XZ MIME Type

What does application/x-xz mean?

The application/x-xz media type identifies data stored in the XZ compressed stream format, normally in a file ending in .xz. XZ compression is lossless, so successful decompression reproduces the original bytes exactly.

The XZ format specification itself names .xz and application/x-xz.¹ IANA's current application media-type registry does not list the subtype, so this is a widely deployed but unregistered media type. The x- prefix is part of that conventional name, not a separate version of XZ.²

Where did XZ come from?

Lasse Collin and Igor Pavlov designed the XZ file format. Version 1.0.0 of its specification was published on January 14, 2009, as a replacement for the older LZMA-Alone format used by LZMA SDK and LZMA Utils.¹

XZ Utils is the reference command-line and library implementation. Its compression core is based on Pavlov's LZMA SDK but was substantially adapted for XZ Utils. The suite includes the xz command, the liblzma library, and a smaller decompression-only program named xzdec.³

XZ is a container for filter chains rather than the name of one bare compression algorithm. Current XZ streams commonly end their filter chain with LZMA2, an updated form of LZMA1. Optional executable and delta filters can transform certain inputs before LZMA2 compresses them.⁴

How do you identify an XZ file?

Every XZ stream begins with these six bytes:¹

FD 37 7A 58 5A 00
   7  z  X  Z

The non-text bytes at either end help prevent confusion with an old .lzma stream or a text file. A complete XZ stream also ends with 59 5A, the ASCII letters YZ, before any permitted padding. Checking both ends can quickly reveal a truncated download, but only a decoder can validate the complete block structure and integrity fields.¹

An XZ file can contain multiple concatenated streams. Each stream contains a header, one or more compressed blocks, an index, and a footer. The index records block sizes and enables limited random access when the file was divided into suitably small independent blocks.¹⁵

Test a complete file without saving its decompressed output:

xz --test --verbose download.xz

XZ always protects structural headers with CRC32. A stream can protect uncompressed data with CRC32, CRC64, or SHA-256, or omit the data check. XZ Utils uses CRC64 by default.¹⁴ These checks detect accidental corruption. They do not authenticate the sender or make the output safe to open.

How do you open an application/x-xz file?

Web browsers do not provide a native XZ file viewer or decompression API. When a browser cannot display a response's media type, it normally offers the file as a download for another application.⁶

• XZ Utils supplies xz, unxz, and xzcat on Unix-like systems and also publishes Windows builds.³⁴
• 7-Zip can pack and unpack XZ streams.⁷
• GNU tar can call an XZ decompressor when working with .tar.xz archives.⁸

To preserve the compressed input while writing the decompressed file:

xz -dk report.csv.xz

For a TAR archive, inspect the members before extraction:

tar -tJf source.tar.xz
tar -xJf source.tar.xz -C empty-directory

The .xz stream does not store an original filename. XZ Utils derives an output name by removing the suffix, while the contents themselves could be text, an image, a TAR archive, or any other byte sequence.⁴

Support in Poly

Poly recognizes the .xz extension as application/x-xz and classifies the file as an archive. It can store, sync, share, version, download, and find the file by name.

Poly treats the compressed bytes as opaque:

• It does not decompress the XZ stream or inspect a TAR archive inside it.
• It does not index decompressed text, tar member names, or member metadata.
• It does not generate a thumbnail or provide an in-app archive browser.
• The Poly agent cannot read or reason about the compressed payload.

Download and decompress the file with a trusted utility when you need its contents. Adding the decompressed result to Poly separately lets that file use the preview and indexing pipeline for its own format.

Poly's filename mapping recognizes .xz, including a compound name such as backup.tar.xz because its final extension remains .xz. It does not map the shorthand .txz to this media type.

XZ, LZMA, and .tar.xz are different layers

These names are related, but they do not describe interchangeable files:

Renaming archive.tar.xz to archive.tar does not decompress it. One XZ decompression step produces the tar file, after which a tar program can list or extract its members. Likewise, changing .lzma to .xz does not add the XZ header, index, footer, or integrity checks.¹⁴

To convert .tar.xz to ZIP, safely extract the TAR archive and create a new ZIP archive from the extracted tree. Converting a plain .xz first requires discovering what single file emerges after decompression.

Safety, memory, and integrity

Compression can make a small input expand into a much larger output. XZ's decoder memory requirement is also set by compression options stored in the file. The XZ Utils manual notes that ordinary preset -9 data currently needs about 65 MiB to decode, while specially constructed valid XZ files can require several gigabytes. Use --memlimit-decompress and an output-size limit when processing untrusted data.⁴

If the output is a TAR archive, review paths and links before extraction. Absolute paths, parent-directory references, symbolic links, executables, and unexpectedly large members can be dangerous even when the outer XZ checks pass.

Keep the decoder patched and obtain it from a trusted source. XZ Utils release tarballs 5.6.0 and 5.6.1 contained the CVE-2024-3094 backdoor. The incident affected those compromised software releases, not the XZ file-format specification or ordinary XZ data created by trustworthy tools.³