How Windows 95 Handled Hidden File Extensions

When Microsoft released Windows 95, it introduced a revamped interface that concealed file extensions by default for known file types within Windows Explorer. This design choice prioritized visual simplicity for mainstream users over technical transparency, marking a major departure from MS-DOS and Windows 3.1, while laying the groundwork for significant usability changes and security concerns in personal computing.

In Windows 95, Windows Explorer handled file extensions through a dedicated setting located in the folder options menu. Users could access this by opening any folder, navigating to the View menu, selecting Options, and switching to the View tab. Here, Microsoft included a checkbox labeled "Hide MS-DOS file extensions for file types that are registered," which was checked by default upon installation.

The mechanism relied entirely on the Windows Registry, specifically the HKEY_CLASSES_ROOT hive. When an application was installed, it registered its associated file extensions (such as .txt for Notepad, .doc for WordPad, or .bmp for Paint). If an extension existed within the registry as an associated type, Windows Explorer stripped that extension from the visible file name on the desktop and inside folder windows. Instead of seeing README.TXT, a user simply saw README alongside the Notepad icon. Extensions that had no registered association remained visible so the operating system could indicate that the file was unrecognized.

Microsoft adopted this behavior to foster a document-centric user experience rather than a file-centric one. Influenced by the graphical presentation of the classic Mac OS, the design philosophy assumed that distinct icons and descriptive type columns rendered three-letter DOS extensions redundant and confusing for novice computer users.

However, hiding extensions by default introduced notable technical problems. Power users accustomed to explicit DOS naming found it difficult to quickly identify file formats or modify extensions directly. More critically, it opened a major security vulnerability known as the "double extension" exploit. Malicious actors could distribute executable files named with two extensions, such as document.txt.exe. With extensions hidden, Windows Explorer displayed the file as document.txt, tricking users into executing arbitrary code under the assumption they were opening a harmless text document. Despite these risks, the default behavior of concealing registered file extensions persisted as a standard setting across subsequent versions of the Windows operating system.