An executable file, often simply called an executable, is a file that contains instructions a computer can run directly, together with the metadata an operating system needs to load those instructions into memory and start a process. In software fundamentals, it is the end product that turns source code into a program a user or system can launch.
An executable differs from an ordinary data file in two ways: its contents follow a binary format that the operating system loader understands, and the system grants it permission to execute. Depending on the platform, the file holds native machine code for a specific processor, bytecode for a runtime such as a virtual machine, or a script that an interpreter reads line by line.
How an executable file becomes a running process
Running an executable is the job of the operating system loader, which reads the file header, maps the code and data sections into a fresh virtual address space and transfers control to the entry point. The header tells the loader which processor architecture the code targets, where each section belongs in memory and which shared libraries the program needs.
Most modern executables are dynamically linked, so the loader also invokes a dynamic linker that locates required libraries, maps them into the process and fills in the addresses of the functions the program calls. A statically linked executable carries all of its library code inside the file, which makes it larger but independent of the libraries installed on the target system.
The typical sequence from launch to execution is shown below.
- The user or another program asks the operating system to start the file.
- The kernel checks execute permission and, on some systems, the code signature.
- The loader parses the header and maps code, data and stack into memory.
- The dynamic linker resolves shared library dependencies and relocations.
- Control passes to the entry point, and the program begins running as a process.
Executable formats on major platforms
Each operating system family defines its own executable file format, and a file built for one format will not run natively on another. The format determines the header layout, how sections are described and how dependencies are recorded.
| Format | Platforms | Typical file extension | Notable feature |
|---|---|---|---|
| PE (Portable Executable) | Windows | .exe, .dll | Import tables list required DLL functions |
| ELF | Linux, BSD, Android, most Unix systems | None required | Flexible sections and program headers |
| Mach-O | macOS, iOS | None required | Universal binaries bundle several architectures |
| COFF-based formats | Older Unix, embedded toolchains | .o, .out | Ancestor of PE and several object formats |
File extensions matter mainly on Windows, where .exe marks a program and the shell uses the extension to decide how to open a file. Unix-like systems ignore the extension and instead rely on the execute permission bit and on the first bytes of the file, called the magic number, to identify the format.
Native, bytecode and script executables
Not every executable contains machine code. The broad term covers three families that differ in what actually runs the instructions, and this distinction affects portability, startup time and distribution.
| Kind | What the file contains | What runs it | Portability |
|---|---|---|---|
| Native executable | Machine code for one CPU architecture | The processor directly | One operating system and architecture |
| Bytecode executable | Instructions for a virtual machine | A runtime such as the JVM or .NET CLR | Any platform with that runtime |
| Script | Human-readable source text | An interpreter named in the first line or by association | Any platform with that interpreter |
| Self-contained bundle | Native launcher plus runtime and code | The embedded runtime | One target platform, no installed runtime needed |
On Unix-like systems a script becomes executable when it has the execute bit set and begins with a shebang line such as #!/usr/bin/env python3, which tells the kernel which interpreter to start. Bytecode files, such as Java archives, usually need a launcher command unless the system associates the extension with the runtime.
Executable files and related software concepts
Several neighboring terms in software fundamentals describe files that resemble executables but play a different role. Telling them apart prevents confusion when installing, debugging or securing software.
| Artifact | Can it be launched directly | Relationship to an executable |
|---|---|---|
| Source code | No, except interpreted scripts | Input that a compiler turns into an executable |
| Object file | No | Intermediate output that a linker combines into an executable |
| Shared library | No, it is loaded by a program | Code that an executable uses at run time |
| Installer package | Usually yes, through an installer | Container that places executables and files on a system |
| Configuration file | No | Data that changes how an executable behaves |
The boundary between an executable and a library is thinner than it seems: on Windows both use the PE format, and on Linux a shared library is an ELF file that some systems can even run directly. The difference lies in whether the file defines a program entry point intended for launch.
Security risks and safe handling
Because an executable runs with the privileges of the user who starts it, it is the most common vehicle for malware. Operating systems therefore add several layers of control before and during execution.
- Code signing lets the system verify the publisher and detect tampering after signing.
- Download quarantine marks cause a warning the first time a file from the internet is opened.
- Address space layout randomization and non-executable memory make exploits harder.
- Application allowlisting in managed environments permits only approved executables to run.
- Disguised extensions, such as a document name followed by .exe, remain a frequent social engineering trick.
The safest practice is to run executables only from trusted sources, keep extensions visible in the file manager and verify published checksums or signatures for software downloaded outside an official store.
Stripped to the essentials
An executable file is a file that does something when it is opened. Most files hold information, such as a photo or a letter, and need a program to show them. An executable is the program itself.
A useful comparison is a recipe already translated into the cook’s own language. The computer reads it and follows the steps immediately. Because it gives the computer orders, an executable should come only from a source that is trusted.
Where it is applied
A small engineering team writes a command-line tool that converts sensor logs into reports. They compile it into three native executables: a PE file for Windows, an ELF file for Linux servers and a universal Mach-O file for Mac laptops with both Intel and Apple processors.
To avoid dependency problems on customer machines, they build the Linux version as a statically linked executable of about 12 MB, compared with 3 MB for the dynamic build. They sign the Windows and macOS files, publish SHA-256 checksums with each release and see far fewer support requests about missing libraries and security warnings.