In docProps/app.xml, every docx carries an <Application> element naming the program that wrote the file. It's the single highest-leverage field in app.xml for telling you "what made this file."
This page covers what the common values mean and how to read divergence between Application and other metadata.
Where the field comes from
When a word processor writes a .docx, it sets the <Application> element to its own name and version. The expected pattern is:
- Microsoft Word (desktop):
Microsoft Office WordorMicrosoft Word for Microsoft 365 - Microsoft Word Online:
Microsoft Office Word(same string; differs in other fields) - LibreOffice Writer:
LibreOffice/7.5.4.2$Linux_X86_64 LibreOffice_project/... - Apple Pages export-to-Word: blank or
Microsoft Office Word(Pages pretends to be Word) - Google Docs Download-as-Word:
Microsoft Office Word(Docs also pretends to be Word) - WPS Office:
WPS Office_xxxxx - Older Word versions:
Microsoft Word 2010,Microsoft Word 2007
Anything else is unusual.
Common values and what they tell you
Microsoft Office Word / Microsoft Word for Microsoft 365 / Microsoft Office Word 2019
The modal pattern for student work. Indicates the file was written by Word (desktop, Online, or a tool pretending to be Word).
Word itself writes the version string into other fields too: AppVersion, DocSecurity, Company (often empty for student work). When Application: Microsoft Office Word pairs with empty AppVersion and Company, the file was likely not actually saved by Word — it was saved by a program that wrote the Word-compatible Application string without filling in the rest. Common: Google Docs export, Pages export.
LibreOffice/7.5.4.2$...
LibreOffice Writer. Common on Linux and frugal users. The $Linux_X86_64 suffix is a giveaway. Also common patterns: $Win_x86_64, $macOS_X86_64.
LibreOffice writes more verbose Application strings than Word does. Treat this as a positive identification, not as suspicious.
WPS Office_xxxxx
WPS Office is a Word-compatible suite popular in China and increasingly globally. Indicates the student is using WPS instead of Word. Not suspicious.
Empty / missing
If <Application> is absent or empty, the file went through a converter that stripped the field, or it was written by a programmatic tool that didn't bother setting it.
Common sources of empty Application:
- Some "convert to Word" web tools.
- Some older versions of LibreOffice on specific platforms.
- Programmatic docx generators (python-docx, docx4j) writing minimal metadata.
In student work, a fully-empty Application combined with Company: empty AND creator: Anonymous is consistent with "downloaded from a Google Doc while signed out" — see why Google Docs exports look different.
Versions of Word that look "too old"
Microsoft Office Word 2007 on a docx submitted in 2026 is unusual. Most institutional Office installs run current versions. Possible explanations:
- The student is on a personal computer with a very old install.
- The student inherited the file from someone with an older Office.
- The file genuinely was authored in 2007 and just submitted now.
- A converter wrote an old Application string deliberately.
Worth a question; not by itself an answer.
What divergence between fields tells you
The most useful interpretation pattern: when Application says one thing but other fields contradict it. Examples:
Application: Microsoft Office Word but revisions.xml absent and TotalTime: 0
A real Word session generates revisions.xml (autosave history) and a non-zero TotalTime. Their absence with a Word-style Application string means the file claims to be Word but wasn't actually saved by Word. Almost always: Google Docs Download-as-Word.
Application: Microsoft Office Word but namespace declarations in document.xml differ from Word's
Word writes a specific set of XML namespace declarations in document.xml. Other tools (Google Docs, Pages) write slightly different ones. A scanner that fingerprints these can detect a Word-claim that doesn't match Word's XML conventions. The structural signals deep-dive covers this in more detail.
Application: empty but tracked changes present
A file with tracked changes was actually saved during an editing session. An empty Application combined with tracked changes is rare — it usually means a converter stripped Application but preserved the document.xml content.
What to do when Application looks wrong
- Confirm with the student. "Did you write this in Word, Google Docs, or something else?" Most students will tell you the truth on this question even when they wouldn't on a more charged one. The answer is often "Google Docs" and the rest of the forensics report makes sense.
- Compare to the rest of the class. A handful of
LibreOfficeandGoogle DocsandPagesexports in a class is normal. A pattern where only one student's submissions consistently show an unusual Application string across multiple assignments is worth a closer look. - Don't escalate on a single odd value. Application is one field. The forensics report needs to read coherent across all fields before drawing conclusions.
What Application can't tell you
- Whether the content was written by a human. Same as everything else in this layer — metadata is about the file, not about authorship.
- The student's identity. Application is a tool fingerprint, not an identity fingerprint.
- Whether the file is exactly what the student wrote, or whether something happened to it after they were done.
For the broader metadata layer, see the metadata signals page.