ZERO-UPLOAD SANDBOX
.usdz Tier 1 · Deep AST Parser

USDZ Spatial 3D Archive (Pixar / Apple VisionOS)

Zero-compression, 64-byte mmap-aligned PKZIP package created by Pixar & Apple for AR QuickLook and VisionOS spatial scenes, beginning with a root `.usdc` (`PXR-USDC`) or `.usda` stage.

Standard ZIP tools break USDZ! Every member MUST use `ZIP_STORED` (method 0) AND start its payload at an exact multiple of 64 bytes (padded via ZIP extra fields).

MIME Types model/vnd.usdz+zip
Byte Endianness little
Container Family zip
0xFF

Drop any .usdz file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.usdz Magic Bytes & Header Offset Map

Offset: 0x00 (0 B) ASCII: PK..
50 4B 03 04

Uncompressed 64-byte aligned ZIP containing PXR-USDC layer at offset 0x40

Byte Offset Length Data Type Field Name Engineering Description
0x00 - 0x1D 30 B zip_lfh local_header ZIP header with compression_method == 0 (Store)
0x1E - 0x3F var name+pad alignment_pad Filename + extra field padding to 64-byte boundary
0x40 - 0x47 8 B char[8] usdc_magic 'PXR-USDC' Crate binary stage header
Upload Gateway & AppSec Advisory

.usdz Security & Polyglot Risk Matrix

Risk Level: low
Arbitrary Code / Macros
NO (Inert Data)
Pickle Deserialization
SAFE (No Pickle VM)
XML External Entity (XXE)
NONE
Polyglot Prepend Risk
YES (Check Tail/Offsets)
Backend Upload Validation Recommendation

Verify method==0 (uncompressed), data_offset % 64 == 0 for every entry, and first entry extension in {.usdc, .usda, .usd}.

Compiler-Verified Reference Code

Read .usdz Header & Metadata Without Heavy Dependencies

import struct, sys
with open(sys.argv[1], "rb") as f:
    hdr = f.read(30)
    sig, ver, flags, method = struct.unpack("<IHHH", hdr[:10])
    fn_len, ex_len = struct.unpack("<HH", hdr[26:30])
    data_off = 30 + fn_len + ex_len
    assert sig == 0x04034B50 and method == 0 and data_off % 64 == 0
    print(f"Valid 64B-aligned USDZ: first data_offset=0x{data_off:X}")
CI/CD & Unit Test Fixtures

Deterministic .usdz Sample Files & Edge Cases

Open Full .usdz Sample Matrix & Mutator →
minimalexpect: valid

minimal-64b-aligned.usdz

Apple VisionOS / QuickLook compliant uncompressed ZIP with 64-byte mmap alignment and `PXR-USDC` Crate root layer.

↓ Download (206 B)
SHA-256: 84ed4c279742f4c9aa8557034806427c40d29fb91d3415def454b5371035f3bf
Exact: 206 bytes
curl -fsSL https://fileformat.co/fixtures/v1/usdz/minimal-64b-aligned.usdz -o minimal-64b-aligned.usdz \
  && echo "84ed4c279742f4c9aa8557034806427c40d29fb91d3415def454b5371035f3bf  minimal-64b-aligned.usdz" | shasum -a 256 -c
realisticexpect: valid

spatial-stage-textured.usdz

64-byte aligned USDZ archive bundling both a `PXR-USDC` binary stage and an uncompressed RGBA PNG texture.

↓ Download (483 B)
SHA-256: 30477e3f8aaf315b7f84c5950a266a44d86d615dd8ad087d49825eb2b6a35f1e
Exact: 483 bytes
curl -fsSL https://fileformat.co/fixtures/v1/usdz/spatial-stage-textured.usdz -o spatial-stage-textured.usdz \
  && echo "30477e3f8aaf315b7f84c5950a266a44d86d615dd8ad087d49825eb2b6a35f1e  spatial-stage-textured.usdz" | shasum -a 256 -c
edge-case64-Byte Alignment Violationexpect: parser_error

unaligned-violation.usdz

Valid ZIP containing `scene.usdc`, but entry data starts at non-64B-aligned offset—catches subtle USDZ packager bugs.

↓ Download (182 B)
SHA-256: 1b5d09db530a3b47b91227c552a243fc0a0debb7e2e757ad2d6988a07e86cdae
Exact: 182 bytes
curl -fsSL https://fileformat.co/fixtures/v1/usdz/unaligned-violation.usdz -o unaligned-violation.usdz \
  && echo "1b5d09db530a3b47b91227c552a243fc0a0debb7e2e757ad2d6988a07e86cdae  unaligned-violation.usdz" | shasum -a 256 -c

Related Specifications & Alternatives