File Type / Magic Byte Detector
Identify any file's true format from magic bytes — not the extension. Detects mismatches, polyglots, and corrupted headers.
Try the demo instantly
Loads a sample PNG — shows magic byte detection, MIME type, hex dump, and CTF hints
Drop any file here or click to browse
Any format supported · Only the first 512 bytes are read
100% Client-Side Processing
Only the first 512 bytes are read via the browser FileReader API. Nothing is uploaded or sent anywhere.
How to identify a file (4 steps)
- Drop or Select a File: Upload any suspect file. Detection uses only the first 512 bytes, and nothing is sent to a server. Files up to 20 MB are also kept in this browser's IndexedDB so the Hex Viewer can open them.
- Read the Detection Result: The tool matches the file header against 100+ known magic-byte signatures and shows format, MIME type, and confidence.
- Inspect the Hex Dump: Browse raw bytes to spot anomalies, embedded payloads, or tampered headers.
- Follow Repair Hints: Extension mismatches, truncation, and corrupt headers are flagged with actionable repair steps.
Using Magic Bytes in CTF Forensics
CTF authors commonly rename files to hide their true format. A file called image.jpg may actually be a ZIP, PNG, PDF, executable, or another format entirely. Checking the first bytes lets you determine what the file really is before moving to deeper analysis.
Typical CTF triage workflow
What are magic bytes, file signatures, and magic numbers?
Magic bytes (also called file signatures or magic numbers) are fixed byte sequences at a known offset — usually the very start — of a file that identify its format. Every compliant PNG starts with exactly 89 50 4E 47 0D 0A 1A 0A; every PDF starts with 25 50 44 46 (%PDF). These bytes are set by the application that created the file and are part of the format specification itself — renaming a file does not change them. Tools like file on Linux, binwalk, and this detector all use magic bytes as the primary identification method because they are far more reliable than file extensions, which any user or script can change freely.
Supported file signatures (104)
| Format | Magic bytes (hex) |
|---|---|
| JPEG 2000 Image (JP2) | 00 00 00 0C 6A 50 20 20 0D 0A … |
| JPEG XL Image | 00 00 00 0C 4A 58 4C 20 0D 0A … |
| PNG Image | 89 50 4E 47 0D 0A 1A 0A |
| JPEG Image | FF D8 FF |
| GIF87a Image | 47 49 46 38 37 61 |
| GIF89a Image | 47 49 46 38 39 61 |
| WebP Image | 52 49 46 46 |
| TIFF Image (Little-Endian) | 49 49 2A 00 |
| TIFF Image (Big-Endian) | 4D 4D 00 2A |
| Adobe Photoshop (PSD) | 38 42 50 53 |
| ICO Icon | 00 00 01 00 |
| GIMP XCF Image | 67 69 6D 70 20 78 63 66 20 76 |
| BMP Image | 42 4D |
| ZIP Archive | 50 4B 03 04 |
| ZIP Archive (empty) | 50 4B 05 06 |
| ZIP Archive (spanned) | 50 4B 07 08 |
| RAR Archive (v5.0+) | 52 61 72 21 1A 07 01 00 |
| RAR Archive (v1.5+) | 52 61 72 21 1A 07 00 |
| 7-Zip Archive | 37 7A BC AF 27 1C |
| BZIP2 Compressed | 42 5A 68 |
| XZ Compressed | FD 37 7A 58 5A 00 |
| TAR Archive (ustar) | 75 73 74 61 72 @+257 |
| Cabinet Archive (CAB) | 4D 53 43 46 |
| Debian Package (DEB) | 21 3C 61 72 63 68 3E |
| RPM Package | ED AB EE DB |
| GZIP Compressed | 1F 8B |
| Zstandard Compressed | 28 B5 2F FD |
| LZ4 Compressed | 04 22 4D 18 |
| LZO Compressed | 89 4C 5A 4F 0D 0A 1A 0A |
| Snappy Framing | FF 06 00 00 73 4E 61 50 70 59 |
