What Is a KTH File? The Keynote Theme That Is Really a ZIP Archive With Two Layouts
KTH files are Keynote themes saved as ZIP archives, and ZIP tools accept edited ones with no warning. Jump to your question below, or work through it in order.
What Is a KTH File? Keynote themes in ZIP archives, and the ending is only a label
Short answer
A KTH file is a Keynote theme saved as a ZIP archive. It stores layouts, styles and pictures that Keynote reuses for new slides, and it starts with the ZIP bytes 50 4B 03 04. The ending .kth is only a label, and two layouts of parts can be inside.
We found 10 public KTH files, made 15 of our own and damaged one KTH file in 50 ways. Eight readers handled the 50 copies in different ways, and only 4 copies gave the same answer in all eight. In 11 copies, five ZIP tools extracted changed content with no warning.
To open a KTH file, read the opening steps. To check one, read the six steps. If your KTH file will not open, begin with the eight causes.
A KTH file is a Keynote theme packed in a ZIP archive. The ZIP signature 50 4B 03 04 and the Keynote parts inside make the KTH file, and the ending .kth is only a label. Apple Keynote on a Mac installs KTH files.
Picture the theme zebra.kth, saved from a design blog. Double click it on any Mac and Keynote offers to add it to the theme chooser. Windows PCs have no program that installs KTH files. Inside, every KTH file is a folder of parts in ZIP form.
FileInfo describes KTH files as presentation themes for Keynote, an Apple iWork program. It lists only Apple Keynote on Mac as software that opens them.
Apple's Keynote guide says you make custom themes with File and Save Theme. It says installable theme files use the .kth extension, and that custom themes land in the My Themes group of the theme chooser.
An older Apple guide for Keynote 6.2 adds a rule for phones. Themes sent through a web server or webmail must end in .kth.zip to install in Keynote on iOS.
Wikipedia on Keynote says Keynote uses KEY for presentations and .kth for themes, and calls both bundles based on XML. Our files show this is true for older KTH files only. The newer KTH files use compressed binary parts.
Where our KTH files come from
We looked for public KTH files in code projects and through web search. We found 10 KTH files in five projects and downloaded all 10. No public collection of KTH files exists, so these 10 are all we could find.
The 10 KTH files are themes that people made to share. Six use an older layout of parts from the Keynote 09 era, and four use the newer layout. Sizes range from 187 KB to 4.3 MB.
We also made 15 test files from two public KTH files, zebra.kth and bright, and damaged copies of zebra.kth in 50 ways. Eight readers handled every KTH file. They are five ZIP tools, a Keynote parser, LibreOffice and our 50 line script.
We tested on Linux. We opened no KTH file in Keynote, on a Mac, an iPhone or Windows, so the tests show how readers treat KTH files and not how Keynote does. We list the limits in the format part.
KTH file facts at a glance
| Property | Value |
|---|---|
| Meaning | Keynote theme files, made by Apple. FileInfo files KTH files as presentation themes for Keynote. |
| Endings | .kth on a Mac, and .kth.zip when you send KTH files to iOS devices through a web server or webmail (Apple). |
| Start |
50 4B 03 04, the ZIP signature. All 10 public KTH files start with it.
|
| Container | ZIP archives in two layouts. Six of our 10 KTH files use the older layout and four use the newer layout. |
| MIME type |
None found for .kth. IANA lists application/ for KEY files and does not mention .kth.
|
| Opens with | Apple Keynote on Mac. Any ZIP tool lists the parts. LibreOffice opened 4 of our 10 KTH files. |
| Size in our set | From 187 KB to 4.3 MB. Pictures take 62 to 92 percent of the bytes. |
| Our tests | 10 public KTH files, 15 made files, 50 damaged copies and eight readers, on Linux. We opened no KTH file in Keynote. |
Wrong page? Look at the PPT file for PowerPoint presentations, the ZIP file for the container or the PDF file for finished slides.
What Is Inside a KTH File? Two layouts, and pictures take most of the bytes
A KTH file is a ZIP archive with two possible layouts inside. The older layout has one XML file named index.apxl, and the newer layout has IWA files in an Index folder. Pictures take 62 to 92 percent of the bytes in both.
We took apart all 10 public KTH files. The figure shows two KTH files side by side. The file bright uses the older layout, and zebra.kth uses the newer layout. Counts are members of the ZIP archive.
Read the figure from the top. Readers separate the two layouts by one name. If index.apxl is present, the KTH file is the older kind. If an Index folder has IWA files, it is the newer kind.
The ZIP part is the same in both. Wikipedia on ZIP says every entry starts with a local header that begins 50 4B 03 04.
The older layout, from the Keynote 09 era
Six of our KTH files use it. Their index.apxl file is XML, and its first element is named metatheme where a Keynote 09 presentation says presentation.
PRONOM, the format registry of the UK National Archives, lists a signature for Keynote 09 files that looks for index.apxl and the version string 92008102400. All six of these KTH files contain that string.
The themeMetaData file is a small property list. It names the application version, the slide width and height and a hidden flag. Five of these KTH files are 1024 by 768 and one, AndroidDesign, is 800 by 600.
Pictures live in theme-files, with 18 to 21 files in our set. The thumbs folder adds 10 to 14 small thumbnails, and the Contents folder adds preview pictures and three strings files named name, masterNames and fontsAndText.
The newer layout, with IWA parts
Four of our KTH files use it. The Index folder has 19 to 35 IWA files, and 12 to 28 of them are master slides. The iWorkFileFormat project notes on GitHub call an IWA file an iWork Archive, which is a Protobuf stream wrapped in a Snappy stream.
The Data folder stores the pictures, with 12 to 30 files. The Metadata folder has three small files. Properties names the format version, BuildVersionHistory lists the Keynote builds that saved the file and DocumentIdentifier names the document.
