File Signature Checker
See what a file really is from its first bytes — and whether its name is lying.
The first 512 bytes are read in your browser and never uploaded. You get the real format, its MIME type and the header bytes — plus a warning when the extension disagrees with the content.
When you need this
- A file will not open and you suspect the extension is wrong — someone renamed a PNG to .jpg, or a ZIP to .docx.
- You are about to trust a file because of its name, and want one cheap check before you do.
- A download arrived with no extension at all, and you need to know what it is before choosing an app to open it.
- A pipeline rejects an upload as "not a valid image" and you need to see whether the bytes or the parser is at fault.
Why other file-type checkers fall short
Most tools read the filename and report the extension back to you. That is the one piece of information you already had, and it is exactly the thing under suspicion.
Online checkers ask you to upload the file. For a document you have not opened yet, that is the worst possible moment to send it to a third party.
Tools that list a hundred formats but never say "these two disagree" leave you to compare two columns yourself — and the comparison is the only part that matters.
Some report the MIME type the operating system guessed, which is derived from the extension again. A guess dressed as a measurement.
File signature reference
Every row is a rule the checker applies: a fixed byte sequence at a fixed offset. Where a row lists two groups of bytes, both must match — RIFF alone does not make a file a WebP, and the brand at offset 8 is what separates MP4 from QuickTime.
| Format | Extensions | Offset | Magic bytes (hex) | MIME type |
|---|---|---|---|---|
| PNG | png | 0 | 89 50 4E 47 0D 0A 1A 0A | image/png |
| JPEG | jpg, jpeg, jpe, jfif | 0 | FF D8 FF | image/jpeg |
| GIF | gif | 0 | 47 49 46 38 | image/gif |
| WebP | webp | 0, 8 | 52 49 46 46 · 57 45 42 50 | image/webp |
| BMP | bmp, dib | 0 | 42 4D | image/bmp |
| TIFF (little-endian) | tif, tiff | 0 | 49 49 2A 00 | image/tiff |
| TIFF (big-endian) | tif, tiff | 0 | 4D 4D 00 2A | image/tiff |
| ICO / CUR | ico, cur | 0 | 00 00 01 00 | image/x-icon |
| AVIF | avif | 4, 8 | 66 74 79 70 · 61 76 69 66 | image/avif |
| HEIC / HEIF | heic, heif | 4, 8 | 66 74 79 70 · 68 65 69 63 | image/heic |
| 0 | 25 50 44 46 | application/pdf | ||
| GZIP | gz, tgz | 0 | 1F 8B | application/gzip |
| RAR | rar | 0 | 52 61 72 21 1A 07 | application/vnd.rar |
| 7-Zip | 7z | 0 | 37 7A BC AF 27 1C | application/x-7z-compressed |
| ZIP | zip | 0 | 50 4B 03 04 | application/zip |
| ZIP (empty archive) | zip | 0 | 50 4B 05 06 | application/zip |
| ZIP (spanned) | zip | 0 | 50 4B 07 08 | application/zip |
| SQLite 3 | sqlite, db, db3 | 0 | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 | application/vnd.sqlite3 |
| TAR | tar | 257 | 75 73 74 61 72 | application/x-tar |
| WAV | wav | 0, 8 | 52 49 46 46 · 57 41 56 45 | audio/wav |
| AVI | avi | 0, 8 | 52 49 46 46 · 41 56 49 20 | video/x-msvideo |
| Ogg | ogg, oga, opus | 0 | 4F 67 67 53 | audio/ogg |
| FLAC | flac | 0 | 66 4C 61 43 | audio/flac |
| MP3 (ID3 tag) | mp3 | 0 | 49 44 33 | audio/mpeg |
| MP3 (frame sync) | mp3 | 0 | FF FB | audio/mpeg |
| QuickTime MOV | mov | 4, 8 | 66 74 79 70 · 71 74 20 20 | video/quicktime |
| MP4 | mp4, m4v, m4a | 4 | 66 74 79 70 | video/mp4 |
| WebAssembly | wasm | 0 | 00 61 73 6D | application/wasm |
| ELF | elf, so, o | 0 | 7F 45 4C 46 | application/x-elf |
| PE (Windows EXE/DLL) | exe, dll, sys | 0 | 4D 5A | application/vnd.microsoft.portable-executable |
| Java class | class | 0 | CA FE BA BE | application/java-vm |
Frequently asked questions
What is a file signature?
A file signature (also called a magic number) is a short fixed byte sequence at the start of a file that identifies its format. PNG files begin with 89 50 4E 47, PDFs begin with the characters %PDF, and ZIP archives begin with PK. Software that opens files reads these bytes; the extension is a hint for humans.
Why does a renamed file still fail to open?
Because the application decides from the bytes, not the name. Renaming photo.png to photo.jpg changes the label in the file listing and nothing else — the first bytes still say PNG. Some applications try to recover by sniffing the content, which is why a renamed file sometimes opens anyway and sometimes shows a broken image.
Is my file uploaded?
No. The page reads the first 512 bytes with the browser's own file API and does the comparison in JavaScript. There is no upload step and no server to receive one. You can open the network panel before dropping the file and watch: no request is made.
Why does a DOCX show up as ZIP?
Because it is one. Modern Office documents, APK packages and JAR files are all ZIP containers with a specific internal layout. Telling them apart means reading the archive index, which this tool does not do — so it reports the container honestly rather than guessing which kind of ZIP it is.
Why can a text file have no signature?
Because plain text has no header. TXT, JSON, CSV, and most source files begin directly with their content, so there is no magic number to match. This tool says so explicitly instead of guessing a format from the extension.