| Cpio Archive (newc) | 30 37 30 37 30 31 |
| Cpio Archive (CRC) | 30 37 30 37 30 32 |
| OLE Compound Document | D0 CF 11 E0 A1 B1 1A E1 |
| MP3 Audio (ID3) | 49 44 33 |
| WAV Audio | 52 49 46 46 |
| AIFF Audio | 46 4F 52 4D |
| AIFF-C Audio | 46 4F 52 4D |
| FLAC Audio | 66 4C 61 43 |
| OGG Container | 4F 67 67 53 |
| MIDI Audio | 4D 54 68 64 |
| AAC Audio (ADTS) | FF F1 |
| AAC Audio (ADTS, CRC) | FF F9 |
| AU / SND Audio | 2E 73 6E 64 |
| MP3 Audio (sync) | FF FB |
| MP3 Audio (sync v2.5) | FF F3 |
| MP3 Audio (sync v2) | FF F2 |
| WMV / WMA / ASF (Windows Media) | 30 26 B2 75 8E 66 CF 11 A6 D9 … |
| MP4 / ISO Base Media | 66 74 79 70 @+4 |
| AVI Video | 52 49 46 46 |
| MKV / WebM Video | 1A 45 DF A3 |
| FLV Video | 46 4C 56 01 |
| MPEG Program Stream | 00 00 01 BA |
| ELF Executable | 7F 45 4C 46 |
| Java Class File | CA FE BA BE |
| Java KeyStore | FE ED FE ED |
| Mach-O 32-bit LE | CE FA ED FE |
| Mach-O 64-bit LE | CF FA ED FE |
| Mach-O 32-bit BE | FE ED FA CE |
| Mach-O 64-bit BE | FE ED FA CF |
| WebAssembly (WASM) | 00 61 73 6D |
| Android DEX Bytecode | 64 65 78 0A |
| Android ODEX (optimized DEX) | 64 65 79 0A |
| Lua Bytecode | 1B 4C 75 61 |
| PE / EXE / DLL | 4D 5A |
| PostScript Document | 25 21 50 53 |
| PDF Document | 25 50 44 46 2D |
| RTF Document | 7B 5C 72 74 66 31 |
| Microsoft Access Database | 00 01 00 00 53 74 61 6E 64 61 … |
| SQLite Database | 53 51 4C 69 74 65 20 66 6F 72 … |
| KeePass 2.x Database | 03 D9 A2 9A 67 FB 4B B5 |
| KeePass 1.x Database | 03 D9 A2 9A |
| WOFF2 Font | 77 4F 46 32 |
| WOFF Font | 77 4F 46 46 |
| OTF Font | 4F 54 54 4F |
| TTF Font | 00 01 00 00 |
| PCAP Network Capture (LE) | D4 C3 B2 A1 |
| PCAP Network Capture (BE) | A1 B2 C3 D4 |
| PCAPNG Network Capture | 0A 0D 0D 0A |
| Windows Registry Hive | 72 65 67 66 |
| Windows Shortcut (LNK) | 4C 00 00 00 01 14 02 00 |
| CHM Help File | 49 54 53 46 |
| Outlook PST | 21 42 44 4E |
| PGP / GPG Encrypted Data | 85 02 |
| PGP Public Key Ring | 99 01 |
| PGP / GPG (new format) | C1 |
| QOI Image | 71 6F 69 66 |
| BPG Image | 42 50 47 FB |
| Apple ICNS Icon | 69 63 6E 73 |
| Windows Cursor (CUR) | 00 00 02 00 |
| BitTorrent Metainfo | 64 38 3A |
| Apple Disk Image (DMG) | 78 01 73 0D |
| SWF Flash (compressed) | 43 57 53 |
| SWF Flash (uncompressed) | 46 57 53 |
| VHD Disk Image | 63 6F 6E 65 63 74 69 78 |
| X.509 Certificate (DER) | 30 82 |
| Zlib Compressed (default) | 78 9C |
| Zlib Compressed (best) | 78 DA |
| Zlib Compressed (none) | 78 01 |
| PEM / ASCII Armored Data | 2D 2D 2D 2D 2D 42 45 47 49 4E |
| VMDK Disk Image | 4B 44 4D 56 |
| Apple Binary Property List | 62 70 6C 69 73 74 |
| LZFSE Compressed | 62 76 78 32 |
| Android Sparse Image | 3A FF 26 ED |
| QEMU QCOW2 Disk Image | 51 46 49 FB |
What Are Magic Bytes and File Signatures?
Most file formats begin with a short, fixed byte sequence that identifies them. PNG starts with 89 50 4E 47 0D 0A 1A 0A, JPEG with FF D8 FF, ZIP with 50 4B 03 04, PDF with the text %PDF- and ELF executables with 7F 45 4C 46. These sequences are called magic bytes, file signatures or magic numbers, and tools such as the Unix file command read them instead of trusting the file name.
This detector compares the first bytes of your file with its signature table, reports the best match with a confidence level, and shows the raw header so you can check the result yourself.
