File Type / Magic Byte Detector
Identify any file's true format from magic bytes — not the extension. Detects mismatches, polyglots, and corrupted headers.
Try the demo instantly
Loads a sample PNG — shows magic byte detection, MIME type, hex dump, and CTF hints
Drop any file here or click to browse
Any format supported · Only the first 512 bytes are read
100% Client-Side Processing
Only the first 512 bytes are read via the browser FileReader API. Nothing is uploaded or sent anywhere.
How to identify a file (4 steps)
- Drop or Select a File: Upload any suspect file. Only the first 512 bytes are read — no data leaves your browser.
- Read the Detection Result: The tool matches the file header against 100+ known magic-byte signatures and shows format, MIME type, and confidence.
- Inspect the Hex Dump: Browse raw bytes to spot anomalies, embedded payloads, or tampered headers.
- Follow Repair Hints: Extension mismatches, truncation, and corrupt headers are flagged with actionable repair steps.
Frequently Asked Questions
Does the file get uploaded to a server?
No. Detection reads only the first 512 bytes using the browser's FileReader API — everything runs locally. Nothing is sent anywhere.
Why does the detected type differ from my file extension?
CTF challenges frequently disguise files by renaming them. Renaming a file does not change its underlying bytes — the tool identifies the real format directly from the raw header bytes (magic bytes), regardless of the extension.
What is a magic byte / file signature?
Most file formats begin with a known byte sequence. PNG files always start with 89 50 4E 47 0D 0A 1A 0A. ZIP files start with 50 4B 03 04. These sequences are called magic bytes.
What does 'weak confidence' mean?
Some signatures use only 2 bytes (e.g. 'MZ' for PE executables, '78 9C' for zlib). These patterns are shared by many files, so confidence is lower than with longer, unique signatures.
A file wasn't identified — what now?
The file may be encrypted, a custom binary, or plain text. Check the hex dump for high entropy (encryption), repeated patterns, or readable strings. Try the Strings Analyzer next.
What are multi-condition signatures?
Some formats share the same 4-byte prefix (e.g. RIFF). These require checking a second field to distinguish WebP from WAV from AVI. This tool checks ALL conditions before confirming a match.
Using Magic Bytes in CTF Forensics
CTF authors commonly rename files to hide their true format. A file called image.jpg may actually be a ZIP, PNG, PDF, executable, or another format entirely. Checking the first bytes lets you determine what the file really is before moving to deeper analysis.
Typical CTF triage workflow
What are magic bytes, file signatures, and magic numbers?
Magic bytes (also called file signatures or magic numbers) are fixed byte sequences at a known offset — usually the very start — of a file that identify its format. Every compliant PNG starts with exactly 89 50 4E 47 0D 0A 1A 0A; every PDF starts with 25 50 44 46 (%PDF). These bytes are set by the application that created the file and are part of the format specification itself — renaming a file does not change them. Tools like file on Linux, binwalk, and this detector all use magic bytes as the primary identification method because they are far more reliable than file extensions, which any user or script can change freely.
Supported file signatures (104)
| Format | Magic bytes (hex) |
|---|---|
| JPEG 2000 Image (JP2) | 00 00 00 0C 6A 50 20 20 0D 0A … |
| JPEG XL Image | 00 00 00 0C 4A 58 4C 20 0D 0A … |
| PNG Image | 89 50 4E 47 0D 0A 1A 0A |
| JPEG Image | FF D8 FF |
| GIF87a Image | 47 49 46 38 37 61 |
| GIF89a Image | 47 49 46 38 39 61 |
