed 6-byte header magicFD 37 7A 58 5A 00and verifies integrity using per-block and per-stream CRC64 checksums by default (CRC32 and SHA-256 are also supported). - In early 2024, XZ Utils versions 5.6.0 and 5.6.1 were found to contain a deliberately injected backdoor (CVE-2024-3094) in the
liblzmalibrary. The.xzfile format specification is unaffected; only those specific build tarballs were compromised.
Security & safety
RISK: LOWThe .xz format carries no executable code and cannot 'run'; risk comes only from what is inside (extract before trusting). Note the 2024 supply-chain incident (CVE-2024-3094): a backdoor was inserted into the liblzma build of xz 5.6.0/5.6.1 shipped in some distro test channels - that affects the tool/library binaries, not .xz files you receive. Beware fake 'xz opener' download sites bundling adware; use 7-Zip/PeaZip from their official pages.
Format details
in a nutshellPrograms that open XZ files
Windows3 apps
7-Zip
Open-source Right-click the .xz → 7-Zip → Extract Here; for .tar.xz extract twice (xz, then the tar). 
NanaZip
Open-source Modern 7-Zip fork from the Microsoft Store - right-click → extract the .xz/.tar.xz. 
macOS3 apps
The Unarchiver
Free Double-click the .xz; The Unarchiver decompresses (and untars .tar.xz) automatically.
Terminal (xz / tar)
Built-in Run tar -xf file.tar.xz (macOS bsdtar handles xz) or install xz via Homebrew. 
Linux3 apps
XZ Embedded
Open-source Decoder-only C library for embedded/bootloader use - not an end-user app; for developers decompressing .xz in constrained systems.
xz / XZ Utils
Open-source xz -d file.xz to decompress, or tar -xf file.tar.xz for tarballs. Pre-installed on most distros.
Archive Manager (GNOME) / Ark (KDE)
Open-source Double-click the .xz in the file manager and click Extract. Technical details
deep spec| Compression algorithm | LZMA2 (evolution of LZMA); optional filter chain with delta and BCJ (branch/call/jump) filters |
| Container structure | Stream header → one or more compressed blocks → block index → stream footer |
| Stream header magic | FD 37 7A 58 5A 00 - fixed 6 bytes at offset 0 |
| Stream footer magic | 59 5A ("YZ") - always the last 2 bytes of every .xz stream |
| Byte order | Little-endian |
| MIME type | application/x-xz |
| Integrity checking | Per-block and per-stream checksums; default CRC64; CRC32 and SHA-256 also supported |
| Encryption | None - no built-in encryption; encrypt data before compression if needed |
| File storage | Single compressed stream only; no filenames or directory tree (combine with .tar for multi-file archives) |
| Encoding | Binary |
| Typical compressed size | Tens of KB to several GB; Linux kernel source tarballs commonly 50-200 MB |
| Compression ratio vs. alternatives | Typically ~30% smaller than gzip and ~15% smaller than bzip2 on source code |
| Security note | CVE-2024-3094: XZ Utils 5.6.0/5.6.1 tarballs contained a backdoor in liblzma; the .xz file format specification is unaffected |
| Platform support | Linux, BSD, macOS, Windows (via XZ Utils, 7-Zip, PeaZip, NanaZip, The Unarchiver) |
| Released | 2009 (XZ Utils 4.999.x / 5.0; format finalized 2009) |
| Latest version | XZ file format 1.0.4 (2009); XZ Utils 5.6.x toolchain |
| Open standard | Yes · royalty-free |
| Specification | tukaani.org |
XZ conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about XZ files.
Frequently asked questions
How do I open an .xz file on Windows?
What is the difference between .xz and .tar.xz?
Is .xz better than .gz or .zip?
Is the xz file format affected by the xz backdoor (CVE-2024-3094)?
How do I decompress .xz on Linux?
xz -d file.xz to get the original file, or tar -xf file.tar.xz to unpack a tarball. xz is preinstalled on most distributions.
