What Is an ICO File? How to Check a Windows Icon File Before You Trust It

7 How Do You Open an ICO File? Six readers we tested and two viewers from outside pages

The table lists the programs we tested and the one Microsoft page we read. The readers with a version number are the ones we tested. We worked on Linux, so we opened no ICO file in Windows Explorer, Paint or Photos.

Open ICO files on the command line

Three commands list the images of an ICO file. For base.ico, the file command prints the first two and writes a literal \012- where a line break belongs. The identify program and icotool list all four.

file -b base.ico
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 24x24 with \012- PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
identify base.ico
base.ico[0] ICO 16x16 16x16+0+0 8-bit sRGB 0.000u 0:00.000
base.ico[1] PNG 24x24 24x24+0+0 8-bit sRGB 605B 0.000u 0:00.000
base.ico[2] PNG 32x32 32x32+0+0 8-bit sRGB 760B 0.000u 0:00.000
base.ico[3] PNG 48x48 48x48+0+0 8-bit sRGB 3653B 0.000u 0:00.000
icotool --list base.ico
--icon --index=1 --width=16 --height=16 --bit-depth=32 --palette-size=0
--icon --index=2 --width=24 --height=24 --bit-depth=32 --palette-size=0
--icon --index=3 --width=32 --height=32 --bit-depth=32 --palette-size=0
--icon --index=4 --width=48 --height=48 --bit-depth=32 --palette-size=0

The icotool numbers start at 1, and identify numbers start at 0. All three agree on 16, 24, 32 and 48 pixels. The identify program prints 3653B for the last image, which is the size of the file and not of the image.

Open ICO files with Python

The Python package Pillow reads the same list. Six lines print the size and color mode of every image in an ICO file. The load call decodes the pixels, so a damaged image fails here and not at the open.

from PIL import Image
im = Image.open('base.ico')
for s in sorted(im.ico.sizes()):
    img = im.ico.getimage(s)
    img.load()
    print(s, img.mode)
(16, 16) RGBA
(24, 24) RGBA
(32, 32) RGBA
(48, 48) RGBA

Pillow failed on 10 of the 153 files and on 16 of the 50 damaged ICO files, so read its answer with care. The damage grid lists the copies where its pixels differed from the intact file.

Viewers and converters for ICO files

These two links open outside pages for ICO files. One comes from SysTools and one from Freeviewer. We describe them from their own pages and tested neither.

The SysTools Image Converter lists ICO among its inputs and not among its outputs, so it reads an ICO file and does not write one. Its page lists outputs like PDF, PNG, JPG, BMP and TIFF. Its demo converts the first 5 files and adds a watermark.

Freeviewer's page describes an image viewer for Windows that lists ICO and ICON among its formats. It previews images in bulk, reorders them and prints them. Its free version reads files and exports the first 5 images. We list no prices, because they change.

8 How Do You Check an ICO File? Six steps, and only one of them reads image data

The first reads need no Python. The xxd command prints bytes, and the file command names the type of an ICO file. For base.ico they show a type of 1, a count of 4 and the first entry.

xxd -l 22 base.ico
00000000: 0000 0100 0400 1010 0000 0100 2000 6804  ............ .h.
00000010: 0000 4600 0000                           ..F...
file -b base.ico
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 24x24 with \012- PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel

Read the first line from the left. Bytes 0 to 3, 00 00 01 00, are the reserved field and the type of the ICO file. Bytes 4 and 5, 04 00, are the count. The file command prints the same facts as words, and it names the first two images.

Step 4 starts at byte 6 of the ICO file. Every entry is 16 bytes long. The width and height come first, and the size and offset come last. A cursor starts with 00 00 02 00 instead.

Check ICO files with Python

The script reads the 6 header bytes of ICO files and then the entry list. It prints the type, the image count and the file size, then one line for every image. It decodes no image, and it never changes an ICO file.

#!/usr/bin/env python3
"""ico_peek.py - read the 6 byte header and the 16 byte entries of an ICO or CUR file. Decodes no pixels.
Usage: python3 ico_peek.py FILE [FILE ...]
"""
import os, struct, sys

PNG = b'\x89PNG\r\n\x1a\n'

def kind(blob):
    if blob[:8] == PNG:
        return 'PNG'
    if len(blob) >= 4 and struct.unpack('<I', blob[:4])[0] in (12, 40, 52, 56, 108, 124):
        return 'BMP, %d byte header' % struct.unpack('<I', blob[:4])[0]
    return 'unknown data (%s)' % blob[:4].hex(' ')

