Polyglot File Analyzer
Detect multiple file formats hidden in one file — PNG+ZIP, JPEG+PDF, and more. Binwalk-compatible signature scan, byte map, extraction, and polyfile-style JSON report. No upload.
Drop a file here, or
Any file type · 150+ signatures checked against the file's head and tail
100% local — nothing is uploaded
Have more than one suspicious file?
How to Analyze a Polyglot File (4 steps)
- Upload the file you suspect is a polyglot (PNG+ZIP, JPEG+PDF, or any format mashup)
- The scanner checks 150+ known file signatures across the first 64 KB and last 1 MB
- Review each detected format's byte range in the interactive byte map, or switch to Strings / Raw Output
- Extract any embedded region, or download the binwalk-style / polyfile-JSON report
Polyglot Analyzer — Detection Methods
| Method | Technique | Formats | Best For |
|---|---|---|---|
| Signature Scan | Matches 150+ magic-byte signatures at the file's head and tail | Any format | Fast first-pass detection |
| Format-Aware Parse | Walks JPEG / PNG / MP3 / PDF / ZIP internal structure with CRC32 validation | JPEG, PNG, MP3, PDF, ZIP | Confirming trailing data and corruption |
| Entropy Analysis | Per-block Shannon entropy across the whole file | Any format | Spotting encrypted or compressed regions |
| Strings Extraction | Pulls printable ASCII runs of 4+ characters | Any format | Finding flags, URLs, embedded text |
Frequently Asked Questions
What is a polyglot file?
A polyglot is a single file that's valid in two or more formats at once — for example a PNG that's also a working ZIP archive, or a JPEG that's also a PDF. Each format's parser reads only the bytes it recognizes and ignores the rest, so the file 'looks like' whichever program opens it.
How do I check if an image has a hidden file or text inside it?
Upload the image here — the scanner checks it against 150+ file signatures to catch a hidden file (a ZIP, PDF, or executable appended after the image data), and the Strings tab pulls any readable text, URLs, or CTF flags embedded in the raw bytes. Between the two, that covers both 'is something hidden' and 'what does it say' without needing a separate tool.
How is this different from binwalk or polyfile?
Same idea — signature scanning plus structural parsing — but it runs 100% in your browser tab. Nothing is uploaded. Output mirrors binwalk's DECIMAL/HEXADECIMAL/DESCRIPTION table and polyfile's JSON schema so you can drop this into an existing workflow.
Sequential vs overlapping polyglots — what's the difference?
Sequential (chimera) polyglots concatenate whole formats end-to-end — each parser stops at its own EOF marker and never sees the next format. Overlapping (true) polyglots reuse the same byte ranges for two formats at once, which is the harder, more surgical construction.
Why didn't it find a format I know is in there?
The signature database covers 150+ common formats. Custom or obscure containers, or a payload with its magic bytes deliberately stripped, won't show up in the signature scan — try Strings or Raw Byte Search to look for other markers manually.
Is my file uploaded anywhere?
No. Scanning, hashing, and extraction all run locally using ArrayBuffer, the Web Crypto API, and a WebWorker. Nothing leaves your device.
What does 'Matryoshka' mode do?
It re-scans each extracted region for further nested formats, recursively — useful for CTF challenges that hide a polyglot inside a polyglot. It only runs when you ask for it, since recursive scanning is heavier than the default pass.