piapia123
en

File Signature Identification (Magic Bytes)

Web

Everything runs locally in your browser — nothing is uploaded

Input
Drop a file here to load its contents
Output

Paste the first few bytes of a file and find out what it really is. This beats the extension: an extension is part of the file name and anyone can change it, while the header is part of the content — it is what tells you why that photo.jpg will not open, or what a blob of binary data actually holds. More than 60 common formats are covered, across images, documents, archives, audio, video, executables and fonts. When one signature fits several formats the tool lists all of them (a ZIP container could be a docx, an apk or a jar) rather than picking one for you. The lookup also runs backwards: enter png or image/png to see its signature and offset.

Features

  • 59 common formats: images, documents, archives, audio, video, executables, fonts
  • Judged purely by bytes — extensions can be changed, headers cannot
  • Every matching format is listed, ordered by how specific the match is
  • Signatures at an offset are handled: ISO 9660 at 32 KB, MP4 ftyp at offset 4
  • Reverse lookup: enter png, PNG or image/png to see its signature and offset
  • An ASCII view is shown too, so text signatures (%PDF, {\rtf, <?xml) are obvious
  • Hexadecimal input accepts spaces, colons, commas and 0x / \x prefixes

How to use

  1. Paste the first bytes of the file, in hex or as text
  2. Matches appear as you type — there may be several
  3. To see a format's signature, type its extension or MIME type instead
  4. Switch the "Input is" option to force bytes or a format name

FAQ

Why does a ZIP match several formats?
Because docx, xlsx, pptx, apk, jar and epub are all ZIP containers at the file level — what separates them is which entries are inside, which the first few bytes cannot show. The tool lists ZIP alongside those possibilities, since "this is a ZIP container" is itself useful information.
Which is more trustworthy, the header or the extension?
The header. An extension is part of the file name: one letter changed turns an exe into a jpg, which is one of the most common phishing tricks. The header is part of the content and would have to be forged along with it. It is not absolute either — some containers are generic (see the previous question) — which is why every plausible match is listed.
Why only the first 256 bytes?
Because the signature lives in the first few dozen bytes, and you may have pasted an entire file in. Showing all of it would slow the page down, and the identification still uses the full input — the ISO 9660 signature sits at a 32 KB offset, so the truncation affects display only.
Can it convert the file once identified?
This tool only identifies. For images, see the image-to-Base64 or QR tools; for text, the encoding tools. Identification is step one — knowing what it is tells you which tool to reach for next.

Related tools