def peek(path):
    size = os.path.getsize(path)
    with open(path, 'rb') as f:
        head = f.read(6)
        if len(head) < 6:
            return '%s: header cut short at %d bytes' % (path, len(head))
        zero, kind_id, count = struct.unpack('<HHH', head)
        if kind_id not in (1, 2):
            return '%s: not an icon or cursor, the first 6 bytes are %s' % (path, head.hex(' '))
        name = 'ICO' if kind_id == 1 else 'CUR'
        out = ['%s: %s, %d images, file is %d bytes' % (path, name, count, size)]
        if zero:
            out.append('  warning: the first two bytes are not 0')
        if count == 0 or 6 + count * 16 > size:
            out.append('  warning: the entry list does not fit inside the file')
            return '\n'.join(out)
        for i in range(count):
            f.seek(6 + 16 * i)
            w, h, colors, res, a, b, length, where = struct.unpack('<BBBBHHII', f.read(16))
            w, h = w or 256, h or 256
            extra = 'hotspot %d,%d' % (a, b) if kind_id == 2 else '%d bit' % b
            f.seek(where)
            blob = f.read(min(length, 8)) if where < size else b''
            note = ''
            if where + length > size:
                note = '  (ends past the end of the file)'
            elif where < 6 + count * 16:
                note = '  (starts inside the entry list)'
            out.append('  image %d: %dx%d, %s, %d bytes at %d, %s%s' % (
                i, w, h, extra, length, where, kind(blob) if blob else 'no data', note))
        return '\n'.join(out)

for p in sys.argv[1:]:
    print(peek(p))

Here is what it printed for three files. They are base.ico, a cursor with a hotspot and an ICO file with a 256 pixel PNG image beside four BMP images.

python3 ico_peek.py base.ico sample.cur pillow.ico
base.ico: ICO, 4 images, file is 3653 bytes
  image 0: 16x16, 32 bit, 1128 bytes at 70, BMP, 40 byte header
  image 1: 24x24, 32 bit, 605 bytes at 1198, PNG
  image 2: 32x32, 32 bit, 760 bytes at 1803, PNG
  image 3: 48x48, 32 bit, 1090 bytes at 2563, PNG
sample.cur: CUR, 1 images, file is 3254 bytes
  image 0: 23x42, hotspot 1,24, 3232 bytes at 22, BMP, 40 byte header
pillow.ico: ICO, 5 images, file is 102602 bytes
  image 0: 256x256, 32 bit, 84676 bytes at 86, PNG
  image 1: 48x48, 32 bit, 9832 bytes at 84762, BMP, 40 byte header
  image 2: 32x32, 32 bit, 4392 bytes at 94594, BMP, 40 byte header
  image 3: 24x24, 32 bit, 2488 bytes at 98986, BMP, 40 byte header
  image 4: 16x16, 32 bit, 1128 bytes at 101474, BMP, 40 byte header

The first line of every answer gives the type, the image count and the file size. Later lines give the size, bit depth, byte length, offset and kind of every image. A cursor prints a hotspot in place of the bit depth.

python3 ico_peek.py testsrc.png A1.ico C3.ico D13.ico
testsrc.png: not an icon or cursor, the first 6 bytes are 89 50 4e 47 0d 0a
A1.ico: ICO, 4 images, file is 3653 bytes
  warning: the first two bytes are not 0
  image 0: 16x16, 32 bit, 1128 bytes at 70, BMP, 40 byte header
  image 1: 24x24, 32 bit, 605 bytes at 1198, PNG
  image 2: 32x32, 32 bit, 760 bytes at 1803, PNG
  image 3: 48x48, 32 bit, 1090 bytes at 2563, PNG
C3.ico: ICO, 4 images, file is 70 bytes
  image 0: 16x16, 32 bit, 1128 bytes at 70, no data  (ends past the end of the file)
  image 1: 24x24, 32 bit, 605 bytes at 1198, no data  (ends past the end of the file)
  image 2: 32x32, 32 bit, 760 bytes at 1803, no data  (ends past the end of the file)
  image 3: 48x48, 32 bit, 1090 bytes at 2563, no data  (ends past the end of the file)
D13.ico: ICO, 4 images, file is 3653 bytes
  image 0: 16x16, 32 bit, 1128 bytes at 3753, no data  (ends past the end of the file)
  image 1: 24x24, 32 bit, 605 bytes at 1198, PNG
  image 2: 32x32, 32 bit, 760 bytes at 1803, PNG
  image 3: 48x48, 32 bit, 1090 bytes at 2563, PNG

The file testsrc.png is a PNG picture and fails the first check. A1 has a reserved field of 1 and prints a warning. C3 was cut at 70 bytes, and D13 has an image offset of 3,753 in an ICO file of 3,653 bytes. Both print that an image ends past the end.

What the script found in our files

The script reads the header and the list and nothing else. It does not decode an image or compare the pixels. ICO files with broken images can pass it, so the damaged ICO files matter.

Check order for any ICO file

1. 1 Copy the ICO file, write its SHA256 hash and work on the copy.
2. 2 Read the first 4 bytes of the ICO file. They must be 00 00 01 00 for an icon. The bytes 00 00 02 00 mean a cursor.
3. 3 Read bytes 4 and 5 for the image count. Then read the entry list, where every entry is 16 bytes long.
4. 4 Read the list with our script. A warning means the list does not fit inside the file or an image ends past the end.
5. 5 Compare with the file command and with identify or icotool. A difference points to damage or a reader limit.
6. 6 Draw every image with Pillow, as in the Python example, and compare the sizes with the list. Only this step reads image data.

