What is the HWP file format?
.hwp files are associated with Hanword (formerly known as Hangul Word Processor), developed by Hancom Inc. of South Korea.
Files with the .hwp extension, besides text, can store text formatting information, charts, graphics, tables, and other document elements. The format uses an OLE2 Compound File Binary (CFBF) container - the same binary structure that underlies legacy Microsoft Word .doc files - with individual content streams compressed using zlib. The FileHeader stream inside the container opens with the ASCII signature HWP Document File.
Hangul is the name of the Korean alphabet. Hanword offers native support for Hangul characters, which is one of the main reasons for its enormous popularity on the Korean market. The Korean government and institutions have adopted Hanword as their standard word processor, making .hwp the de facto official document format in South Korea.
There are several tools for opening and converting .hwp files into other popular document formats. LibreOffice Writer supports .hwp natively, and Hancom provides a free Hancom Office Viewer. Because .hwp is deeply embedded in South Korean bureaucracy, it is also a frequent target of malware campaigns - malicious .hwp files exploiting embedded OLE objects are a documented attack vector used by APT groups including Lazarus Group. The format's successor, .hwpx, is an open XML-based container that became the Hancom Office default in April 2021.
Security & safety
RISK: HIGHHWP is a documented malware delivery vector. North Korean APT groups (including Lazarus Group), as well as other threat actors, regularly exploit vulnerabilities in Hancom Hangul's OLE object and embedded script handling to deliver malware to Korean-speaking targets. Multiple CVEs affect Hancom Hangul. Never open an unexpected or unsolicited HWP file on a production system without scanning it first. For users who simply need to read the content of an HWP received from a known trusted source, using LibreOffice (which has a more limited attack surface than Hancom Hangul) or an online converter is safer.
Format details
in a nutshell- Haansoft HWP legacy variants (HWP 2.x/3.x) - Earlier binary formats (.hwp) from the DOS/early-Windows era, structurally different from HWP 5.x; rare today.
Programs that open HWP files
Technical details
deep spec| Container format | OLE2 Compound File Binary Format (CFBF); magic bytes `D0 CF 11 E0 A1 B1 1A E1` - same container as legacy `.doc`, `.xls`, `.ppt` |
| Internal signature | `FileHeader` stream opens with ASCII string `HWP Document File` (hex: 48 57 50 20 44 6F 63 75 6D 65 6E 74 20 46 69 6C 65) |
| Byte order | Little-endian throughout (OLE2 CFBF standard) |
| Content compression | Per-stream zlib compression applied to content streams inside the OLE2 container |
| MIME type | `application/x-hwp` (also registered as `application/vnd.hancom.hwp`) |
| Internal streams | `FileHeader`, `BodyText` (paragraphs), `DocInfo` (properties), `BinData` (embedded images/objects), `PrvText` (plain-text preview), `PrvImage` (thumbnail) |
| Encryption | Optional password protection using RC4 or AES; encrypted state flagged in the `FileHeader` stream |
| Version field | HWP format version stored as `5.x.y.z` in the `FileHeader` stream (e.g., `5.1.0.0`) |
| Text encoding | Hangul and other Unicode text stored as UTF-16LE within content streams |
| Security risk | Documented malware delivery vector (APT campaigns including Lazarus Group); malicious embedded OLE objects are a known attack mechanism |
| Typical file size | 20 KB - 50 MB; grows substantially with embedded images or OLE objects |
| Successor format | `.hwpx` - Hancom's open ZIP/XML-based format; became the Hancom Office default on April 15, 2021 |
| Released | 1989 (HWP 1.0, MS-DOS) |
| Latest version | HWP 5.x (last widely used binary format; default changed to HWPX on April 15, 2021) |
| Open standard | Yes · royalty-free |
| Specification | www.hancom.com |
HWP conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about HWP files.