Hex Viewer / Editor
Browse, search, and edit raw bytes of any file up to 100 MB — with magic-byte detection, pattern highlighting, and direct download of your modified file.
Drop any file to inspect its bytes
Any format · Max 100 MB · Processed entirely in your browser
Or try:
100% Client-Side · No upload · Up to 100 MB
File bytes never leave your machine. The viewer renders only visible rows — even a 100 MB file stays responsive.
How to use the Hex Viewer (5 steps)
- Open a file: Drop any file (up to 100 MB) onto the viewer, paste a hex string, or pick up where you left off with a file loaded in another CTF Lab tool.
- Navigate bytes: Scroll the hex grid. Jump to any offset with Ctrl+G, search with Ctrl+F (hex, text, or regex). Use Page Up/Down or click the offset column.
- Inspect findings: Magic-byte signatures are highlighted automatically. Click any row to inspect bytes in the detail panel — it shows decimal, binary, and ASCII at a glance.
- Edit bytes (optional): Click any byte in the hex or ASCII column to select it, then type two hex digits to overwrite. All edits are tracked as a diff — the original file is never changed. Undo with Ctrl/⌘+Z and redo with Ctrl/⌘+Shift+Z, and watch the Data inspector read the bytes as numbers.
- Export: Download the modified file or copy the selection as hex / C / Python. Export the full dump as a .hexdump.txt for offline analysis.
What Is a Hex Viewer?
This online hex viewer opens a file in your browser and shows it as its raw bytes; nothing is uploaded. Each byte is written as two hexadecimal digits from 00 to FF, so a file of any type — image, archive, executable, unknown blob — can be read the same way. It adds a text pane beside the hex, an offset column on the left, a detail panel for the selected byte, and a hex editor for changing bytes in place.
Use the Hex Viewer Online for a File or a Pasted Hex String
To look inside a file, drop it on the viewer: it works as a simple hex reader for any format, up to 100 MB, and highlights known file-start markers so you can see what the file really is. If you only have a hex string rather than a file, paste it into the viewer and it becomes bytes you can scroll, search and inspect like a file.
Converting hex is a different job from viewing bytes. To turn a hex value into decimal, binary or another base, or to read it as text or as a big integer, use the Number Base Converter. To peel off Base64, hex, URL and other encoding layers, use the Encoding Auto-Decoder. Both can hand the bytes back here when you want to see where they sit in the file.
How to Read a Hex Dump
Each row starts with the offset of its first byte, followed by the bytes in hex and the same bytes as characters. Bytes between 0x20 and 0x7E show as printable ASCII; anything else shows as a dot, so readable text stands out on the right.
Byte order matters when a number spans several bytes. PNG stores lengths and sizes big-endian (most significant byte first), while formats such as BMP and WAV use little-endian, so the same value can look reversed between formats.
Common Hex-Editing Tasks in CTFs
Typical jobs are repairing a damaged header so a file opens (for example restoring the first bytes of a JPEG to FF D8 FF), changing a single field such as an image dimension, finding data appended after a format's end marker (FF D9 for JPEG, the IEND chunk for PNG), and reading a message stored in a plain-text region.
After editing a PNG field you usually also need to fix its CRC; the PNG Chunk Analyzer can check and repair it. To find out what a file really is before you edit, run it through the File Type Detector.
Editing Safely
As a hex editor it keeps edits in memory and shows them as changed bytes; your original file is never modified. Export writes a modified copy or a hex dump. Edits overwrite bytes in place, so you cannot insert or delete bytes and the file length stays the same.
Read Bytes as Numbers With the Data Inspector
A header field is rarely a single byte. A length, an offset or a timestamp is usually two, four or eight bytes read together, and the answer depends on byte order. Select a byte and the Data inspector reads up to eight bytes from that offset as 8, 16, 32 and 64-bit integers (signed and unsigned), Float32, Float64, an ASCII character and a UTF-8 character, in little-endian or big-endian order. For example the four bytes 78 56 34 12 are 305,419,896 read little-endian and 2,018,915,346 read big-endian.
The inspector reads the bytes as they currently are, so an edit shows up immediately, and a value that needs more bytes than remain in the file says so instead of guessing. Floating-point values are printed in the shortest form that reads back to the same number, so the bytes CD CC CC 3D read as little-endian Float32 show as 0.1. To convert a number between bases, or to read it as text, use the Number Base Converter.