Three preview pictures finish the file. They are preview, preview-micro and preview-web. The main preview is 1028 by 772 pixels in two of the four KTH files and 1024 by 576 in the other two.
| File | Format version | Last Keynote build | Master slides |
|---|---|---|---|
zebra.kth
|
2.0.24 | M6.6.1 | 12 |
pepabo-theme-wide
|
2.0.24 | M6.6.2 | 14 |
pepabo-theme
|
1.5.0 | M6.5.3 | 15 |
azusa3.kth
|
14.0.1 | M14.0 | 28 |
The table shows three format versions in four KTH files. The last one, azusa3.kth, has a member dated 19 April 2024, and its BuildVersionHistory lists seven builds from M6.1 to M14.0. Master counts range from 12 to 28.
What the ZIP wrapper adds
The 37 to 71 members of the four newer KTH files are stored with no compression, because IWA files already pack themselves. In the six older KTH files, only index.apxl is deflated. It shrinks from 1.2 MB to 78 KB in bright.
Both layouts are ordinary archives. No part of a KTH file needs Keynote to open it. ZIP tools list and extract every part, and our five ZIP tools did so for all 10 public KTH files. Only the meaning of the parts needs Keynote.
What Do KTH Files Store? Six older files, four newer ones and a few loose items
The ending .kth says nothing about which layout is inside. Six of our 10 KTH files use the older layout and four use the newer layout. Pictures take 62 to 92 percent of the unpacked bytes, and the design parts take most of the rest.
Two KTH files can look alike in a file manager and differ inside. We summed the unpacked bytes of every member in the 10 public KTH files and sorted them into pictures, IWA parts, index.apxl and other files. The figure shows the shares.
Pictures are the weight
The smallest KTH file, zebra.kth, is 62 percent pictures. The largest share is in azusa3.kth, with 92 percent. Pictures take 73 to 78 percent of the six older KTH files, and index.apxl takes 20 to 24 percent.
This is why themes with wood grain or blackboard tiles weigh 4 MB while flat themes weigh under 400 KB. Our six older KTH files, with textured backgrounds, are all between 3.9 and 4.3 MB.
What the design parts store
The design parts store master slides, styles and fonts. In the newer KTH files, DocumentStylesheet is the biggest IWA part. In zebra.kth it is 38,931 bytes, more than half of all the IWA bytes in that file.
Themes store a sample slide too. LibreOffice drew one page from every newer KTH file that it opened, so all four files have a single slide next to their masters.
What authors leave inside
Six of our 10 KTH files, all in the older layout, store a loose file at the top level of the ZIP archive, outside the usual folders. Names like theme-bg_Snapseed and document-bg point to an edited background picture.
The file AndroidDesign goes further. It stores four loose items at the top level. They are a folder named .iWTrash with two items inside, a screenshot dated 5 May 2012 and two TIFF pictures. Together they take 785 KB, or 15 percent of the unpacked bytes, and they look like leftovers from the author's own folder.
Not sure the file is a KTH file at all? Check it with our script.
What Did We Find in 10 Public KTH Files? Eight readers, and one that split the files by layout
Seven readers accepted all 10 of our public KTH files. LibreOffice accepted the four KTH files with the newer layout and refused the six with the older layout. All 10 KTH files start with the same four bytes and pass the ZIP integrity test.
We found 10 KTH files in five projects. They are themes that people made to share, so this study shows what readers do with shared themes and not with every theme. The figure shows which reader accepted which KTH file.
The eight readers
Five readers are ZIP tools. They are Info-ZIP unzip 6.00, 7-Zip 23.01, bsdtar 3.7.2, the Python 3.13 zipfile module and the Go 1.24.7 archive/zip package. We extracted every KTH file to a new folder and compared the hash of the folder with the hash for the intact file.
Our script is the 50 line Python program in the check part. It reads the ZIP archive, names the layout and prints what it finds, and it makes no slide.
The Keynote parser is the Python package keynote-parser 1.14.5.0, which unpacks iWork files. It reads only KEY files, so we gave it every KTH file under a KEY name. LibreOffice 24.2.7 converted every file to PDF, and we counted a KTH file as accepted when a PDF came out.
Where the readers agree
Seven readers accepted all 10 KTH files. For every file, the five ZIP tools and the Keynote parser extracted as many files as the ZIP archive lists. Our script named six KTH files as the older layout and four as the newer layout, which matches our own count.
Every IWA part in the four newer KTH files starts with the byte 00, the first byte of a Snappy chunk. No ZIP integrity test failed, and no KTH file had a stray member that stopped a reader.
The file AndroidDesign has 50 members and four loose items at the top, and all seven readers still accepted it.
Where LibreOffice splits from the rest
LibreOffice opened the four newer KTH files and drew one page from every one. It refused all six older KTH files and printed the same message for all of them, that the source file could not be loaded.
The ending is not the cause. We renamed bright to a KEY name, and LibreOffice still refused it. Then we changed one word inside, replacing the root word metatheme with presentation in index.apxl, and LibreOffice drew a page. So it reads the root word and not the ending.
That helps you in one way and not in another. Newer KTH files can give you a quick page in LibreOffice. Older KTH files need Keynote, because LibreOffice sees nothing it can import. We did not compare the page with what Keynote would draw.
Read the study with care. It shows what eight readers do with 10 public KTH files from five projects. We opened no file in Keynote, and we did not check how any file was made. Readers that accept these KTH files can still fail on yours.
What Do Readers Do With a Damaged KTH File? 50 broken copies, eight readers and 11 silent edits
We damaged one KTH file in 50 ways and handled every copy with eight readers. Only 4 of the 50 copies gave the same answer in all eight, and those 4 are harmless rewrites. In 11 edited copies, all five ZIP tools extracted changed content with no warning.
The base file is zebra.kth, with 191,723 bytes and 37 members. We changed one thing at a time and sorted the 50 copies into six groups. The groups cover cuts, the front of the file, the end record, the directory, the stored bytes and valid ZIP files with edits.
