There is one catch, and it matters. Showing extensions does not show every extension. Below are the steps for current Windows releases, the threat behind the advice, and the blind spot the usual tip leaves out.
Why the extension matters
Microsoft's support page on common file name extensions, which covers Windows 11 and Windows 10, says a Windows file name has two parts separated by a period: the name, and an extension that defines the file type. Windows uses the extension to pick the app that opens the file and the icon it shows. Microsoft's example is .docx, which tells Windows to open the file in Word and display a Word icon.
Microsoft also warns that renaming an extension does not convert the file to another format. The extension is a label, not proof of what's inside. Attackers rely on that.
Microsoft's own settings catalog lists "Hide extensions for known file types" as a File Explorer option. MITRE ATT&CK calls the hiding behaviour the Windows default. This is long-standing behaviour: AskVG noted years ago that by default all Windows versions such as Windows XP, Vista, Windows 7 or Windows 8 don't show file extensions for known file types such as exe, mp3, txt, doc, avi, etc. The usual explanation is a cleaner, less confusing interface. Keep in mind that a work PC managed by an IT department may already be set differently.
Summary: extensions decide how Windows treats a file. Hiding them makes Explorer look tidier and makes files easier to disguise.
How to show file extensions in Windows 11 and Windows 10
Method 1: File Explorer (recommended)
Microsoft documents this path for both Windows 11 and Windows 10:
- Press Windows key + E to open File Explorer.
- Select View in the command bar.
- Hover over Show.
- Select File name extensions.
What success looks like: report becomes report.docx, photo becomes photo.jpg, and so on, in every folder.
On older Windows 10 Explorer layouts with the ribbon, Microsoft's instructions say to open the View tab and tick File name extensions in the Show/hide group.
Method 2: Windows Settings
This page has changed names, so the menu labels depend on your build:
- Windows 11, version 25H2 and later: Microsoft's Advanced Windows Settings documentation says the old "For developers" settings now live under Settings > System > Advanced. Under File Explorer, turn on Show file extensions.
- Earlier builds: look under Settings > System > For developers > File Explorer. MakeUseOf describes this route, and Microsoft's settings catalog lists the same option there.
If the toggle is greyed out or missing, Microsoft's documentation says organization policies on managed devices can disable Advanced settings toggles. In that case, ask your IT department rather than trying to work around it.
Method 3: Folder Options (legacy)
MakeUseOf suggests this route for older Windows versions. Open Control Panel, switch the view to Small icons if needed, and choose File Explorer Options. On the View tab, untick Hide extensions for known file types. AskVG describes the same checkbox: just disable "Hide extensions for known file types" option in Folder Options.
Method 4: Registry command (for scripts and admins)
Microsoft's Group Policy Preferences protocol documentation identifies the value as HideFileExt under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced. Because it sits under HKCU, the setting applies to the current user only. MakeUseOf gives this command for Windows Terminal or PowerShell:
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0 /f
A value of 0 means extensions are shown. MakeUseOf says pressing F5 in Explorer refreshes the view. Atera's guide is more cautious and says to restart File Explorer, or sign out and back in, for the change to take effect. If F5 doesn't work, try that. For most home users, Method 1 is simpler and safer than editing the registry.
Summary: File Explorer's View menu is the official route on both supported versions. In Settings, look for Advanced on 25H2 and later or For developers on older builds. The registry value is per-user and suits scripting.
The attack this setting defends against
MITRE ATT&CK lists the core trick as Double File Extension (technique T1036.007). An attacker names a file something like Evil.txt.exe. With extensions hidden, Explorer shows Evil.txt, but the last extension is the real one and decides how the file runs. MITRE says harmless-looking first extensions are typically text, document or image types. The real extensions underneath are often .exe, .lnk, .hta and .scr.
MITRE's real-world examples include:
- The Bazar loader using names like
PreviewReport.DOC.exe - DarkGate disguising malicious shortcut files as PDFs with
.pdf.lnk - Kimsuky using the same
.pdf.lnktrick
MITRE's recommended mitigation is a configuration change: disable the hide-extensions default. That is the setting this article is about. MITRE also recommends training users to look for double extensions.
The blind spot: some extensions stay hidden anyway
Look at those DarkGate and Kimsuky examples again. Both end in .lnk, the shortcut format, and shortcuts are one of the file types Windows hides even after you turn extensions on.
Atera warns that .lnk shortcuts are exempt from the Hide extensions for known file types setting. It explains that this behavior is hardcoded via a NeverShowExt registry flag tied specifically to the .lnk file type. SS64's reference lists the default NeverShowExt entries. They cover internet shortcuts (.url), file and folder shortcuts (.lnk), MS-DOS program shortcuts (.pif) and a few legacy scrap and document-shortcut types.
So a file named Invoice.pdf.lnk can still appear as Invoice.pdf on a PC where you have turned extensions on. That's not a bug. It's exactly what DarkGate and Kimsuky took advantage of. This also backs up MakeUseOf's point that .pif extensions stay hidden even with the setting enabled.
What should you do about it?
- Check the icon overlay. Shortcuts normally show a small arrow on their icon. An "invoice" with a shortcut arrow is a red flag.
- Check the Type column. In Details view, a disguised shortcut will usually say "Shortcut" rather than "PDF Document".
- Power users can remove the hiding rule. AskVG and others describe deleting the
NeverShowExtvalue from the relevant HKEY_CLASSES_ROOT key, for examplelnkfile, and then restarting. This is an advanced registry edit and needs administrator rights, so back up the key first.
Other tricks the setting won't catch
MITRE also documents Right-to-Left Override (T1036.002). Attackers insert the invisible Unicode character U+202E, which reverses how the text after it is displayed. MITRE's example is a screensaver executable whose name ends \u202Excod.scr but displays as rcs.docx. Showing extensions doesn't help here, because the screen itself is showing you the wrong text. MITRE notes that this technique cannot be easily prevented with preventive controls.
MakeUseOf mentions two more methods:
- Whitespace padding: many spaces before the real extension push it out of view.
- Icon swapping: an executable is given a PDF or image icon.
Neither depends on hidden extensions. Checking the Type column in Details view or the file's Properties dialog helps against both.
Summary: showing extensions defeats basic double-extension tricks. It does nothing for shortcut disguises, Unicode reversal or swapped icons.
The bottom line
Turn on file name extensions. It's free, it's reversible, and MITRE lists it as a mitigation for a technique real threat groups use. But it only makes some disguises visible. It doesn't block anything, and it doesn't tell you a file is safe.
Treat any unexpected attachment or download with suspicion, even if its name and icon look ordinary. If it has a shortcut arrow, says "Shortcut" or "Application" in the Type column, or arrived from a stranger with an urgent message, don't open it.
Microsoft also notes that Windows 10 support ended on October 14, 2025. If you're still on Windows 10, changing one Explorer setting is the smallest part of staying safe.