File Start and End Markers
Where common formats begin and end — useful for spotting appended data or a damaged header.
| Format | Starts with | Ends with |
|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | IEND chunk: 49 45 4E 44 AE 42 60 82 |
| JPEG | FF D8 FF | FF D9 |
| GIF | 47 49 46 38 (GIF8) | 3B |
| 25 50 44 46 (%PDF) | %%EOF (25 25 45 4F 46) | |
| ZIP | 50 4B 03 04 | End-of-central-directory record: 50 4B 05 06 |
Keyboard Shortcuts
| Keys | Action | Group |
|---|---|---|
| Arrow keys | Move cursor | Navigation |
| Tab / Shift+Tab | Next / previous byte | Navigation |
| PageUp / PageDown | Jump 20 rows | Navigation |
| Ctrl/⌘+G | Go to offset | Navigation |
| Click / Shift+Click | Select a byte / extend the selection | Selection |
| Enter / Space | Edit the selected byte (hex) | Editing |
| Ctrl/⌘+Z | Undo the last edit | Editing |
| Ctrl/⌘+Shift+Z or Ctrl+Y | Redo an undone edit | Editing |
| Ctrl/⌘+V | Paste hex at the cursor | Editing |
| B or Ctrl/⌘+Click | Bookmark a byte | Bookmarks |
| Ctrl/⌘+F | Focus the search box | Search |
| ? | Show the shortcut list | Help |
How it works
1. Load bytes
Open a file of up to 100 MB or paste a hex string (also capped at 100 MB). Files are read with the browser File API.
2. Render only what is visible
The hex grid is virtualized: it renders the rows in view plus a small buffer, so large files scroll without building every row.
3. Highlight known signatures
The viewer reuses the same magic-byte signature table as the File Type Detector and matches them in the byte ranges it displays.
4. Search
Search by hex bytes, by text (printable ASCII), or by regular expression. Files up to 8 MB are searched on the main thread and larger ones in a Web Worker. Results are capped at 10,000 matches, regex patterns at 500 characters, and a regex match at 4,096 bytes.
5. Edit and export
Edited bytes are stored in an in-memory map of original versus edited values; the original file is never changed. Export writes a modified copy in 4 MB chunks, or a hex dump, and selections can be copied as hex, C, Python or JavaScript.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Offset column | The byte position of the first byte in each row, in hex. | Use Ctrl+G to jump to an offset you saw in another tool. |
| Hex and ASCII panes | Each byte in hex, and as a character when it is between 0x20 and 0x7E; other bytes show as a dot. | Readable text in the ASCII pane often marks metadata or embedded messages. |
| Signature highlight | A byte range that matches a known magic-byte signature. | A signature at an unexpected offset can mean an embedded or appended file. |
| Edited byte | A byte whose value differs from the original file, tracked in the diff map. | Edits only reach a file when you export; revert any byte to restore its original value. |
| Detail panel | The selected byte shown as decimal, binary and ASCII. | Use it when checking flags, lengths and single-bit differences. |
| Bookmarks | Saved offsets, stored in the browser's localStorage under the file's name and size. | Bookmark offsets you plan to return to across sessions. |
Examples
Input: A PNG whose first byte was changed from 89 to 00
Result: No PNG signature highlight at offset 0; the hex pane shows 00 50 4E 47.
Meaning: Editing that byte back to 89 and exporting the file restores a valid PNG header.
Input: Search for the text flag in a firmware image, then jump to a match
Result: Matches are listed with offsets and highlighted in the grid.
Meaning: The surrounding bytes show whether it is a real string, part of a table, or a decoy.
Input: A file opened straight after analysis in the Strings Extractor
Result: The Hex Viewer offers the file from the session hand-off, with no re-upload.
Meaning: The other tool kept a copy in your browser for up to 30 minutes so you can continue in the Hex Viewer.
Input: A JPEG whose first byte was changed to 00, so it begins 00 D8 FF E0 and will not open
Result: The Detector reports no confident match; in the Hex Viewer the first byte shows as 00 instead of FF.
Meaning: A JPEG must start FF D8 FF. Select the first byte, overwrite it with FF, export the modified copy and the file opens again.
Input: A text message written in the bytes after the end of an image
Result: Scrolling to the end of the file, the ASCII pane shows readable characters after the format's end marker.
