{"id":45,"date":"2026-08-08T11:39:00","date_gmt":"2026-08-08T11:39:00","guid":{"rendered":"https:\/\/easyextract.online\/blog\/how-windows-icons-are-stored-in-exe-files\/"},"modified":"2026-08-26T08:14:08","modified_gmt":"2026-08-26T08:14:08","slug":"how-windows-icons-are-stored-in-exe-files","status":"publish","type":"post","link":"https:\/\/easyextract.online\/blog\/how-windows-icons-are-stored-in-exe-files\/","title":{"rendered":"How Windows Icons Are Stored in EXE Files"},"content":{"rendered":"

A Windows program’s icon is stored inside the .exe<\/code> itself, in the file’s resource section, as one or more RT_ICON<\/code> images tied together by an RT_GROUP_ICON<\/code> directory.<\/strong> The icon you see in Explorer is not a separate file \u2014 it is a resource embedded in the executable’s PE (Portable Executable) structure. Knowing how that works explains why one program can show a crisp icon at every size, and how to pull the icon back out.<\/p>\n

This guide covers the PE resource layout, why an icon is really several images in one, and how to extract an icon from an EXE<\/a> \u2014 including DLLs \u2014 directly in your browser.<\/p>\n

The PE format and its resource section<\/h2>\n

Every Windows .exe<\/code> and .dll<\/code> follows the Portable Executable (PE)<\/strong> format. Besides the code the program runs, a PE file contains a resource section<\/strong> (named .rsrc<\/code>) that holds non-code assets: icons, cursors, menus, version information, dialog layouts and embedded images. The resource section is a small tree, organised first by resource type<\/em>, then by name\/ID<\/em>, then by language<\/em>.<\/p>\n

Icons live under two resource types in that tree: RT_ICON<\/code> and RT_GROUP_ICON<\/code>.<\/p>\n

Why an icon is several images in one<\/h2>\n

What looks like a single icon is actually a set<\/strong> of images at different sizes and colour depths \u2014 16×16, 32×32, 48×48, 256×256, and so on. Windows picks the closest match for wherever the icon is displayed: a small one in a list view, a large one on the desktop. This is exactly what an .ico<\/code> file is: a container of multiple bitmaps.<\/p>\n

Inside the EXE, each of those individual images is stored as its own RT_ICON<\/code><\/strong> resource. On its own, an RT_ICON<\/code> is just one bitmap; nothing links it to the others.<\/p>\n

How RT_GROUP_ICON ties them together<\/h2>\n

The glue is RT_GROUP_ICON<\/code><\/strong>. This resource is a small directory that lists all the images belonging to one logical icon: for each, it records the width, height, colour depth and \u2014 crucially \u2014 the resource ID of the matching RT_ICON<\/code>. When Windows needs “the application icon”, it reads the RT_GROUP_ICON<\/code> directory, then fetches the RT_ICON<\/code> entries it points to.<\/p>\n

To rebuild a usable .ico<\/code> file from an executable, a tool has to do the same thing: read the group directory, collect the referenced RT_ICON<\/code> images, and reassemble them into a single icon file. Grabbing one RT_ICON<\/code> in isolation gives you only one size.<\/p>\n

One executable, many icons<\/h2>\n

A program can contain many icon groups \u2014 the main application icon, document-type icons, toolbar graphics, and more. System DLLs are the extreme case: files like shell32.dll<\/code> and imageres.dll<\/code> hold hundreds of the icons Windows uses across its interface. That is why an icon extractor that handles DLLs as well as EXEs is so useful.<\/p>\n

How to extract the icon<\/h2>\n

To pull the icon out, you need a tool that parses the PE resource tree, reads the RT_GROUP_ICON<\/code> directories and reassembles the referenced RT_ICON<\/code> images. Drop the file into the icon extractor<\/a>: it lists every icon group in the executable and lets you download each one at full size \u2014 all in your browser, so the .exe<\/code> is never uploaded. Because it reassembles the stored images, you get every size the program shipped, not a single screenshot.<\/p>\n

If you are inspecting an installer or an executable more broadly, the EXE extractor<\/a> and the archive & executable tools<\/a> cover the rest of what a PE file holds.<\/p>\n

Frequently asked questions<\/h2>\n

Where is the icon stored inside an EXE file?<\/strong>
\nIn the executable’s PE resource section (.rsrc<\/code>), as RT_ICON<\/code> images grouped by an RT_GROUP_ICON<\/code> directory. It is embedded in the file, not stored separately.<\/p>\n

How do I extract an icon from an EXE or DLL?<\/strong>
\nOpen the file in a tool that reads the PE resource tree, such as the icon extractor<\/a>, and download the icon. DLLs like shell32.dll<\/code> often contain hundreds of icons.<\/p>\n

Why does one icon have several sizes?<\/strong>
\nWindows needs the icon at different sizes for different places (lists, the desktop, the taskbar). Each size is a separate RT_ICON<\/code> image, and the RT_GROUP_ICON<\/code> directory ties them into one logical icon.<\/p>\n

Can I get the icon at full resolution?<\/strong>
\nYes. The images are stored in the file, so a proper extractor rebuilds the full icon \u2014 including the largest size, often 256×256 \u2014 rather than capturing what is on screen.<\/p>\n

Can a single EXE contain more than one icon?<\/strong>
\nYes. Applications usually have a main icon plus document and toolbar icons, and system DLLs can hold hundreds.<\/p>\n

Related reading<\/h2>\n