Header block

Every entry in a tar archive starts with a header of exactly 512 bytes. It holds the entry’s name, permissions, owner, size, time and type. The numbers are written as text, in octal, so the header can be read in a text editor.

Fields

This is the ustar layout from POSIX.1-1988, which pax archives also use. Offsets and sizes are in bytes; the examples come from the header shown further down.

Offset	Size	Type	Name	Description
`0`	100	string	`name`	The entry’s name, or the last part of its path when `prefix` is used. Example: `hello.txt`.
`100`	8	octal	`mode`	Permission bits, plus 4000 setuid, 2000 setgid and 1000 sticky. Example: `000644`.
`108`	8	octal	`uid`	Numeric user ID of the owner. Example: `001750`, which is 1000.
`116`	8	octal	`gid`	Numeric group ID.
`124`	12	octal	`size`	Number of bytes of data after the header. Zero for folders and links. Example: `00000000015`, which is 13.
`136`	12	octal	`mtime`	Modification time in seconds since 1 January 1970 UTC. Example: `14712530600`, which is 1730851200, midnight UTC on 6 November 2024.
`148`	8	octal	`chksum`	The header checksum, explained below.
`156`	1	character	`typeflag`	What the entry is. See type flags. Example: `0`, a regular file.
`157`	100	string	`linkname`	The target of a hard or symbolic link.
`257`	6	string	`magic`	`ustar` and a NUL byte.
`263`	2	string	`version`	The two characters `00`.
`265`	32	string	`uname`	Owner’s user name. A reader uses it in place of `uid` when that user exists.
`297`	32	string	`gname`	Owner’s group name.
`329`	8	octal	`devmajor`	Major device number, for character and block devices.
`337`	8	octal	`devminor`	Minor device number.
`345`	155	string	`prefix`	The folder part of a path too long for `name`.
`500`	12	padding	`pad`	Zeros, bringing the header to 512 bytes.

Example

The header of a 13-byte file, hello.txt, written by bsdtar in ustar format. Rows that are all zeros are shown as *. The marked bytes are the magic and version.

00000000  68 65 6C 6C 6F 2E 74 78 74 00 00 00 00 00 00 00  hello.txt.......
*
00000060  00 00 00 00 30 30 30 36 34 34 20 00 30 30 31 37  ....000644 .0017
00000070  35 30 20 00 30 30 31 37 35 30 20 00 30 30 30 30  50 .001750 .0000
00000080  30 30 30 30 30 31 35 20 31 34 37 31 32 35 33 30  0000015 14712530
00000090  36 30 30 20 30 31 32 37 31 32 00 20 30 00 00 00  600 012712. 0...
*
00000100  00 75 73 74 61 72 00 30 30 75 73 65 72 00 00 00  .ustar.00user...
*
00000120  00 00 00 00 00 00 00 00 00 75 73 65 72 00 00 00  .........user...
*
00000140  00 00 00 00 00 00 00 00 00 30 30 30 30 30 30 20  .........000000 
00000150  00 30 30 30 30 30 30 20 00 00 00 00 00 00 00 00  .000000 ........
*

A real ustar header for hello.txt, with zero rows shown as *.

Strings and paths

Text fields are padded with NUL bytes. A value that fills the whole field has no NUL at the end, so a 100-character name uses all 100 bytes of name.

A path longer than 100 characters can be split at a /: the part before the slash goes in prefix, the part after it in name, and the slash itself is not stored. A reader joins them as prefix/name. This gives paths of up to 256 characters, as long as the split falls in the right place. Longer paths need a pax header or a GNU long name. A folder’s name ends with /.

Numbers

Numeric fields hold octal digits as ASCII text, with leading zeros, ended by a space or a NUL. Writers differ in the ending: in the example, mode is six digits, a space and a NUL, while size is eleven digits and a space. A reader should accept either.

The field sizes set limits. With 11 digits, size reaches 8 GiB less one byte, and with 7 digits uid and gid reach 2,097,151. Larger values are written in one of two ways:

Base-256, from GNU tar: if the top bit of the field’s first byte is set, the field is a big-endian binary number instead of text. A first byte of 80 marks a positive number held in the remaining bytes, and FF marks a negative one. Most readers accept this.
Pax records, from POSIX: the true value goes in a size, uid or gid record in a pax header, as decimal text of any length.

Checksum

The checksum is the sum of all 512 bytes of the header, each read as an unsigned number, with the eight bytes of the chksum field itself counted as spaces (8 × 32 = 256). It is stored as six octal digits, a NUL and a space. Some old writers summed signed bytes, so careful readers accept either sum.

In the example the sum comes to 5,578. In octal that is 12712, so the field holds 012712, a NUL and a space:

00000090  36 30 30 20 30 31 32 37 31 32 00 20 30 00 00 00  600 012712. 0...

The checksum field at bytes 148 to 155.

A reader recomputes the sum and compares. A block of zeros fails the check, which is how the end of the archive is told apart from a header.

Magic and version

Bytes 257 to 264 tell the header variants apart:

Bytes 257 to 264	Variant
`ustar` NUL `00`	POSIX ustar, and pax archives
`ustar` space space NUL	GNU tar’s own format, whose fields from byte 345 on differ; see GNU extensions
all zeros	the original Version 7 header, which ends at `linkname`