Meaning: Data placed after the end marker is ignored by image viewers but is still part of the file. Bookmark the offset and extract or search it.
Limitations
- Files over 100 MB are rejected, and pasted hex is capped at 100 MB.
- Regex search matches the printable-ASCII view of the file, not raw bytes, and is capped at 500 pattern characters and 4,096-byte matches.
- Search stops at 10,000 results.
- Signature highlights are matched from magic bytes only and can be wrong on forged or partial headers.
- Edits are a byte overwrite. You cannot insert or delete bytes, so the file length stays the same.
- Undo and redo keep up to 200 steps (and a bounded number of changed bytes) in memory only; they are cleared when you load another file or leave the page.
- The Data inspector reads one offset at a time, up to eight bytes, as fixed-size integers, floats and a character. It has no structure templates, bit-field view, time formats or multi-byte strings, and it does not follow a pointer to another offset.
- Bookmarks live in this browser's localStorage, so they do not follow you to another browser or device.
Privacy
Files are read and edited in your browser and are not uploaded. Edits stay in memory until you export. Bookmarks are saved in localStorage in this browser, and a file handed over from another CTF Lab tool arrives through IndexedDB and stays on your device. If you accept analytics, coarse usage data (file category, extension, MIME type and a size range) may be recorded; file names and contents are not.
Frequently Asked Questions
Does this upload my file anywhere?
No. Everything runs in your browser — the file never leaves your machine. The viewer reads bytes locally using the File API.
What is the maximum file size?
100 MB. Files up to 100 MB are handled with a virtualised grid that only renders visible rows, so the page stays responsive even on very large files.
How does editing work?
Each edited byte is stored in an in-memory diff map. The original file is never modified. Undo and redo step through your edits (up to 200 steps, kept in memory and cleared when you load another file), and Revert all is one undoable step. When you download the result, the tool assembles the output in 4 MB chunks and writes your edits on top.
What search modes are available?
Hex (formal hex parser — '89 50 4E 47'), Text (ASCII 0x20–0x7E projection), and Regex (applied to the ASCII projection). Files larger than 8 MB are searched in a background WebWorker to keep the UI responsive.
What are bookmarks?
Bookmarks pin specific byte offsets so you can jump back to them instantly. They are stored in your browser's localStorage, keyed by filename and size — they persist across sessions.
What does the session handoff do?
If you used the File Type Detector or Strings Analyzer on a file, it is automatically offered here via IndexedDB — no need to re-upload. Session data expires after 30 minutes and is never sent to a server.
What does the Data inspector show?
Click a byte and the Data inspector reads up to eight bytes from that offset as UInt8/Int8, 16, 32 and 64-bit integers, Float32 and Float64, an ASCII character and a UTF-8 character, in little-endian or big-endian order. It includes your unsaved edits, shows 'needs N bytes' when too few remain, and prints floats in the shortest form that reads back to the same value.
What is the CTF hex format shown?
The standard xxd/hexdump -C format: offset (8 hex digits), two groups of 8 bytes, then an ASCII column in pipes. Bytes 0x20–0x7E are shown as characters; everything else is a dot.
How do I fix a corrupted file header?
First identify what the file should be, for example with the File Type Detector. Then compare its first bytes with that format's signature (FF D8 FF for JPEG, 89 50 4E 47 for PNG), select each wrong byte, type the correct hex value, and export the modified copy. Edits overwrite bytes in place, so this works when bytes were changed, not when they were removed.
What do the dots in the ASCII pane mean?
The ASCII pane shows a character for bytes between 0x20 and 0x7E. Every other byte, such as 0x00 or 0xFF, has no printable form and is drawn as a dot. A long run of readable characters among the dots usually marks text such as metadata, a string table or an embedded message.
Related Tools
File Type / Magic Byte Detector
Identify the file's true format before you edit its header.
Strings Extractor
Find readable text and offsets to jump to here.
Number Base Converter
Convert a hex value to decimal, binary, text or a big integer, and back.
Encoding Auto-Decoder
Select a suspicious string and decode it — Base64, hex, ROT13, gzip and more.
PNG Chunk Analyzer
For PNG files, see chunk boundaries and CRC results.
ROT13 & Caesar Cipher Solver
Selected readable text that looks rotated? Try every ROT/Caesar shift.