An .ics file is a calendar event or invitation stored as plain text. Beyond the date and title it carries the organizer and the entire attendee list - every invitee's email address - and, when it's a video meeting, the joining link and its passcode usually sit in the description in clear text. Because those links tend to stay valid long after the meeting, a forwarded invite can quietly be a way in.
Scan a Calendar Invite fileThe most sensitive thing an .ics file exposes is the guest list. File X-Ray reads the organizer and every attendee, showing the CN name and the email that identifies each account, and it also surfaces the SENT-BY delegate - the assistant or secretary who actually sent the invite on someone's behalf. One saved invite can name a whole meeting's worth of people who never expected their address to travel with the file.
It pins down where and when. The plain LOCATION line is read, but so is Apple Calendar's X-APPLE-STRUCTURED-LOCATION, which stores a geo: coordinate and a titled street address that pinpoints the venue far more exactly than the text line - and a GEO property drives a precise map pin. DTSTART and DTEND place a person at a specific time and date.
The description field is where the real leaks hide. Agendas and notes live there, but so do conferencing links, dial-in numbers, passcodes, PINs and door codes. File X-Ray flags the description as high risk when it detects a link or an access code, precisely because those details routinely stay usable long after the event has passed.
The file's own bookkeeping names the owner and the history. X-WR-CALNAME often reads like "Alice's Work Calendar" and hands over the owner's name outright; the calendar description and timezone hint at where that owner is based. DTSTAMP, CREATED and LAST-MODIFIED record when the entry was written and edited, the SEQUENCE number counts how many times the meeting was rescheduled and re-sent, and the UID host and PRODID name the system and app that generated it.
This is a selection. The full field manual documents the fields read from each format.
The organizer and every attendee's email address, the event location (including precise coordinates and a street address on Apple invites), the start and end times, the description with any meeting link or passcode, and the name of the calendar it came from - which often includes the owner's own name.
Yes. Joining links and passcodes live in the event description in plain text, and File X-Ray flags the description as high risk when it finds a link or an access code. Because these credentials frequently stay valid after the meeting, a forwarded invite can let someone into a call.
It can. A saved .ics keeps the organizer and the full attendee list, each with a name and email. If you forward an invite file, you may be handing over every other guest's address along with it.
It is the name of the calendar the event was exported from, and it usually contains the owner's name or the calendar's purpose - something like 'Alice's Work Calendar'. Together with the calendar timezone it can identify who owns the file and roughly where they are.
Open it in File X-Ray. It parses the invite in your browser - the file is never uploaded, though a pinned location is sent to draw its map - listing the attendees, precise location, any passcode in the description and the source calendar name, so you can see exactly what you would be sharing.
File X-Ray reads Calendar Invite files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.