Green means the reader gave the same answer as for the intact KTH file. For the five ZIP tools, that means the same files on disk. Amber means another answer with no warning. Red means a warning or a refusal. Copy numbers match the rows of the figure, and copies 46 to 48 are controls.
ZIP tools cannot see a careful edit
Eleven copies are valid ZIP files whose parts we edited and packed again. They are copies 35 to 43, 49 and 50. All five ZIP tools extracted changed content from every one of them and none warned, because every part matched its own checksum.
The edits change what the theme says. Copy 35 rewrites the build history to say Black, and copy 36 swaps in the preview of another theme. Copy 37 empties Document, copy 38 takes the stylesheet of another theme and copy 39 adds a text note.
Copy 40 adds a 1 MB hidden member, copy 41 removes the previews, copy 42 removes the Metadata folder and copy 43 renames Index to index.
Our script saw 8 of the 11 and LibreOffice saw 6. Copies 35 and 36 passed both, so no reader in our set flagged them. The controls explain why. Copies 46 to 48 rewrite the ZIP archive with deflate, in reverse order or with a valid comment, and all eight readers gave the same answer.
The five ZIP tools disagree about damage
The five ZIP tools gave the same kind of answer on only 22 of the 50 copies. On 9 copies, one tool refused the KTH file while another extracted the same files as the intact copy. Those copies are 1, 2, 8, 9, 15, 16, 17, 19 and 25.
The bsdtar tool is the most forgiving. It returned the same files for 19 copies, and it did so for copies 1, 2, 8 and 9, which are cut at the end. The 7-Zip tool is the loudest. It warned on 28 copies and gave the same files on only 7.
Info-ZIP unzip warned on 18 copies and refused 11. Python refused 15 copies, and so did Go. Wikipedia says tools that read ZIP files correctly look for the end record first, and that tools which repair archives scan from the front. Copies 1 and 2 show both habits, because they lose the end record.
What the groups show
| Group | What we found |
|---|---|
| A. Cut short (1 to 9) | Cutting the KTH file to 4 bytes (copy 6) made all eight readers refuse it. An empty file (copy 7) was refused by six readers. bsdtar printed nothing, and LibreOffice drew a blank page. Cuts at 10, 50 and 90 percent (copies 3 to 5) made 7-Zip and bsdtar warn and extract part of the file. |
| B. Front of the file (10 to 13) | A flipped first byte (copy 10) and four zeroed bytes (copy 11) stopped bsdtar, Python, our script and LibreOffice. Text or zeros before the ZIP data (copies 12 and 13) made unzip warn, and six other readers gave the same files. LibreOffice read copy 12 as plain text and drew 76 pages of garbled characters. It refused copy 13. |
| C. End record (14 to 20) | A wrong entry count (copies 16 and 17) made Go and LibreOffice refuse the KTH file, while bsdtar, Python, our script and the parser gave the same files. One KB of junk after the end (copy 18) passed seven readers. A valid comment (copy 20) passed all eight. |
| D. Directory (21 to 26) | Wrong directory CRC or size values (copies 21 and 22) passed unzip and made most other readers warn or refuse. One changed letter in a directory name (copy 23) made Go extract a file under another name with no warning. Zip64 markers in ordinary files (copy 26) stopped nearly every reader. |
| E. Stored bytes (27 to 34) |
A flipped byte in Document, in preview or in a picture (copies 27 to 29) made all five ZIP tools warn. LibreOffice drew the same first page as the intact KTH file for copies 27 to 29 and 31. It refused copy 30 (zeroed stylesheet) and copies 32 and 33 (wrong local headers).
|
| F. Valid ZIP files with edits (35 to 50) |
Every ZIP tool accepted copies 35 to 43, 49 and 50 with changed content. The path copies (44 and 45) made bsdtar refuse a member named ../ and made unzip strip a leading slash with a warning. Controls 46 to 48 passed all eight readers.
|
Which readers warn
Our script refused 29 copies and LibreOffice refused 32. They agree on 32 of the 50 copies. The Keynote parser refused 12 and warned on 13, which is nearer the ZIP tools than the other two.
On six copies, LibreOffice drew the same first page as for the intact KTH file although a ZIP tool warned or refused. They are copies 19, 27, 28, 29, 31 and 34. Readers that forgive more are not safer, because they can hide the damage from you.
Read the grid with care. Green cells mean only that a reader gave the same answer as for the intact KTH file. We opened no copy in Keynote, so the grid shows how readers treat the ZIP archive and nothing about the theme. Every test changed one thing in a single file.
What Does Our Expert Say About KTH Files? A note from Neeraj Singh on checking before installing
List the parts of the KTH file and compare its hash with the source before you install it. Eleven edited copies passed five ZIP tools with no warning, and only readers that know the Keynote layout saw most of them. A listing takes a few seconds.
Expert insight
KTH files look like small themes, but they are ZIP archives with parts that nobody checks for you. In our tests, 11 edited copies changed what five ZIP tools extracted, and none of them warned. List the parts, compare hashes with the source and install themes only from people you trust.
Why a ZIP check proves little
A ZIP tool that opens a KTH file shows that the archive is intact. It does not show that the theme is the one you meant. In our tests, ZIP tools that found no error read edited parts as happily as the original ones.
Two readers that agree on one KTH file can both miss an extra member. Neither says whether 1 MB of data hides in the archive or whether paths leave the folder. The script from the check part lists the layout, the build and the loose items. Compare its answer with a second reader.
Hash the file first. The SHA256 hash of a KTH file shows which copy you have, and it shows if a transfer changed it later. Keep the original read only, and work on copies of KTH files.
How Do You Open a KTH File? Keynote on a Mac installs it, and a ZIP tool looks inside
Open KTH files with Apple Keynote on a Mac. Double click the file and choose Add to Theme Chooser. We found no Windows program that installs KTH files, and LibreOffice opened only the four newer KTH files we tried. ZIP tools list the parts of any KTH file.
