What Is an SVG File? A Plain-English Guide

Six Competing Proposals, and Why the W3C Picked None of Them

SVG stands for Scalable Vector Graphics, and its origin wasn't a single company inventing a format and giving it away — it came out of a genuine standards fight. During 1998, the World Wide Web Consortium received six separate, competing proposals for how the web should handle vector graphics, including Vector Markup Language (VML), backed by Microsoft, Autodesk, Hewlett-Packard, and Macromedia, and Precision Graphics Markup Language (PGML), backed by Adobe and Sun Microsystems. Rather than pick a winner from that list, the W3C's newly formed SVG Working Group chose a third path: build an entirely new specification, informed by ideas from both submissions but tied to neither company's commercial interest.

The first public working draft of that new specification appeared in 1999, and after two more years of committee work, SVG 1.0 became an official W3C Recommendation on September 4, 2001. Microsoft kept shipping VML inside Internet Explorer and Office for years afterward, which is the real reason some very old Word and Excel files still contain VML-based vector shapes today, but SVG is what every browser maker eventually converged on, and VML has been effectively dead outside of legacy Office documents for well over a decade now.

Every Shape Is Text: Paths, Curves, Filters, and Live Animation Inside the Same Tags

An SVG file is plain XML text, which means opening one in Notepad shows the actual shape data as readable tags rather than encoded binary. The workhorse element is <path>, whose "d" attribute holds a string of drawing commands: "M" to move to a starting point, "L" for a straight line, "C" for a cubic Bézier curve defined by two control points, "Q" for a simpler quadratic Bézier with just one control point, and "A" for an elliptical arc. That single element, repeated and combined, is how SVG describes everything from a straight-edged icon to a hand-drawn signature curve, all as a string of letters and numbers a text editor can display.

Beyond basic shapes, the specification defines filter primitives — feGaussianBlur for soft blur, feDropShadow for shadows, feColorMatrix for color remapping — that apply directly inside the XML rather than requiring a separate image editor. SVG also carries its own native animation system, called SMIL (Synchronized Multimedia Integration Language), using elements like <animate> and <animateTransform> to change a shape's position, color, or size over time without any external CSS or JavaScript at all — a capability no photo format has ever had, since a JPEG or PNG has no concept of time passing inside the file.

The One Real Risk a Photo Format Never Has: Code That Runs When the Image Opens

Because SVG is XML, and because a browser hands XML content to the exact same parsing engine that runs a web page's HTML and JavaScript, an SVG file is allowed to contain a real <script> tag, event-handler attributes like onload and onclick, and even a <foreignObject> element that can embed live HTML inside the image itself. A PNG or JPEG never carries this risk, no matter how it's crafted, because a browser hands those file types to an image decoder that only ever produces pixel color values — there is no path from a JPEG's bytes to executable code, structurally, under any circumstances.

This difference isn't theoretical. Documented, real-world stored cross-site scripting attacks have used SVG files uploaded as profile pictures or shared as attachments, where the embedded script runs with the same access to cookies and page data as the site that unknowingly served the image. The standard defense, used by security-conscious platforms, is sanitizing every uploaded SVG to strip out script tags, event handlers, and foreign-object content before the file is ever displayed to another user — treating it, correctly, as a small program rather than a harmless picture.

Where the Rendering Actually Works, and Where SMIL Almost Got Cut

Every currently maintained browser — Chrome, Firefox, Safari, and Edge — renders standard SVG natively today, whether it's placed with an <img> tag, used as a CSS background, or embedded directly inside a page's HTML. The one real scare in SVG's rendering history involved that SMIL animation system described above: Chrome 45, released in 2015, began showing developers a deprecation warning for SMIL, signaling an intent to remove it in favor of CSS and Web Animations. Chrome's own stated reason was that no other major browser at the time, including Internet Explorer and the newly launched Edge, supported SMIL at all, making it a genuine cross-browser liability rather than a settled standard.

That removal never actually happened — Google suspended the deprecation in 2016, and SMIL animation still works in Chrome as of today, alongside every other current browser. The practical lesson from that episode is that inline SVG embedded directly in HTML and given styling with CSS is the most consistently supported way to use the format across every browser and version, while the older SMIL animation tags, though currently safe to use, carry a documented history of at least one major browser trying to remove them outright.

What a Text-Based Picture Format Is Actually Good For

• Genuinely tiny files for flat art: a simple logo or icon described as a handful of path commands is routinely a few hundred bytes to a few kilobytes, far below an equivalent raster image at any real display resolution.
• Live restyling with CSS, no re-export needed: because colors and strokes are attributes in the markup, changing an icon's fill color across a whole page is one CSS rule, not a round trip through an image editor.
• Sharp at every screen density, using one file: the same SVG renders crisply on a low-resolution monitor and a high-density phone screen, since it's drawn fresh from math each time rather than stretched from stored pixels.
• Real risk if untrusted files are accepted from users: the script and event-handler capability covered above means SVG uploads from the public need sanitization in a way a JPEG upload never requires.
• A poor fit for photographs: describing every subtle color gradient in a photo as path data produces enormous, slow-to-render files, which is why photos still use JPEG, PNG, or WebP instead.

Scalable Markup Set Beside an Ordinary Pixel Photo

Straight Answers About the Format Behind Most Web Icons

Did Microsoft's VML ever fully disappear?
Not entirely — VML shipped inside Internet Explorer and Office for years after SVG became the official standard in 2001, and legacy Word and Excel files built with old versions of those programs can still contain VML-based shapes today, even though no current browser uses VML for the web.

Is it actually dangerous to open any SVG file I'm sent?
Opening one from a source you trust in a modern browser is not inherently risky, but an SVG from an unknown or public upload source could contain a script tag or event handler that runs code, which is exactly why platforms that accept public image uploads sanitize SVG content before displaying it to anyone else.

Why did my SVG's animation stop working in an old browser version?
If the animation uses SMIL elements like <animate>, older versions of Internet Explorer never supported that system at all, and it briefly carried a deprecation warning in Chrome 45 in 2015 before Google reversed that decision in 2016; current Chrome still supports it.

Can I edit the path data by hand in a text editor?
Yes. Since SVG is plain XML text, the "d" attribute of any <path> element can be read and edited directly, though hand-editing raw coordinate and curve-command strings is tedious compared to using a vector editor like Illustrator or Inkscape.

Why does a photo look terrible if someone tries to save it as SVG?
SVG has to describe a photo's countless subtle color transitions as path or filter data rather than storing pixels directly, which produces enormous, sluggish files for a result that still looks worse than a properly compressed JPEG or PNG of the same photo.