Mark of the Web
The Mark of the Web is an invisible marker that Windows embeds in files downloaded from the internet. It signals to the operating system and programs such as Office or the browser that the file comes from a potentially unsafe source and should therefore be treated with increased caution.
Anyone who downloads a file from the internet on Windows doesn’t get it without accompanying information. Windows attaches a hidden note to the file: the Mark of the Web. This note sits in what’s called an alternate data stream — an invisible attachment that the NTFS file system stores alongside the actual file. You won’t see anything of it in File Explorer. Nevertheless, many programs read this note and change their behavior accordingly.
Protection from dangerous files from the web
The Mark of the Web is a central security principle in Windows. Without it, the system would not be able to distinguish whether a file originated from its own hard drive or from an unknown source on the internet. This distinction is crucial, however — because files from the web can contain malware.
Microsoft Office, for example, shows a yellow warning bar when you open a document carrying the Mark of the Web. Macros — small automated programs within Office files — then remain disabled by default. This prevents one of the most common attack vectors, in which criminals embed malicious code in Office documents. Windows Defender and other security programs also check the Mark of the Web before allowing a file to run.
A common misconception: many people think the file itself has somehow been altered or damaged. That’s not true. The Mark of the Web doesn’t touch the file’s content at all — it is a separate entry that can be removed at any time without changing the file.
How Windows sets and stores the marker
As soon as a browser like Chrome, Edge, or Firefox saves a file, it writes a short block of text into the alternate data stream “Zone.Identifier”. Among other things, this contains the zone of origin — the number 3 stands for “Internet”, the number 0 for “local computer”. Newer versions of Windows additionally store the exact source URL there, along with the page from which the download link was clicked.
Anyone who wants to see the content can enter the command `more < filename.docx:Zone.Identifier` in the command prompt. You then see a few lines of text — technically, there’s nothing more to it. The Mark of the Web can be removed via the file properties in Windows: there’s a checkbox labeled “Unblock” that removes the entry. After that, Windows treats the file as if it were created locally.
Important: the Mark of the Web only works on NTFS drives. If you copy a file to a USB stick formatted with FAT32, the marker is lost — because FAT32 doesn’t support alternate data streams. This is a well-known weakness that attackers occasionally exploit.
Mark of the Web in security alerts and attacks
In tech and security news, the term mainly comes up when attackers deliberately bypass it. One well-known method involves ZIP archives or ISO files: older versions of Windows used not to pass the Mark of the Web on to files created during extraction. Malware hidden in such archives thus ended up on the computer without any warning. Microsoft changed this behavior in Windows 11 — ZIP contents now automatically inherit the marker.
Security researchers regularly publish vulnerabilities that allow the Mark of the Web to be bypassed entirely. Microsoft classifies such flaws as serious, because they undermine a fundamental protection mechanism. Such vulnerabilities are regularly patched in the monthly security updates — known as Patch Tuesday.
For ordinary users, the practical takeaway is simple: the warning message that Office or Windows displays when a file comes from the internet is not an annoying error. It is the Mark of the Web doing its job. Anyone who habitually dismisses these warnings without thinking disables one of the most effective everyday protection mechanisms in Windows.