File Signature Checker — Verify a File's Real Type
Check what a file really is: read its magic bytes, name the format, and see whether the extension agrees with the content.
or drag a file here
Choose a file to identify it.
What this tool does
It reads the first bytes of a file and compares them against the signature table every format publishes, then reports the type it finds. Because the check is on content rather than on the name, it answers the question an extension cannot: is this file really what it claims to be? The result is put beside the filename, so a mismatch is visible immediately.
Why the extension cannot be trusted
A filename extension is a hint for the operating system about which program to open, and nothing more. It is written into the name, not the file, so renaming changes the claim and never the content. Every mislabelled download — a WebP saved as .jpg, a HEIC photo a Windows machine refuses, a .csv that is really an .xlsx — is a version of the same problem, and all of them are diagnosed the same way: look at the bytes.
Reading the hex dump
The dump shows the leading bytes as hexadecimal, beside their printable characters. Text-based
formats are legible straight away — a PDF's first five bytes spell %PDF-, an HTML
file starts with <. Binary formats are not meant to read as text, which is exactly
why their signatures were chosen to be distinctive in hexadecimal. A file whose first bytes are
4D 5A is a Windows executable whatever it is called.
Containers and the honest answer
Not every file has one true type. A .docx is a ZIP archive containing XML, so it
shares its opening bytes with every other ZIP-based format and the specific type only appears
further in. This tool reports the most specific match it can confirm and lists the alternatives
rather than hiding them, because the difference between “this is a ZIP” and “this is a Word
document” matters to what you do next.
Frequently asked questions
What are magic bytes?
The first few bytes of a file, chosen by the format so that software can recognise it without being told. A PNG always starts 89 50 4E 47, a PDF starts %PDF-, a ZIP starts PK. Because they sit at a fixed place and are defined by the format, they identify the file more reliably than the name it happens to carry.
Why does the extension not match?
Because an extension is a filename convention, not part of the file. It is set by whoever saved or renamed it and is trivially edited — renaming photo.jpg to photo.png changes nothing inside. That gap is both why mislabelled downloads break and how a harmless-looking file can really be something else, so checking the content is the honest test.
Is this the same as checking for malware?
No. It tells you what format the file is, which is useful for spotting a disguised executable — a “document” that is really an .exe or .zip stands out. It does not scan for malicious content inside a correctly-typed file, and it is not a substitute for a proper antivirus scan.
Why do several file types share a signature?
Because some formats are containers. Every Office .docx, .xlsx and .pptx is a ZIP archive at heart, so all of them begin PK — the real type is named deeper in the archive. The tool reports the most specific match it can see and lists the others, rather than pretending the answer is unique.
Do I need to open the file?
No. Only the leading bytes are needed, and the tool reads just those, in your browser. Nothing is sent anywhere, and nothing is executed — the bytes are only compared, never run.
Which bytes should I look at for an unknown file?
The first sixteen are enough for almost every format, which is what the dump shows. A few signatures sit further in — TAR puts “ustar” at offset 257 — and this tool knows about those too, so a file that looks blank up front can still be identified.
Go deeper
Longer explanations of the problems this tool solves:
Sources
- Gary Kessler — File Signatures Table (the reference list of magic numbers).
- IANA — Media Types registry, for the canonical MIME type of each format.
- RFC 1952 (GZIP), RFC 1950 (ZLIB) and the PNG, JPEG and ZIP specifications.
Everything runs in your browser — your file never leaves your device.