| WebP Image | 52 49 46 46 |
| TIFF Image (Little-Endian) | 49 49 2A 00 |
| TIFF Image (Big-Endian) | 4D 4D 00 2A |
| Adobe Photoshop (PSD) | 38 42 50 53 |
| ICO Icon | 00 00 01 00 |
| GIMP XCF Image | 67 69 6D 70 20 78 63 66 20 76 |
| BMP Image | 42 4D |
| ZIP Archive | 50 4B 03 04 |
| ZIP Archive (empty) | 50 4B 05 06 |
| ZIP Archive (spanned) | 50 4B 07 08 |
| RAR Archive (v5.0+) | 52 61 72 21 1A 07 01 00 |
| RAR Archive (v1.5+) | 52 61 72 21 1A 07 00 |
| 7-Zip Archive | 37 7A BC AF 27 1C |
| BZIP2 Compressed | 42 5A 68 |
| XZ Compressed | FD 37 7A 58 5A 00 |
| TAR Archive (ustar) | 75 73 74 61 72 @+257 |
| Cabinet Archive (CAB) | 4D 53 43 46 |
| Debian Package (DEB) | 21 3C 61 72 63 68 3E |
| RPM Package | ED AB EE DB |
| GZIP Compressed | 1F 8B |
| Zstandard Compressed | 28 B5 2F FD |
| LZ4 Compressed | 04 22 4D 18 |
| LZO Compressed | 89 4C 5A 4F 0D 0A 1A 0A |
| Snappy Framing | FF 06 00 00 73 4E 61 50 70 59 |
| Cpio Archive (newc) | 30 37 30 37 30 31 |
| Cpio Archive (CRC) | 30 37 30 37 30 32 |
| OLE Compound Document | D0 CF 11 E0 A1 B1 1A E1 |
| MP3 Audio (ID3) | 49 44 33 |
| WAV Audio | 52 49 46 46 |
| AIFF Audio | 46 4F 52 4D |
| AIFF-C Audio | 46 4F 52 4D |
| FLAC Audio | 66 4C 61 43 |
| OGG Container | 4F 67 67 53 |
| MIDI Audio | 4D 54 68 64 |
| AAC Audio (ADTS) | FF F1 |
| AAC Audio (ADTS, CRC) | FF F9 |
| AU / SND Audio | 2E 73 6E 64 |
| MP3 Audio (sync) | FF FB |
| MP3 Audio (sync v2.5) | FF F3 |
| MP3 Audio (sync v2) | FF F2 |
| WMV / WMA / ASF (Windows Media) | 30 26 B2 75 8E 66 CF 11 A6 D9 … |
| MP4 / ISO Base Media | 66 74 79 70 @+4 |
| AVI Video | 52 49 46 46 |
| MKV / WebM Video | 1A 45 DF A3 |
| FLV Video | 46 4C 56 01 |
| MPEG Program Stream | 00 00 01 BA |
| ELF Executable | 7F 45 4C 46 |
| Java Class File | CA FE BA BE |
| Java KeyStore | FE ED FE ED |
| Mach-O 32-bit LE | CE FA ED FE |
| Mach-O 64-bit LE | CF FA ED FE |
| Mach-O 32-bit BE | FE ED FA CE |
| Mach-O 64-bit BE | FE ED FA CF |
| WebAssembly (WASM) | 00 61 73 6D |
| Android DEX Bytecode | 64 65 78 0A |
| Android ODEX (optimized DEX) | 64 65 79 0A |
| Lua Bytecode | 1B 4C 75 61 |
| PE / EXE / DLL | 4D 5A |
| PostScript Document | 25 21 50 53 |
| PDF Document | 25 50 44 46 2D |
| RTF Document | 7B 5C 72 74 66 31 |
| Microsoft Access Database | 00 01 00 00 53 74 61 6E 64 61 … |
| SQLite Database | 53 51 4C 69 74 65 20 66 6F 72 … |
| KeePass 2.x Database | 03 D9 A2 9A 67 FB 4B B5 |
| KeePass 1.x Database | 03 D9 A2 9A |
| WOFF2 Font | 77 4F 46 32 |
| WOFF Font | 77 4F 46 46 |
| OTF Font | 4F 54 54 4F |
| TTF Font | 00 01 00 00 |
| PCAP Network Capture (LE) | D4 C3 B2 A1 |
| PCAP Network Capture (BE) | A1 B2 C3 D4 |
| PCAPNG Network Capture | 0A 0D 0D 0A |
| Windows Registry Hive | 72 65 67 66 |
| Windows Shortcut (LNK) | 4C 00 00 00 01 14 02 00 |
| CHM Help File | 49 54 53 46 |
| Outlook PST | 21 42 44 4E |
| PGP / GPG Encrypted Data | 85 02 |
| PGP Public Key Ring | 99 01 |
| PGP / GPG (new format) | C1 |
| QOI Image | 71 6F 69 66 |
| BPG Image | 42 50 47 FB |
| Apple ICNS Icon | 69 63 6E 73 |
| Windows Cursor (CUR) | 00 00 02 00 |
| BitTorrent Metainfo | 64 38 3A |
| Apple Disk Image (DMG) | 78 01 73 0D |
| SWF Flash (compressed) | 43 57 53 |
| SWF Flash (uncompressed) | 46 57 53 |
| VHD Disk Image | 63 6F 6E 65 63 74 69 78 |
| X.509 Certificate (DER) | 30 82 |
| Zlib Compressed (default) | 78 9C |
| Zlib Compressed (best) | 78 DA |
| Zlib Compressed (none) | 78 01 |
| PEM / ASCII Armored Data | 2D 2D 2D 2D 2D 42 45 47 49 4E |
| VMDK Disk Image | 4B 44 4D 56 |
| Apple Binary Property List | 62 70 6C 69 73 74 |
| LZFSE Compressed | 62 76 78 32 |
| Android Sparse Image | 3A FF 26 ED |
| QEMU QCOW2 Disk Image | 51 46 49 FB |