Why You Cannot Trust a File Extension
An extension is only a label. Renaming a file from .png to .txt changes the name and nothing else, so the bytes still say PNG. CTF authors rename files, strip or overwrite headers, and hand you a blob with no extension at all; malware often does the same to look harmless.
When the detected type and the extension disagree, the report flags an extension mismatch. The usual next step is to rename the file to the detected type and open it with the matching tool.
Containers, Polyglots and Ambiguous Signatures
Several formats share one container. DOCX, XLSX, JAR, APK and EPUB are all ZIP archives, and WAV, WebP and AVI all begin with a RIFF header and differ only in a format field at bytes 8-11, which is why the detector checks more than one condition for them.
A polyglot is a single file that is valid as two formats at once, for example an image that is also a ZIP archive. When more than one signature matches at different positions, the report lists them so you can try opening the file as each candidate.
What a Magic-Byte Check Cannot Tell You
Only the first 512 bytes are read, so data appended later in the file will not appear here, and a header can be forged to claim a type it is not. Treat the result as what the file claims to be, then confirm with a structure tool.
For text hidden in the file use the Strings Extractor, for raw bytes use the Hex Viewer, and for a PNG use the PNG Chunk Analyzer to walk every chunk.
Common File Signatures (Magic Bytes)
Generated from the detector's own signature table, so it always matches what the tool checks.
| Format | Signature bytes | Position | Confidence |
|---|---|---|---|
| PNG Image | 89 50 4E 47 0D 0A 1A 0A | start of file | Strong |
| JPEG Image | FF D8 FF | start of file | Strong |
| GIF87a Image | 47 49 46 38 37 61 | start of file | Strong |
| BMP Image | 42 4D | start of file | Weak (short signature) |
| PDF Document | 25 50 44 46 2D | start of file | Strong |
| ZIP Archive | 50 4B 03 04 | start of file | Strong |
| RAR Archive (v5.0+) | 52 61 72 21 1A 07 01 00 | start of file | Strong |
| 7-Zip Archive | 37 7A BC AF 27 1C | start of file | Strong |
| GZIP Compressed | 1F 8B | start of file | Weak (short signature) |
| PE / EXE / DLL | 4D 5A | start of file | Weak (short signature) |
| MP3 Audio (ID3) | 49 44 33 | start of file | Strong |
| WAV Audio | 52 49 46 46 | start of file | Strong |
| SQLite Database | 53 51 4C 69 74 65 20 66 … | start of file | Strong |
How it works
1. Read the header
Detection uses only the first 512 bytes of the file, read with file.slice(0, 512). Nothing after byte 512 takes part in the result.
2. Match magic bytes
The header is compared against 104 signatures. A signature can require several byte conditions at fixed offsets, for example a RIFF container must also match its format field at bytes 8-11 to be WAV, WebP or AVI. Strong matches win over weak ones such as two-byte signatures.
3. Flag anomalies
The detected type is compared with the file extension. The report also notes when no signature matches, when several signatures match at different offsets (a possible polyglot) or at the same offset (an ambiguous signature), and when the file is extremely small.
4. Check structure
For PNG, JPEG, GIF, PDF, ZIP and ELF the tool looks for the format's end marker (IEND, FF D9, the GIF trailer, %%EOF, the ZIP end-of-central-directory record) or plausible header fields inside the bytes it read. On large files the end marker is usually outside those 512 bytes, so the result is often reported as unknown rather than complete.
5. Analyse the bytes
Within the same 512 bytes it computes Shannon entropy, the printable-byte ratio, UTF-8 validity and JSON validity, guesses common text formats (JSON, XML/HTML, CSV, PEM, plain text), scans for up to three other known signatures, and reads the brand of ISO media files.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| Detected type and confidence | The best signature match. Strong means a longer or multi-condition signature; weak means a short signature shared by many files, such as MZ or 78 9C. | Treat weak matches as a lead, not a verdict. Confirm with another tool. |
| Extension mismatch | The extension does not belong to the detected type. | The file may have been renamed on purpose. Rename it to the detected type and open it. |
| Multiple signatures | More than one signature matched. Different offsets suggest a polyglot; the same offset suggests an ambiguous signature. | Inspect the hex dump and try opening the file as each candidate format. |
| Structural status | Whether the format's end marker or header fields were found in the bytes read: complete, truncated or unknown. | Truncated means the file looks cut off. Unknown on a large file usually just means the end is past byte 512. |
| Entropy level | High is above 7.2 bits per byte, medium above 5, in the first 512 bytes only. | High entropy with few printable bytes suggests compressed or encrypted data. |
| Embedded signature | Another known magic-byte sequence found inside the first 512 bytes, after the primary match. | Look at that offset in the Hex Viewer; it can indicate a file appended inside another. |
| Repair candidates | Shown when no signature matches and the first four bytes are all 0x00 or all printable ASCII. | Write one candidate's magic bytes over the header in a hex editor and re-run the detector. |
Examples
Input: A file named notes.txt that begins 89 50 4E 47 0D 0A 1A 0A
Result: Detected as PNG, with an extension-mismatch warning.
