A download can look like a PDF in its name while actually ending in .exe. Before opening an unexpected attachment, make Windows show the filename ending and compare it with what you expected to receive. This guide is for Windows 11 and follows Microsoft’s documentation; the examples are illustrative, not files we tested.
Safety first: do not double-click an unfamiliar file to discover what it is. Showing extensions helps you inspect a name, but it does not prove a file is safe. A genuine PDF can still contain deceptive links.
1. Show the ending without opening the file
Open File Explorer from the taskbar and go to the folder containing the download. Select View → Show → File name extensions. Microsoft documents this setting in its guide to Windows filename extensions.
Expected result: common files display endings such as .pdf, .jpg or .docx. If the name is cut off, use Details view and widen the Name column until you can read its end. This changes the display; it does not convert or repair a download.
If the ending still seems unclear, right-click the file and choose Properties without opening it. Compare the name with the listed file type. If your device is managed and you cannot find or change the display option, ask your administrator rather than applying registry fixes.
2. Compare the complete name with the promised file
Use this decision check before choosing an app:
| Illustrative name | What to check next |
|---|---|
invoice.pdf |
The ending matches a PDF, but confirm the source and whether you expected an invoice. |
invoice.pdf.exe |
The final ending is an executable program. Stop if you expected a document. |
invoice.zip |
This is an archive, not the invoice itself. Its name does not establish what its contents are. |
invoice.pdf.pdf |
A repeated ending alone is not proof of malware. Check the source and full file type. |
A familiar icon or a reassuring word earlier in the name is insufficient evidence. Treat a mismatch as a reason to verify the delivery through a contact method you already trust. Do not use a phone number supplied only in the suspicious message. Our suspicious-message checklist covers that source check.
3. Do not fix a mismatch by renaming it
Renaming invoice.pdf.exe to end in .pdf does not turn the program into a document. Microsoft explains that changing an extension changes the name, not the underlying format.
If the sender confirms that they intended a PDF, ask them to provide the correct export through the usual trusted channel. If a file is important and its correct format is uncertain, preserve the original and seek help before making edits. Avoid uploading private attachments to unfamiliar “file repair” or conversion sites.
4. Separate a wrong app from a wrong file
If the file really ends in .pdf, comes from a verified source and is expected, opening in a browser instead of your preferred reader is a different problem. Follow our Windows 11 PDF default-app guide; do not rename the extension to change the app.
If the file has already been opened and prompted you to install software, enter credentials or enable something unexpected, stop following those instructions. Record what happened without reopening it. Use our guide to getting help after a suspected compromise for the next step.
Finish check: you can read the complete filename, its ending fits the expected delivery, and you have verified the source independently when anything looks wrong. Keeping extensions visible makes that check easier next time; it is one precaution, not a safety guarantee.
Was this helpful?
Help us make our guides more useful.
No sign-in needed. This browser remembers your response for up to 180 days.