How to use the file type identifier (magic bytes)
- Choose one or more files, or drop them on the box. Up to 20 files at a time, 25 MB each.
- Read the detected type and media type for each file. They come from the first bytes of the file, not from its name.
- Check the extension line. A warning appears when the name ends in an extension that does not fit the content.
- Use Copy report to keep the results as text, or Clear to start over.
Worked examples
A PNG image starts with the eight bytes 89 50 4E 47 0D 0A 1A 0A, a JPEG with FF D8 FF, a GIF with the text GIF87a or GIF89a, a PDF with the text %PDF- and a ZIP archive with the two letters PK followed by 03 04. A file named photo.jpg that starts with the PNG bytes is reported as a PNG image with the message that the name ends in .jpg but the content looks like PNG image (usually .png).
A Word document (DOCX) is a ZIP file, so the first bytes only say ZIP. The tool reads the list of files inside the archive, sees [Content_Types].xml and a word folder, and reports a Word document. In the same way it separates Excel and PowerPoint files, OpenDocument files, EPUB books, Java archives and Android packages.
How file type detection works
Many file formats begin with a fixed pattern of bytes, often called a magic number or signature. Reading those first bytes tells you what a file claims to be, whatever its name says. The tool knows about 60 common formats including images, documents, archives, audio, video, programs, fonts and databases, and shows the first 16 bytes in hexadecimal so you can check them yourself.
Some formats have no signature. Text files, CSV, Markdown and source code are just characters, so the tool reports readable text as plain text, and recognizes HTML, XML, SVG, JSON and scripts with a #! first line from their opening characters. Anything else is reported as unknown rather than guessed.
What a match does and does not mean
A matching signature means the file starts like that format. It does not prove that the whole file is valid, complete or safe. A file can begin with a harmless signature and still contain something else, and an executable renamed to .pdf is still an executable. Treat files from unknown senders with care whatever the tool says, and keep your security software up to date.
Files are read in your browser and are never uploaded. Related tools include the hex viewer, the image converter, the PDF metadata editor and the ZIP file creator.
Assumptions and limits
- Detection uses the bytes of the file only. The name is used just to compare the extension with the detected type.
- Legacy Office files (DOC, XLS, PPT) and MSI installers share one container and are reported as a Microsoft compound file.
- Files over 25 MB are not read, and at most 20 files are checked at a time.
- A file with no known signature and unreadable bytes is reported as unknown.
Frequently asked questions
How can I tell what type a file really is?
Look at its first bytes. Most formats start with a fixed signature, and this tool reads it and shows the match, the media type and the first bytes in hex, whatever the file is named.
Why is my .docx file shown as a ZIP archive?
Word documents are ZIP files with a specific set of files inside. The tool looks inside the archive and reports a Word document when it finds the expected parts. A plain ZIP means it did not find them.
Can this tell me whether a file is safe?
No. It only identifies the format from the start of the file. A file can match a format and still be damaged or harmful, so use security software and caution with files from unknown sources.
Does the tool upload my files?
No. Files are read in your browser and nothing is sent anywhere. You can disconnect from the internet after loading the page and the tool still works.