Meaning: The file is a renamed PNG. Rename it to .png, then inspect its chunks in the PNG Chunk Analyzer.
Input: A file whose first four bytes are 00 00 00 00 and matches no signature
Result: No-signature notice, a warning that the header looks zeroed, and repair candidates for PNG, JPEG, PDF, ZIP, GIF and ELF.
Meaning: The header may have been wiped on purpose. Try each candidate in a hex editor and see which one makes the file open.
Input: A .docx file
Result: Detected as a ZIP archive with a hint that many formats are ZIP-based.
Meaning: DOCX, EPUB, JAR and APK are ZIP containers. Unzipping the file lets you inspect its parts.
Input: A file named photo.png that begins FF D8 FF E0
Result: Detected as JPEG, with an extension-mismatch warning.
Meaning: The file is a JPEG saved under the wrong name. Rename it to .jpg; a PNG-only tool would reject it.
Input: A file whose header reads RIFF, four size bytes, then WAVE
Result: Detected as WAV, not as WebP or AVI, even though all three start with RIFF.
Meaning: RIFF is a shared container; the format field at bytes 8-11 decides the type, so the detector checks it before naming the file.
Limitations
- Only the first 512 bytes are analysed. Data appended later in the file, or files embedded past byte 512, will not appear.
- Magic bytes can be forged or copied, so a match shows what the header claims, not proof of the whole file's contents.
- The 104 signatures are not exhaustive. An unknown result does not mean the file is invalid.
- Embedded-signature scanning reports at most three finds, one occurrence per type.
- The CTF flag check looks only for CTF{ and flag{ patterns inside the first 512 bytes.
- Text-format guesses (JSON, XML, CSV, PEM) are heuristics based on how the content starts.
Privacy
Detection runs in your browser and reads only the first 512 bytes of the file. The file is not uploaded. For files up to 20 MB, a full copy is also saved in IndexedDB in this browser so the Hex Viewer can open it without a re-upload; it stays on your device, and the Hex Viewer only offers it for 30 minutes. If you accept analytics, coarse usage data (file category, extension, MIME type and a size range) may be recorded; file names and contents are not.
Frequently Asked Questions
Does the file get uploaded to a server?
No. Detection reads only the first 512 bytes in your browser and nothing is sent to a server. For files up to 20 MB, a full copy is also saved in your browser's IndexedDB so the Hex Viewer can open it without a re-upload; the Hex Viewer only offers it for 30 minutes. It stays on your device.
Why does the detected type differ from my file extension?
CTF challenges frequently disguise files by renaming them. Renaming a file does not change its underlying bytes — the tool identifies the real format directly from the raw header bytes (magic bytes), regardless of the extension.
What is a magic byte / file signature?
Most file formats begin with a known byte sequence. PNG files always start with 89 50 4E 47 0D 0A 1A 0A. ZIP files start with 50 4B 03 04. These sequences are called magic bytes.
What does 'weak confidence' mean?
Some signatures use only 2 bytes (e.g. 'MZ' for PE executables, '78 9C' for zlib). These patterns are shared by many files, so confidence is lower than with longer, unique signatures.
A file wasn't identified — what now?
The file may be encrypted, a custom binary, or plain text. Check the hex dump for high entropy (encryption), repeated patterns, or readable strings. Try the Strings Analyzer next.
What are multi-condition signatures?
Some formats share the same 4-byte prefix (e.g. RIFF). These require checking a second field to distinguish WebP from WAV from AVI. This tool checks ALL conditions before confirming a match.
Can the detector repair a file whose header was wiped?
It cannot rewrite the file, but when no signature matches and the first four bytes are all 0x00 or all printable ASCII it lists repair candidates for common formats. Write one candidate's magic bytes over the start of the file in a hex editor, such as the Hex Viewer, then run the detector again to see whether the file now identifies cleanly.