Skip to main content
macOS Archive Utility attempting to open an XZ compressed file with the resulting error dialog

macOS Archive Utility and XZ Files

macOS Archive Utility — the system-level decompression tool that opens when you double-click an archive in Finder — handles a specific set of compression formats and is not always transparent about which formats fall outside that set. XZ is one of the formats where Archive Utility's behaviour is inconsistent across macOS versions and file types. This technical note covers what Archive Utility can and cannot do with XZ files, the command-line alternatives that work reliably, and the additional context from the 2024 XZ backdoor incident that changed how many macOS users first encountered XZ as a format. This note sits within the tech notes section.

The short version​

→ Short Answer

macOS Archive Utility can open .xz files for simple compressed single-file archives, but its support is partial — it handles the compression layer without supporting the broader XZ utility ecosystem's features, and it does not handle .tar.xz archives (tarballs compressed with XZ) correctly on all macOS versions. The reliable approach on macOS for XZ files is the command-line xz tool or GNU tar with the -J flag, both available through Homebrew. The built-in bsdtar included with macOS supports .tar.xz extraction as of macOS 12 (Monterey) and later, but behaviour in earlier versions is inconsistent.

What Archive Utility actually handles​

Archive Utility's supported format list is not officially documented in detail, but testing across macOS versions establishes a practical picture. It reliably handles: ZIP archives (including nested ZIP), GZIP-compressed files and .tar.gz tarballs, BZip2-compressed files and .tar.bz2 tarballs, 7-Zip archives via the 7z format handler, and .dmg disk images.

XZ support arrived partially and at varying levels of completeness. A standalone .xz file — a single file compressed with XZ — will typically open in Archive Utility on macOS Ventura and later, producing the decompressed result without ceremony. The failure case is .tar.xz: Archive Utility on macOS Monterey and earlier would either produce an error, silently produce only the decompressed .tar layer without extracting the archive contents, or occasionally hang.

⬡ Observed Behaviour

Attempting to open a .tar.xz file in Archive Utility on macOS Big Sur (11.x) produced inconsistent results across tests. In some cases, Archive Utility decompressed the XZ layer and deposited a .tar file in the same directory as the original, leaving the user with an unextracted tar archive and no obvious indication that extraction was incomplete. In other cases, it produced a generic "Unable to expand" error. On macOS Ventura (13.x), the same .tar.xz files opened correctly, extracting the tar contents to a folder. The improvement correlates with the libarchive update shipped in macOS Ventura.

Command-line alternatives​

The most reliable extraction path on macOS is the command-line, where the tools have complete XZ support regardless of macOS version.

Terminal — extract .tar.xz using bsdtar (macOS built-in)
# Works reliably on macOS Ventura and later
tar -xJf archive.tar.xz

# Or with explicit output directory
tar -xJf archive.tar.xz -C /path/to/destination
Terminal — using Homebrew xz for single .xz files
# Install xz if not already present
brew install xz

# Decompress a standalone .xz file (removes the .xz file, outputs original)
xz --decompress file.txt.xz

# Keep the original .xz file while decompressing
xz --decompress --keep file.txt.xz
Terminal — using GNU tar via Homebrew for full compatibility
# Install GNU tar for consistent behaviour across macOS versions
brew install gnu-tar

# gtar handles .tar.xz reliably
gtar -xJf archive.tar.xz
⚙ Compatibility Note

The tar command built into macOS is BSD tar (libarchive-based), not GNU tar. Most common operations behave identically, but subtle differences exist for edge cases. BSD tar uses -J for XZ decompression, which is also valid in GNU tar — so the flag is consistent. The main practical difference is that GNU tar installed via Homebrew has more recent libarchive support and handles unusual XZ file structures more reliably than the macOS system version on older macOS releases.

The XZ backdoor incident​

In March 2024, the XZ Utils package — the reference implementation of XZ compression, used in virtually every Linux distribution and present on macOS through Homebrew — was found to contain a backdoor inserted by a sophisticated threat actor operating under the identity "Jia Tan" over approximately two years. The backdoor, present in versions 5.6.0 and 5.6.1, was targeted at SSH daemons linked against the affected liblzma library, specifically on systemd-based Linux distributions. It was discovered before widespread deployment by Andres Freund during performance investigation.

↻ What Changed

The incident had no direct impact on macOS users' ability to open XZ files — the backdoor was in the compression library itself, not the format — but it significantly raised awareness of XZ as a format and brought many macOS users to encounter XZ file handling for the first time while investigating the incident. The affected versions (5.6.0 and 5.6.1) were briefly present in Homebrew's package index before being reverted to 5.4.6. Apple's system libcompression is not the same codebase and was not affected.

⚠ Common Pitfall

Several macOS users who installed Homebrew's xz package in early 2024 landed on an affected version (5.6.0 or 5.6.1) before Homebrew reverted. Running brew update && brew upgrade xz during that window would upgrade to the compromised version, then a subsequent update would revert to the safe version. If you are auditing software provenance for macOS systems managed during that window, verifying the XZ version history in Homebrew logs is part of due diligence. See the macOS installer verification guide for related verification practices.

Practical recommendations​

For day-to-day use on macOS:

  • Ventura and later: Archive Utility handles most XZ scenarios. Use tar -xJf for .tar.xz if Archive Utility produces an unexpected result.
  • Monterey and earlier: Do not rely on Archive Utility for XZ files. Install Homebrew's xz package and use command-line extraction.
  • Any macOS version: For .tar.xz files in scripts or automated workflows, prefer tar -xJf over Archive Utility for guaranteed consistency.

The XZ format itself is sound — the 2024 incident was a supply chain attack on the reference implementation, not a vulnerability in the format specification. XZ continues to be the standard compression format for source tarballs, Linux distribution packages, and large file archives where compression ratio matters more than speed.

Further Reading