File Signature Identifier

How to use

1. 1Pick a mode: drop a file to inspect its real first 64 bytes, or paste a hex string copied from a hex editor, a network capture, or a base64 decode.
2. 2In file mode, drag a file onto the drop zone or click to choose one. Only the first 64 bytes are read from disk; the rest of the file is never touched.
3. 3In hex mode, paste raw hex (89 50 4E 47 0D 0A 1A 0A or 89504E470D0A1A0A). Spaces, commas, line breaks, 0x and \x prefixes are ignored. Try a preset to load a known signature.
4. 4Read the matched signatures. Each card lists the detected format, the file extensions normally tied to it, the canonical MIME type, and notes on shared prefixes and how to disambiguate.
5. 5Compare the file's declared extension and MIME against the matched signatures. A mismatch warning appears when the extension does not belong to any matched format, a common indicator of file type spoofing.
6. 6Copy the hex dump, the printable ASCII, or any field with the inline copy buttons for use in a bug report, an upload-policy ticket, or a security write-up.

About this tool

File Signature Identifier reads the first 64 bytes of a file (or a hex string you paste) and matches them against a curated table of file format signatures, the same byte patterns the Unix file(1) command and libmagic rely on. The detection is content-based, so it does not trust the file extension or the Content-Type the browser reports. The signature table covers more than 100 formats across ten categories: images (PNG, JPEG, GIF, WebP, BMP, ICO, ICNS, TIFF, HEIC, AVIF, PSD, JPEG XL, SVG), documents (PDF, RTF, EPUB, legacy Microsoft Office OLE), archives and packages (ZIP and the ZIP-based families DOCX, XLSX, PPTX, ODT, JAR, APK, IPA, EPUB; plus RAR4, RAR5, 7z, GZIP, BZIP2, XZ, Zstd, Lzip, LZ4, TAR ustar, DEB, RPM, CAB), audio (MP3 with ID3 or raw frame, WAV, FLAC, Ogg, MIDI, AIFF, AMR), video (MP4, MOV, 3GP, WebM, Matroska, AVI, Flash FLV, MPEG-PS), executables (Windows PE, ELF, Mach-O 32-bit, Mach-O 64-bit, Mach-O universal, Java class, WebAssembly), fonts (TTF, OTF, TTC, WOFF, WOFF2, EOT), databases (SQLite, PCAP, PCAPNG), and miscellaneous containers (BitTorrent, SWF, PEM key, shell script shebang, UTF-8 and UTF-16 BOM, XML, JSON). Shared-prefix formats are handled correctly. ZIP, JAR, APK, DOCX, XLSX, PPTX, ODT, and EPUB all begin with PK 03 04, so they are all listed together with a note that the internal archive layout is what tells them apart. CAFEBABE is reported as both Java class and Mach-O universal, with a note about the disambiguating bytes that follow. The ISO base media file format (MP4, MOV, HEIC, AVIF, 3GP) is decoded by reading the ftyp box and the major brand at bytes 8 to 11, so HEIC photos from an iPhone and AVIF screenshots from a browser are labeled distinctly instead of being grouped under a generic 'MP4'. Use it to audit a suspicious upload, decide what Content-Type to set on a download, debug a multipart form, recover a file with a missing or wrong extension, look up the canonical magic number for a format during reverse engineering, or verify that a 'photo.jpg' is really a JPEG and not a renamed ZIP or executable. Every byte read from your file stays inside this tab. Only the first 64 bytes are inspected, the file is never uploaded, and the analysis is fully local.

Free to use. Works in your browser. No signup, no login.