BYTETOOLS

File Signature (Magic Number) Identifier

Identify any file's real type from its magic number. Drop a file or paste its first bytes and see whether the extension matches the content.

Drop any file here or click to browseOnly the first 40 KB are read, and only in your browser — nothing is uploaded

Detected file type

Drop a file or paste its first bytes to identify what it really is.

What is the File Signature (Magic Number) Identifier?

The ByteTools File Signature Identifier reads the first bytes of a file and matches them against a table of magic numbers to tell you what the file really is.

  • Over 50 signatures across images, media, archives and binaries
  • Matches signatures at an offset, not just at byte zero
  • Warns when the file extension disagrees with the content
  • Accepts a dropped file or pasted hex bytes
  • Shows a hex dump of the leading bytes
  • 100% client-side — only the file header is read, never uploaded

How to use the File Signature (Magic Number) Identifier

  1. 1

    Drop a file onto the box, or click to browse — any file type works.

  2. 2

    Alternatively, paste the leading bytes as hex if you only have a dump or a packet capture.

  3. 3

    Read the detected type, its MIME type, the matching signature and the offset that signature sits at.

  4. 4

    Check the banner that compares the file extension with the bytes, and copy the report if you need to record the finding.

About the File Signature (Magic Number) Identifier

The ByteTools File Signature Identifier reads the first bytes of a file and matches them against a table of magic numbers to tell you what the file really is. It knows the common image, video, audio, archive, document, font and executable signatures, including ones that sit at an offset rather than at byte zero, such as the ftyp box in MP4 files and the ustar marker in TAR archives.

Crucially, it compares what the bytes say against what the extension claims. A .jpg that is really a PNG, or a .pdf that is really a ZIP, gets flagged immediately — useful when a download looks wrong, when a user upload fails validation, or when you are triaging an unfamiliar file.

Only the first 40 KB of your file are read, and they are read 100% locally in your browser. Nothing is uploaded and nothing is executed, so you can safely check a file you do not yet trust. If all you have is a hex dump from a log or a packet capture, paste those bytes instead and the same signature table is applied to them.

Frequently asked questions

What is a file signature or magic number?

It is a short, fixed sequence of bytes at a known position that identifies a file format. PNG files begin with 89 50 4E 47, PDFs begin with the ASCII text %PDF, and ZIP archives begin with PK followed by 03 04. Operating systems and security tools use these markers rather than trusting the extension.

How do I tell if a file has the wrong extension?

Compare the magic number with the extension, which is exactly what this tool does automatically. If you drop a file called photo.jpg and the bytes say PNG, you get a warning. That mismatch is usually harmless renaming, but it is also a classic trick for slipping a file past a naive upload filter.

Why does my text or CSV file show no match?

Plain text formats have no magic number at all. HTML, CSV, JSON, source code and log files are just characters from byte zero, so there is nothing to match. A blank result for a text file is the correct answer, not a failure.

Why do DOCX and JAR files show up as ZIP?

Because they genuinely are ZIP archives. The format adds required entries inside the archive rather than changing the outer container, so the leading bytes are identical to any other ZIP. To distinguish them you need to look at the entry names inside, which a ZIP viewer will show you.

Is my file uploaded when I check it?

No. Your browser reads only the first 40 KB directly from disk and matches it in JavaScript. No part of the file is transmitted or stored, which is what makes this safe for suspicious downloads.

Related tools