WhatsApp export format: what is inside the TXT and the ZIP

An export is a ZIP containing a single transcript and, when media was included, the attachment files beside it. There is no manifest, no index and no metadata file. Everything a reader needs to reconnect a message to its attachment is in the transcript itself.

_chat.txt
IMG-20240315-WA0001.jpg
VID-20240315-WA0004.mp4
PTT-20240315-WA0009.opus
STK-20240316-WA0002.webp

Every line of the transcript begins with a timestamp and a sender. There are two shapes, and which one you get depends on the platform and the phone's language settings rather than on anything you can choose.

[3/15/24, 9:22:31 AM] Sarah Chen: Can you send the schedule?
3/15/24, 9:22 - Sarah Chen: Can you send the schedule?

• The bracket form usually comes from iOS and carries seconds.
• The dash form usually comes from Android and usually does not.
• Both appear in 12-hour and 24-hour versions, again depending on the phone.

What the file never has is a page. An export is one continuous text, so a document made from it has to bring its own way of citing a page, which in a court production means Bates numbering.

This is the single most common reason a converter produces garbage. iOS exports contain characters that do not render and are easy to miss when you open the file in a text editor.

Stripping them before parsing is tempting and wrong: they are part of the file whose digest you are about to publish. Read past them, do not rewrite them.

Not every line in the file is a message, and not every message is one line.

• Continuations. Any line that does not begin with a timestamp belongs to the message above it. A message containing line breaks produces several lines.
• System messages. Encryption notices, group membership changes and subject changes are written like messages but have no sender.
• Attachments. Written as <attached: FILENAME> on iOS and FILENAME (file attached) on Android.
• Omitted media. When the export was made without media, attachments become a short phrase such as image omitted and the file itself is simply absent.

Every one of these is worth checking against a real file rather than taken on trust. The export viewer reads one in your browser and names the lines it could not attribute, and the export guide covers getting the file off the phone in the first place. When the file is headed for a custody case, read How to use WhatsApp messages as evidence in a custody case.

A voice note appears in the transcript as an attachment line naming a .opus file, and that file sits in the archive. The link between a message and its audio therefore costs nothing to establish: it is written down.

The hard part is not finding the audio, it is decoding it. Opus in an OGG container is handled unevenly across browsers, which is why a fallback decoder matters more than the transcription model does.