The easy case is a Mac with Keynote. Apple's install steps say to double click the theme file, which has the .kth extension, and then click Add to Theme Chooser. The new theme lands in the My Themes group, and you choose it when you start a presentation.
We opened no KTH file in Keynote. Our tests used ZIP tools, a parser, LibreOffice and our script, so do not read our grid as a test of Keynote. The sections below cover phones, PCs and looking inside KTH files.
On a Mac
- Double click the .kth file in Finder.
- Click Add to Theme Chooser when Keynote asks.
- Start a new presentation with File and New, and choose the theme in the My Themes group.
- To make it the default, open Keynote, then Settings, then General. Select Use theme, click Change Theme and choose yours.
Apple's guide adds that custom themes are available on all your devices when you use one Apple Account and iCloud Drive is on. It also says custom themes are not available in Keynote for iCloud, the browser version.
One more point from the guide. Only changes to slide layouts are saved to a new theme, so KTH files are sets of layouts and styles and not copies of your slides.
On an iPhone or iPad
The Keynote 6.2 guide for iPhone and iPad says you can share themes through iCloud, iTunes, a WebDAV server or email. On iOS you open the email attachment in Mail, use the share menu to open it in Keynote and tap Add.
The same guide sets a naming rule. Themes that travel through a web server or webmail must end in .kth.zip to install on iOS. It says to compress the file into ZIP form to make that name.
We tested two shapes of that name. KTH files renamed to .kth.zip kept the same bytes, and all eight readers gave the same answer as for the original.
KTH files packed inside new ZIP archives showed one member to the ZIP tools, and our script and LibreOffice refused them as themes. Unpack the outer archive once before you judge the file.
On Windows, Linux or any PC
FileInfo lists only Apple Keynote on Mac as software for KTH files, and Apple names no Windows program in the guides we read. So we found no program that installs KTH files on a PC. You can still look inside, because every KTH file is a ZIP archive.
Any ZIP tool lists the parts. All five of ours read the 10 public KTH files without a rename, and copies named .zip gave the same files as the .kth originals. Extract to a new folder, and open Index or theme-files to see what the theme is made of.
LibreOffice can draw a page from the newer layout. It converted four of our 10 KTH files to one page PDFs, and it refused the six older files. Older KTH files need Keynote.
Look inside KTH files with a command line
The four commands below hash the file, show its first four bytes, list its parts and use our script. The first three work on any computer with a shell and a ZIP tool. The script in the check part is ours.
sha256sum zebra.kth
head -c 4 zebra.kth | xxd
unzip -l zebra.kth
python3 kth_peek.py zebra.kth00000000: 504b 0304 1400 0000 0000 9a65 6e47 10df PK.........enG..
00000010: 6452 2311 0000 2311 0000 1200 0000 496e dR#...#.......In
The first four bytes, 50 4B 03 04, spell PK, the ZIP signature. A version number and the name of the first member come next. In zebra.kth that name is Index/, which shows the newer layout before you read anything else.
Install KTH files on many Macs at once
A forum thread in the Jamf community says custom themes live in the user templates folder of Keynote. For one admin, copied files did not appear in the theme chooser. Another admin opened the file with a script, which makes Keynote ask users to add it. We did not test any of this.
How the readers did on our 50 damaged copies
| Reader | Result |
|---|---|
| Info-ZIP unzip | Same files on 9 copies, other content with no warning on 12, a warning on 18 and a refusal on 11. |
| 7-Zip | Same on 7 copies, other content on 13, a warning on 28 and a refusal on 2. It warns the most. |
| bsdtar | Same on 19 copies, other content on 14, a warning on 12 and a refusal on 5. It is the most forgiving. |
| Python zipfile | Same on 12 copies, other content on 13, a warning on 10 and a refusal on 15. |
| Go archive/zip | Same on 11 copies, other content on 14, a warning on 10 and a refusal on 15. |
| Our script | Same on 15 copies, another summary on 6 and a refusal on 29. It reads the layout, so it sees edits that ZIP tools miss. |
| Keynote parser | Same on 14 copies, other content on 11, a warning on 13 and a refusal on 12. |
| LibreOffice | Same first page on 15 copies, another page on 3 and a refusal on 32. |
How Do You Check a KTH File? Six steps, and a 50 line script
Check KTH files in six steps. Hash the file and read its first four bytes. Then list the parts and test the archive. Use a script that names the layout and the loose items, and compare with a second reader. No ZIP tool shows whether the theme was edited.
The six steps
- Copy the KTH file, write down its SHA256 hash and work on the copy.
-
Read the first four bytes with
head -c 4 file.kth | xxd. KTH files start with50 4B 03 04. Anything else, like text or1F 8B, means the ending is wrong. -
List the parts with
unzip -l file.kth. The nameindexmeans the older layout. IWA files in an.apxl Indexfolder mean the newer layout. -
Test the archive with
unzip -t file.kth. It reports bad checksums on parts that changed after packing. Parts that were edited and packed again pass. - Use the script below. It names the layout, the format version and the last Keynote build. It also flags loose items and unsafe paths.
- Open the KTH file in a second reader and compare the answers. Install it only after its hash matches the source you trust.