9 Is an ICO File Safe to Open? Reading is safe, and a name proves nothing

We opened no ICO file in a viewer and scanned none for malware. The six readers only read bytes. The files come from public test folders, so their contents are not the worry here.

The rename test

We copied base.ico to 10 names, like base.png, base.jpg, base.txt, base.cur, favicon and base.ico.txt. The file command, our script, Pillow and icotool read all 10 as the same ICO file. ImageMagick opened only base.cur and base.ICO. ffprobe refused the names ending .png, .jpg and .bmp. So those two trust the ending.

The reverse also works. We gave 8 other files the ending .ico. They are PNG, JPEG, GIF and BMP pictures, a ZIP archive, an ELF program, a text note and an empty file. The file command named the true type of all 8, and our script and icotool refused all 8.

Pillow and ffprobe opened the 4 pictures as pictures, and ImageMagick opened 2. No reader took the ZIP, the ELF, the text or the empty file for an ICO file. If your file manager hides endings, a name can pass for an ICO file and be a program. Show full names and read the first bytes of anything you doubt.

What an ICO file can contain

An ICO file stores a header, a list and images. In our files the only extras were bytes after the last image and text chunks inside PNG images. 6 files end with extra bytes, from 1 to 1,088.

8 of our 26 PNG images have a tIME chunk and 8 have a tEXt chunk. They come from 3 files. A tIME chunk stores a time and a tEXt chunk stores text. Check your own favicon for chunks before you publish it, because anyone who loads your page can download it.

Icons inside programs

Programs keep their icons as resources inside the EXE or DLL file, as Chen explains in his 2023 article. The ICO file is a copy that a tool writes out. See the EXE file page for the program side.

We tested the extraction on 37 program files, 32 EXE files and 5 DLL or PYD files. The wrestool program from icoutils 0.32.3 found 13 icon groups in 8 of them. They made 12 different ICO files, and all six readers and all four decoders opened all 12.

11 How Do You Make an ICO File or a Favicon? Four writers on one PNG picture, and icotool refused one result

Making an ICO file means writing a header, a list and images. We tested four writers on one 256 by 256 PNG picture of 3,618 bytes. The table lists what the four wrote, and every row ends with the tests behind it.

Make an ICO file from a PNG picture

The four commands below made the four files. The option -c makes icotool create a file. The size list for Pillow is our choice, and ImageMagick takes its list from the option icon:auto-resize.

convert testsrc.png -define icon:auto-resize=256,128,64,48,32,16 out_magick.ico
python3 -c "from PIL import Image; Image.open('testsrc.png').save('out_pillow.ico', sizes=[(16, 16), (32, 32), (48, 48), (64, 64), (128, 128), (256, 256)])"
icotool -c -o out_icotool.ico testsrc.png
ffmpeg -i testsrc.png out_ffmpeg.ico
ls -l out_*.ico | awk '{print $5, $9}'
270622 out_ffmpeg.ico
270398 out_icotool.ico
103267 out_magick.ico
18711 out_pillow.ico

The ImageMagick ICO file stores the 256 pixel image as PNG data and the five smaller ones as BMP data. The Pillow ICO file stores all six as PNG data, so it is about a fifth of the size. Our script lists both.

python3 ico_peek.py out_magick.ico out_pillow.ico
out_magick.ico: ICO, 6 images, file is 103267 bytes
  image 0: 256x256, 32 bit, 3573 bytes at 102, PNG
  image 1: 128x128, 32 bit, 67624 bytes at 3675, BMP, 40 byte header
  image 2: 64x64, 32 bit, 16936 bytes at 71299, BMP, 40 byte header
  image 3: 48x48, 32 bit, 9640 bytes at 88235, BMP, 40 byte header
  image 4: 32x32, 32 bit, 4264 bytes at 97875, BMP, 40 byte header
  image 5: 16x16, 32 bit, 1128 bytes at 102139, BMP, 40 byte header
out_pillow.ico: ICO, 6 images, file is 18711 bytes
  image 0: 16x16, 32 bit, 722 bytes at 102, PNG
  image 1: 32x32, 32 bit, 1555 bytes at 824, PNG
  image 2: 48x48, 32 bit, 2349 bytes at 2379, PNG
  image 3: 64x64, 32 bit, 3290 bytes at 4728, PNG
  image 4: 128x128, 32 bit, 7075 bytes at 8018, PNG
  image 5: 256x256, 32 bit, 3618 bytes at 15093, PNG

Why icotool refuses the ffmpeg file

The ffmpeg ICO file has one 256 pixel BMP image. Its entry says 270,600 bytes, and the BMP header implies 270,376. The icotool program warns about the total size and refuses the ICO file. ImageMagick, Pillow, ffmpeg and the other readers drew it.

Notes on favicons

Google's favicon page lists BMP, GIF, ICO, PNG, JPEG, PPM and TIFF as supported formats, so an ICO file is not required. The picture must be square and at least 8 by 8 pixels, and Google recommends more than 48 by 48. The page requires no file name.

We tested no favicon in a browser or in search. We tested whether four tools can write an ICO file and whether six readers can open it. We also tested drawing, and did not test saving the images out of an ICO file.