File Signature Identification (Magic Bytes)
WebEverything runs locally in your browser — nothing is uploaded
Paste the first few bytes of a file and find out what it really is. This beats the extension: an extension is part of the file name and anyone can change it, while the header is part of the content — it is what tells you why that photo.jpg will not open, or what a blob of binary data actually holds. More than 60 common formats are covered, across images, documents, archives, audio, video, executables and fonts. When one signature fits several formats the tool lists all of them (a ZIP container could be a docx, an apk or a jar) rather than picking one for you. The lookup also runs backwards: enter png or image/png to see its signature and offset.
Features
- 59 common formats: images, documents, archives, audio, video, executables, fonts
- Judged purely by bytes — extensions can be changed, headers cannot
- Every matching format is listed, ordered by how specific the match is
- Signatures at an offset are handled: ISO 9660 at 32 KB, MP4 ftyp at offset 4
- Reverse lookup: enter png, PNG or image/png to see its signature and offset
- An ASCII view is shown too, so text signatures (%PDF, {\rtf, <?xml) are obvious
- Hexadecimal input accepts spaces, colons, commas and 0x / \x prefixes
How to use
- Paste the first bytes of the file, in hex or as text
- Matches appear as you type — there may be several
- To see a format's signature, type its extension or MIME type instead
- Switch the "Input is" option to force bytes or a format name
FAQ
- Why does a ZIP match several formats?
- Because docx, xlsx, pptx, apk, jar and epub are all ZIP containers at the file level — what separates them is which entries are inside, which the first few bytes cannot show. The tool lists ZIP alongside those possibilities, since "this is a ZIP container" is itself useful information.
- Which is more trustworthy, the header or the extension?
- The header. An extension is part of the file name: one letter changed turns an exe into a jpg, which is one of the most common phishing tricks. The header is part of the content and would have to be forged along with it. It is not absolute either — some containers are generic (see the previous question) — which is why every plausible match is listed.
- Why only the first 256 bytes?
- Because the signature lives in the first few dozen bytes, and you may have pasted an entire file in. Showing all of it would slow the page down, and the identification still uses the full input — the ISO 9660 signature sits at a 32 KB offset, so the truncation affects display only.
- Can it convert the file once identified?
- This tool only identifies. For images, see the image-to-Base64 or QR tools; for text, the encoding tools. Identification is step one — knowing what it is tells you which tool to reach for next.
Related tools
Torrent to Magnet
WebDrop in a .torrent to extract the raw infohash and get a paste-ready magnet link, plus size, trackers and creation details. Nothing is uploaded.
MIME Types
WebLook up a MIME type from an extension, or the default extension for a media type. Common types only. Runs entirely in your browser.
Hex Converter
EncodingConvert between hexadecimal and text, accepting 0x, \x, spaces and colons, with UTF-8 byte counts shown. Runs in your browser.
Base64
EncodingConvert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.
URL Parser
WebParse a URL into scheme, host, port, path, query parameters and fragment, with each parameter shown raw and decoded. Runs entirely in your browser.
User-Agent Parser
WebParse a user agent into browser, version, OS, device type and engine, and see which rules matched. Pattern matching only. Runs entirely in your browser.