A 50 line script that reads the KTH file
The Python script below does steps 3 and 5 in about one second. It tests the ZIP archive, reads the property lists and counts the IWA parts. It prints a refusal when it cannot go on, and notes for smaller worries. It makes no slide, and it changes no file.
import re
import sys
import zipfile
import plistlib
KNOWN = {'Index', 'Data', 'Metadata', 'preview.jpg', 'preview-micro.jpg', 'preview-web.jpg',
'index.apxl', 'theme-files', 'thumbs', 'themeMetaData', 'Contents'}
def peek(path):
z = zipfile.ZipFile(path)
bad = z.testzip()
if bad:
return ['CRC error in ' + bad]
names = z.namelist()
out = ['members %d' % len(names)]
if 'index.apxl' in names:
xml = z.read('index.apxl').decode('utf-8', 'replace')
root = re.search(r'<key:(\w+)', xml).group(1)
ver = re.search(r'key:version="(\d+)"', xml).group(1)
meta = plistlib.loads(z.read('themeMetaData'))
out += ['layout 2009 XML', 'root ' + root, 'version ' + ver,
'size %s x %s' % (meta['width'], meta['height'])]
out.append('thumbs %d' % sum(n.startswith('thumbs/') for n in names))
elif any(n.startswith('Index/') and n.endswith('.iwa') for n in names):
props = plistlib.loads(z.read('Metadata/Properties.plist'))
build = plistlib.loads(z.read('Metadata/BuildVersionHistory.plist'))
iwa = [n for n in names if n.endswith('.iwa')]
masters = [n for n in iwa if 'MasterSlide' in n or 'TemplateSlide' in n]
snappy = all(z.read(n)[:1] == b'\x00' for n in iwa)
out += ['layout 2013 IWA', 'format ' + str(props['fileFormatVersion']),
'last build ' + str(build[-1]), 'iwa files %d' % len(iwa),
'masters %d' % len(masters), 'snappy chunks ok %s' % snappy]
out.append('previews %d' % sum(n.startswith('preview') for n in names))
else:
return ['no index.apxl and no Index/*.iwa, so not a Keynote theme']
extra = sorted({n.split('/')[0] for n in names} - KNOWN)
if extra:
out.append('extra top level: ' + ', '.join(extra))
odd = [n for n in names if n.startswith('/') or '..' in n.split('/')]
if odd:
out.append('unsafe paths: ' + ', '.join(odd))
return out
if __name__ == '__main__':
try:
print('; '.join(peek(sys.argv[1])))
except Exception as err:
print('cannot read: %s' % err)On good KTH files it prints the layout and the numbers that identify it. On our damaged copies it names the problem. Copy 27 fails the checksum, copy 37 has an empty IWA part and copy 43 is not a theme at all. Copy 44 has a path that leaves the folder.
python3 kth_peek.py zebra.kth
members 37
layout 2013 IWA
format 2.0.24
last build M6.6.1-2560-1
iwa files 19
masters 12
snappy chunks ok True
previews 3
python3 kth_peek.py bright.kth
members 44
layout 2009 XML
root metatheme
version 92008102400
size 1024.000000 x 768.000000
thumbs 13
extra top level: theme-bg_Snapseed.jpg
python3 kth_peek.py AndroidDesign.kth
members 50
layout 2009 XML
root metatheme
version 92008102400
size 800.000000 x 600.000000
thumbs 10
extra top level: .iWTrash, Screen Shot 2012-05-05 at 11.36.34 PM.png, download (1)-1.tiff, download-1.tiffpython3 kth_peek.py copy27.kth
CRC error in Index/Document.iwa
python3 kth_peek.py copy37.kth
masters 12
snappy chunks ok False
previews 3
python3 kth_peek.py copy43.kth
no index.apxl and no Index/*.iwa, so not a Keynote theme
python3 kth_peek.py copy44.kth
extra top level: ..
unsafe paths: ../kth-slip.txt
python3 kth_peek.py copy6.kth
cannot read: File is not a zip fileWhat the script cannot see
The script reads structure and values, and it cannot say if they are the ones you meant. It printed the same lines for copies 35, 36 and 38 as for the intact file, although they change the build history, the preview and the stylesheet. Only a second reader or a hash shows that.
It also makes no slide and does not decode the IWA parts. It checks only that every part starts with the byte 00. It cannot say whether Keynote accepts the file.
Script refusals are reasons to look closer and not verdicts. For copies 1, 2, 8 and 9, bsdtar extracted the same files as the intact file, and our script refused them.
Want the causes of an error? Go to the causes.
Is a KTH File Safe to Open? Looking is low risk, and installing from a stranger needs a check
KTH files are safe to look at and worth a check before you install them. IANA says Keynote documents are zip archives with the security risks of that format. In our tests, KTH files hid a 1 MB member and loose files, and no ZIP tool warned.
Looking at a theme is not the risk. The risk comes from what ZIP archives can store and from trusting strangers. IANA's record for KEY files says Keynote documents are zip archives, so they share the security risks of that format. KTH files use the same container, so the same care applies.
We scanned no KTH file for malware and opened none in Keynote. What we can say is what KTH files can store and how our readers treated them. Before you install a theme from the web, assume the archive can store more than the theme shows.
What can ride inside a KTH file
AndroidDesign.kth stores a trash folder, a screenshot and two TIFF pictures, 15 percent of its bytes.
../ and with a leading slash. We cover the test below.
What a KTH file can give away
Every ZIP member has a date. The newer file azusa3.kth has members from 10 August 2015 to 19 April 2024, so the dates show when the author saved it. The older KTH files show dates in 2012.
The newer layout also names its history. The BuildVersionHistory file lists every Keynote build that saved the theme, from M6.1 to M14.0 in azusa3.kth. Loose file names can say more. One screenshot in AndroidDesign has the date and the time of the capture in its name.
We did not search the compressed IWA parts for names or other personal details, so we cannot say what else they store.
The path tests
We built copy 44 with a member named ../, which climbs out of the target folder. We built copy 45 with one named /, which starts with a slash. We extracted both copies into a new folder with four ZIP tools and read them with the Go reader without writing.
No tool wrote a file outside the folder. The bsdtar tool refused the ../ member and warned. It also removed the leading slash from the other name. Unzip stripped the leading slash with a warning. 7-Zip and Python placed both members inside the folder. Our script flags both names.
This is true for the versions we used on Linux. Other tools or older versions can differ, so extract unknown archives into a new empty folder.
Check before you install
- Hash the file and compare the hash with the source, if the source lists one.
-
List the parts with
unzip -l. Look for names outside the usual folders. The newer layout usesIndex,DataandMetadata. The older layout usestheme-files,thumbsandContents. - Use our script and read its last two lines, the extra top level names and the unsafe paths.
