File Signature (Magic Bytes) Identifier

Most file formats begin with a fixed sequence of bytes — a magic number or file signature — that identifies the format independent of the filename. A PNG always starts with 89 50 4E 47, a PDF with 25 50 44 46 (%PDF), a ZIP with 50 4B 03 04 (PK), an ELF binary with 7F 45 4C 46, a Windows executable with 4D 5A (MZ). Paste the leading bytes in hex and this tool tells you the real format.

How you'll use it. Grab the first several bytes of a file (with xxd, hexdump, or a hex editor) and paste them. This is core file-forensics and triage: it reveals what a file actually is rather than what its extension claims. A .jpg that starts with 4D 5A is a Windows executable in disguise; a .pdf that starts with 50 4B is really a ZIP (and modern Office documents — DOCX/XLSX/PPTX — are ZIP containers, which is why they share that signature). Once you know the container is text-based, the hex converter turns the following bytes back into readable strings.

Why extensions lie. File extensions are just naming convention and are trivially changed; the operating system and many applications key off content, not name. Attackers exploit the gap in both directions — disguising executables as images to trick users, and mislabeling uploads to slip past filters that only check the extension.

Reading the results. Some signatures overlap or nest: ZIP-based formats (DOCX, JAR, APK, ODT) all begin with PK, and further inspection of the container contents is needed to disambiguate. The tool notes these cases. It matches only the leading bytes, so a match tells you the outer format, not necessarily the full story of a polyglot or embedded file.

Defensive angle. For file uploads, never trust the extension or the client-supplied MIME type. Validate the actual magic bytes server-side against an allowlist of permitted formats, and reject mismatches. Be aware of polyglot files that are valid as two formats at once (e.g., a GIF that is also valid JavaScript) — these defeat naive signature checks, so combine signature validation with re-encoding/normalization, storing uploads outside the web root, and serving them with a correct Content-Type and Content-Disposition.