- Extract into a new empty folder if you want to look at the pictures.
- Install only if the list matches the theme you expected.
If you share a theme of your own, list its parts first. Saving it again with File and Save Theme in Keynote writes a new theme file. We did not test whether that drops loose files, so check the new list.
Use a copy. Work on copies of KTH files, and write down their SHA256 hashes. The hash shows which file you received, and it shows if a transfer changed it later. Keep the original read only.
Why Will Your KTH File Not Open? Eight causes, and what to do about every one
KTH files stop opening for eight reasons. The file can be cut, or it can be no ZIP archive at all. Bytes can come in front of it. The end record or directory can be damaged. A part can fail its checksum or go missing. The file can be packed twice. Your reader can also lack the layout.
The table lists what our readers did with every kind of damage and what to do about it. We opened no copy in Keynote, and Keynote can behave differently from our readers.
| Cause | What we saw and what to do |
|---|---|
| Not a ZIP archive |
Cutting the KTH file to 4 bytes (copy 6) made all eight readers refuse it. An empty file (copy 7) was refused by six. Fix: Read the first bytes with head -c 4 file.kth | xxd. If they are not 50 4B 03 04, download the KTH file again.
|
| The download is cut | Copies cut at 90, 50 and 10 percent (3 to 5) were refused by unzip, Python, Go and our script. 7-Zip and bsdtar warned and extracted part of the file. Fix: Download the KTH file again and compare its size with the source. Do not install a theme that a tool extracted only in part. |
| Bytes in front of the archive |
Text before the ZIP data (copy 12) and 4 KB of zeros (copy 13) made unzip warn, while six other readers gave the same files. LibreOffice read copy 12 as text and refused copy 13. Fix: Cut everything before the first 50 4B 03 04, or fetch the KTH file from the source again.
|
| A damaged end record or directory |
Across copies 14 to 26, bsdtar gave the same files as the intact copy on 9, Python on 5 and Go on 3, while LibreOffice refused 11 of the 13. Fix: Test with unzip -t and try a second ZIP tool. Treat any KTH file that only one tool opens as suspect.
|
| A part fails its checksum | Flipped bytes, flipped bits or blocks of zeros in a part (copies 27 to 31) made all five ZIP tools warn. LibreOffice still drew the same first page for four of the five, so readers that forgive can hide damage. Fix: Download the KTH file again. |
| Parts are missing or renamed |
Four edits made our script and LibreOffice refuse the KTH file. They are no Metadata folder (copy 42), Index renamed to index (copy 43), two Properties members (copy 49) and no IWA files (copy 50). Fix: List the parts with unzip -l and compare them with a good KTH file of the same layout.
|
| Packed twice or locked | KTH files inside new ZIP archives showed one member to the ZIP tools, and our script and LibreOffice refused them. A ZipCrypto password made every reader refuse or warn. Fix: Unpack the outer archive once. If a password is set, ask the sender for an unlocked copy. |
| Your reader knows one layout | LibreOffice drew a page from the four newer KTH files and refused the six older ones with the message that the source file could not be loaded. Fix: Open older KTH files in Keynote on a Mac. Renaming the file did not change the answer. |
Fix a KTH file in seven steps
- Copy the KTH file, write down its SHA256 hash and work on the copy.
-
Read the first four bytes as in the check steps. Look for
50 4B 03 04. -
Test the archive with
unzip -t file.kth, and read every warning it prints. -
List the parts with
unzip -l file.kth. Look forindexor for IWA files in.apxl Index. - Read the KTH file with the check script. Its notes or refusals name the point where the structure stops making sense.
- Compare the size of the KTH file with the source. Smaller files are cut, and larger ones can include loose members.
- If it still fails, get a fresh copy from the source and compare the hashes.
We did not test repairs on files from other people. A file that extracts can still fail in Keynote, and a KTH file that fails in one tool can open in another. For example, bsdtar extracted the same files as the intact copy from four cut copies that our script refused.
What to send when you ask for help
If friends, shops or support teams gave you KTH files that fail, send them these lines. They show what was read and where it stopped, and they save rounds of questions.
Subject: KTH file will not open
File: name, size in bytes and SHA256 hash
First bytes: the output of head -c 4 file | xxd
ZIP test: the output of unzip -t file
Script: the output of kth_peek.py
App: the name and version of the app that fails, and what it printed
Source: where the KTH file came from and how it was copiedNot damage, but a question about other file types? Go to the versus part.
How Do You Make or Convert a KTH File? What 15 files we made show, and what converting costs
There is no true converter for KTH files. To make a theme, use File and Save Theme in Keynote. LibreOffice changes KTH files into one slide PPTX files that keep no masters and no pictures, and a rename changes no byte.
Making KTH files differs from opening them. Keynote writes the theme, and no other program we found does. We made 15 test files from two public KTH files to see what the format allows. We also tried the one conversion path that exists, which is LibreOffice.
Make a KTH file in Keynote
- Open or build a presentation that has the layouts and styles you want.
- Choose File and then Save Theme.
- Click Add to Theme Chooser to keep it in My Themes, or click Save to write a .kth file to your computer.
- To send it to an iPhone through a web server or webmail, end the name in .kth.zip.
Apple's page on saving a theme says the same, and adds that only changes to slide layouts are saved to new themes. We made no theme in Keynote ourselves, so we cannot say what Keynote adds to the file.
The 15 test files we made
| File | What it shows |
|---|---|
| Ending .kth.zip |
The same bytes as zebra.kth, under the ending Apple asks for on iOS. All eight readers gave the same answer.
|
| Renamed to KEY | The same bytes under a KEY name. All eight readers gave the same answer. |
| Renamed to ZIP | The same bytes under a ZIP name. All eight readers gave the same answer. |
| Every member deflated | The parts packed with compression. The files extracted and the page drawn stayed the same. |
| ZIP inside a ZIP |
A new archive around zebra.kth. The ZIP tools saw one member, and our script and LibreOffice refused it.
|
| Older theme renamed to KEY |
The older bright under a KEY name. ZIP tools read it, and LibreOffice refused it.
|
| Root word changed |
The older theme with presentation in place of metatheme. LibreOffice drew a page from it.
|
| Index folded into Index.zip |
The Index parts packed in one inner archive. Our script refused it, and LibreOffice drew the same page as for the original.
|
| Index and Data removed | Only metadata and previews were left. Our script and LibreOffice refused it. |
| Properties as XML |
Properties saved as XML and not binary. Our script and LibreOffice gave the same answers as for the original.
|
| Previews removed | The three preview pictures were taken out. LibreOffice drew the same page, and our script printed a preview count of 0. |
| Mac extras added |
A __MACOSX folder and .DS_Store files were added, as Macs add them. LibreOffice drew the same page, and our script named the extras.
|
| ZIP comment added | A valid comment on the archive. All eight readers gave the same answer. |
| Members reversed | The parts were written in reverse order. All eight readers gave the same answer. |
| Password set | The parts were locked with a ZipCrypto password. Every reader refused or warned. |
The first four rows show that the ending, the compression and the order of the parts change no answer. The next rows show that readers look at the content. New outer archives, a missing Index or a missing Metadata folder make our script refuse the file.
Convert a KTH file to another format
LibreOffice is the only program we found that reads KTH files and writes something else. We converted zebra.kth and azusa3.kth to PPTX files. Both results have one slide, one master and no pictures. The PPTX files weigh 6.6 KB and 7.3 KB.
The originals have 12 and 28 master slides, and they store 12 and 30 files in Data. So the PPTX file keeps the shape of one sample slide and loses the theme. A page from the theme can help as a preview, but it does not replace the theme.
| To | Result |
|---|---|
| PPTX | One slide with one master and no pictures, from LibreOffice, and only for the newer layout. The theme itself is lost. |
| One page, drawn by LibreOffice from a newer file. See what a PDF file is. | |
| ZIP | A rename. The bytes stay the same, so ZIP tools read it either way. See what a ZIP file is. |
| JPG pictures |
Extract the archive and take the pictures from Data or theme-files. See what a JPG file is.
|
Renaming KTH files to KEY changes no byte, and we did not test what Keynote does with them. The older layout has another root word than Keynote 09 presentations, so renaming alone does not change themes into presentations. For PowerPoint slides, read about PPT presentations.
How Does a KTH File Differ From KEY and POTX Files? Themes, presentations and PowerPoint templates
KTH files are Keynote themes, and KEY files are Keynote presentations. Both are ZIP archives. Two PRONOM signatures for Apple iWork files, one for Keynote 09 and one for iWork 14, together match all 10 of our KTH files. POTX files are the PowerPoint cousins of KTH files, and they are also ZIP archives.
People mix these types up, and the ending does not stop them. A theme stores layouts, styles and sample content. A presentation stores your slides. IANA's record registers application/ for KEY files and says Keynote documents are zip archives. It does not mention .kth.
PRONOM, the format registry of the UK National Archives, lists a signature for Keynote 09 files (fmt/646) and one for iWork 14 files (fmt/1441). The first looks inside index for the Keynote namespace and the version string 92008102400. The second looks for Metadata/ and Index/ and a short byte pattern.
The six older KTH files match the first signature, and the four newer ones match the second. Neither signature alone matches all 10, so KTH files look like KEY files to a registry. PRONOM does not list the .kth ending itself.
| Type | What it is | Container | First bytes |
|---|---|---|---|
| KTH | A Keynote theme | ZIP archive with two layouts |
50 4B 03 04
|
| KEY | A Keynote presentation | ZIP archive, per IANA | Not listed by IANA |
| POTX | A PowerPoint template | ZIP archive, in our test |
50 4B 03 04
|
| KTH.ZIP | A KTH file for iOS mail or web | A renamed or repacked KTH file |
50 4B 03 04
|
Microsoft's page on templates says slide designs save as templates with the .potx extension. We made a POTX file with LibreOffice from one test slide. It starts with 50 4B 03 04 and has 65 members.
A shared container does not make files interchangeable. The ZIP part is the same, and the meaning of the parts differs. KEY files store slides, and POTX files store a PowerPoint design. Keynote reads one kind of part and PowerPoint reads another.
Our PPT file guide covers PowerPoint presentations, and our ZIP file guide covers the container itself. The PNG file guide covers the lossless picture type that themes can store.
What Is the KTH File Format Made Of? The facts we could check, and where they came from
The KTH file format is a ZIP archive in one of two layouts. The facts below come from Apple, FileInfo, IANA, PRONOM, Wikipedia and our checks of 10 public KTH files, 15 test files and 50 damaged copies. We opened none of them in Keynote.
| Part | What we could check |
|---|---|
| Name | Keynote theme. Files end in .kth. FileInfo files the type under Apple and Keynote. (FileInfo, Apple) |
| Container |
ZIP archive. Every entry starts with a local header, 50 4B 03 04. (Wikipedia)
|
| Older layout |
index as XML, a themeMetaData property list, theme-files, thumbs and Contents. PRONOM has a signature for Keynote 09 files (fmt/646).
|
| Newer layout |
IWA files in Index, pictures in Data and property lists in Metadata. PRONOM has a signature for iWork 14 files (fmt/1441).
|
| IWA part | A Protobuf stream wrapped in a Snappy stream, with no stream identifier and no checksum. (iWorkFileFormat project notes) |
| MIME type |
None found for .kth. IANA lists application/ for KEY files and does not mention .kth. (IANA)
|
| Install | Double click the file, then Add to Theme Chooser. The theme lands in My Themes. (Apple) |
| iOS name | Themes sent by web server or webmail must end in .kth.zip. (Apple, Keynote 6.2 guide) |
| Sync | With iCloud Drive and one Apple Account, custom themes reach all your devices. They are not available in Keynote for iCloud. (Apple) |
| First release | Keynote 1.0 came out in 2003. (Wikipedia) |
| Our counts | 10 public KTH files, 15 test files, 50 damaged copies and eight readers. |
About the values we list
Facts about Keynote come from the sources named in the rows. Counts were checked against our own files. FileInfo is a directory, so we use it for the name and the program only.
The newer layout has three format versions in our four KTH files. We read them from Properties, and we found no table that says which Keynote version writes which number, so we name no mapping.
What we left out
We tested on Linux only. We used five ZIP tools, a Keynote parser, LibreOffice and one script. We opened no KTH file in Keynote on a Mac or an iPhone, and we used no Windows tool. We scanned no file for malware.
We found 10 public KTH files in five projects, and no larger public set that we could find. Our damaged copies change one thing at a time in copies of one base file, zebra.kth. Readers that fail on our files can work on yours, and the reverse is true as well.
We could not confirm a MIME type for .kth. FileInfo names Keynote on Mac as the only program, and we found no evidence that other programs open KTH files, so we name none. We did not test whether Keynote separates themes from presentations by the root word, or which Keynote versions open which layout.
The Jamf advice comes from a forum thread that we did not test. We did not search the IWA parts for names or other personal details. We tested no THMX file.
Sources checked
For the extension, see the FileInfo page on KTH files. For saving, installing and syncing themes, see Apple's Keynote 14.4 guide. For the iOS name and the ways to share a theme, see Apple's Keynote 6.2 sharing guide.
For the container, see Wikipedia on ZIP files. For Keynote and its file types, see the Wikipedia article on Keynote. For the media type of KEY files, see the IANA registration. For POTX files, see Microsoft's help on slide design templates.
PRONOM, the iWorkFileFormat project notes and the Jamf forum thread are named as text only. We found no SysTools or Freeviewer tool for KTH files, so this page links to none. Every count came from the files and scripts in our research folder.
Frequently Asked Questions About KTH Files
What is a KTH file?
A KTH file is a Keynote theme saved as a ZIP archive. It stores layouts, styles and pictures that Keynote reuses for new slides. FileInfo files KTH files as presentation themes made by Apple. The ZIP signature 50 4B 03 04 starts all 10 public KTH files we read.
How do I open a KTH file?
On a Mac with Keynote, double click the file and click Add to Theme Chooser. The theme appears in the My Themes group. ZIP tools list the parts of any KTH file. We opened no KTH file in Keynote, so our tests cover the tools around it.
Why does my KTH file not open?
Eight causes cover what we found. The file can be cut or not a ZIP archive at all. Bytes can come in front, or the end record or directory can be damaged. A part can fail its checksum or go missing. The file can be packed twice, or your reader can lack the layout.
Is a KTH file a ZIP file?
Yes. All 10 public KTH files we read are ZIP archives, and five ZIP tools extracted all of them. Two layouts of parts are inside. The older one has an index.apxl file, and the newer one has IWA files in an Index folder. The ending .kth is only a label.
Is a KTH file safe to open?
Looking at themes is low risk, and IANA says Keynote documents are zip archives with the security risks of that format. In our tests, KTH files stored 1 MB of hidden data and loose files with no warning from five ZIP tools. We scanned no file for malware. Check the parts before you install a theme from a stranger.
What is the difference between a KTH file and a KEY file?
KTH files are Keynote themes, and KEY files are Keynote presentations. Both are ZIP archives. Two PRONOM signatures for Apple iWork files together match all 10 of our KTH files. A theme stores layouts and styles, and a presentation stores your slides. Renaming one to the other changes no byte.
How do I open a KTH file on Windows?
We found no Windows program that installs KTH files, and FileInfo lists only Keynote on Mac. ZIP tools can list and extract the parts, and the pictures inside open in any viewer. LibreOffice drew a page from the four newer KTH files we tried and refused the six older ones.
How do I install a KTH file on an iPhone or iPad?
Apple says themes sent through a web server or webmail must end in .kth.zip. Open the email attachment in Mail, use the share menu to open it in Keynote and tap Add. Themes in iCloud Drive reach your devices on their own. We did not test this on a phone.
How can I check if a KTH file is damaged?
Hash the file, read its first four bytes, test the archive with unzip and use a script that names the layout. Then open it in a second reader. Five ZIP tools gave the same kind of answer on only 22 of 50 damaged copies, so one reader proves little.
Can LibreOffice open a KTH file?
It opened four of our 10 KTH files, the ones with the newer layout, and drew one page from every file. It refused the six older files. When we changed the root word inside an older file from metatheme to presentation, LibreOffice drew a page. It reads the root word and not the ending.
How do I make or convert a KTH file?
In Keynote, choose File and Save Theme, then add it to the theme chooser or save it to your computer. We found no true converter. LibreOffice changed a KTH file into a PPTX file with one slide, one master and no pictures, so the theme itself was lost.
What is the MIME type of a KTH file?
We could not confirm one. IANA registers application/vnd.apple.keynote for KEY files and does not mention KTH files. Servers can send a generic type for KTH files, and the ZIP signature 50 4B 03 04 is a better guide to what the file is.
Still Stuck With a KTH File? Two routes out, and where to look next
Read the first bytes and follow the seven steps. The cause table lists what to try in order.
Read what can ride inside a KTH file, and then the checks before you install.
Is it a presentation? Our page on PPT presentations covers PowerPoint slides, and the versus part covers how KEY and POTX files relate to a theme.
Is it a zip in disguise? A KTH file is one. Our page on the ZIP container covers the container, and the path tests show how we extracted unsafe names.
Do you need the pictures? Extract the archive and look in Data or theme-files. Our page on JPG pictures covers the picture type inside most themes.
Is it an unknown file type? Browse the file extension resource library, or send it on the submit a file type page.