File type detector (magic bytes)
Find out what a file really is from its first bytes: PNG, JPEG, PDF, ZIP, Office, executables and more than a hundred other formats, and whether its name agrees.
A clear answer. Here’s how.
Most file formats begin with a fixed “magic number” or signature. This tool compares the start of the file with a table of more than 150 signatures taken from Gary Kessler’s file signature table and Wikipedia’s list of file signatures (PNG 89 50 4E 47 0D 0A 1A 0A, JPEG FF D8 FF, PDF 25 50 44 46, ZIP 50 4B 03 04, GZIP 1F 8B 08, ELF 7F 45 4C 46, SQLite “SQLite format 3”, and so on). Signatures can sit at an offset (a TAR file has “ustar” at byte 257; an MP4 has “ftyp” at byte 4 followed by a brand), and some are checked more closely: a Windows executable needs “MZ” and a “PE” header at the address stored at byte 60, a BMP needs a sensible header size, an MPEG transport stream repeats its 0x47 byte every 188 bytes. For ZIP files the tool reads the list of entries to tell Word, Excel, PowerPoint, OpenDocument, EPUB, Java and Android packages from a plain ZIP, and for old Office and Installer files it reads the directory of the compound file. The longest agreement wins; other matches are listed. Text formats such as XML, SVG, HTML, JSON, PEM and scripts with a #! line are recognised from their first characters. It then compares the extension of the file name with the usual ones for the match, and says whether the content looks like text or binary data. A match shows what a file claims to be, not that it is safe, complete or what the sender says it is: a file can start with the right bytes and contain anything after them, and a signature can be forged. Nothing is uploaded or opened.
How this is checked
5 reference checks passed These 5 cases were run when this page was built, on 20 October 2026, and all reproduce within the stated tolerance. The same cases are part of the automated tests that run on every change to Toolmoz. Engine version 1.
See the checks and where each expected answer comes from
Case 1
- Inputs
- The tool’s default inputs
- Expected, and what Toolmoz gave
- Best match expected PNG image, Toolmoz PNG imageMIME type expected image/png, Toolmoz image/pngUsual extensions expected png, Toolmoz pngMatched at offset expected 0, Toolmoz 0Name check expected Agrees, Toolmoz Agrees
- Where the expected answer comes from
- W3C PNG specification section 5.2: every PNG starts with the eight bytes 89 50 4E 47 0D 0A 1A 0A; IANA registers image/png; the Wikipedia list of file signatures shows the same bytes for .png
- Allowed difference
- exact
Case 2
- Inputs
- Or paste the first bytes as hex FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 00 01 00 00File name (optional) holiday.jpg
- Expected, and what Toolmoz gave
- Best match expected JPEG image, Toolmoz JPEG imageMIME type expected image/jpeg, Toolmoz image/jpegName check expected Agrees, Toolmoz Agrees
- Where the expected answer comes from
- JPEG (ITU-T T.81 and the JFIF specification): start of image FF D8, then the APP0 marker FF E0, a length of 00 10 and the text JFIF (4A 46 49 46) with a zero byte
- Allowed difference
- exact
Case 3
- Inputs
- Or paste the first bytes as hex 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00File name (optional) holiday.jpg
- Expected, and what Toolmoz gave
- Best match expected DOS or Windows executable (MZ header), Toolmoz DOS or Windows executable (MZ header)Name check expected Does not agree, Toolmoz Does not agree
- Where the expected answer comes from
- Wikipedia list of file signatures: the DOS and Windows executable header starts with 4D 5A (the letters MZ); .jpg is a picture extension, so a file with this start named holiday.jpg disagrees with its name
- Allowed difference
- exact
Case 4
- Inputs
- Or paste the first bytes as hex 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 10 00 01 01File name (optional) data.db
- Expected, and what Toolmoz gave
- Best match expected SQLite database, Toolmoz SQLite databaseMIME type expected application/vnd.sqlite3, Toolmoz application/vnd.sqlite3Name check expected Agrees, Toolmoz Agrees
- Where the expected answer comes from
- SQLite file format section 1.3.1: the first 16 bytes are the string SQLite format 3 followed by a zero byte (53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00); .db is a usual extension
- Allowed difference
- exact
Case 5
- Inputs
- Or paste the first bytes as hex 7F 45 4C 46 02 01 01 00 00 00 00 00 00 00 00 00 03 00 3E 00File name (optional) tool
- Expected, and what Toolmoz gave
- Best match expected ELF executable or library (Linux, Unix), Toolmoz ELF executable or library (Linux, Unix)Matched at offset expected 0, Toolmoz 0Name check expected No extension, Toolmoz No extension
- Where the expected answer comes from
- Executable and Linkable Format: 7F 45 4C 46 (0x7F then ELF); the next bytes 02 01 mean 64-bit little-endian, type 3 is a shared object and machine 0x3E is x86-64
- Allowed difference
- exact
What this shows: the engine reproduces independently worked values for these cases. It does not prove every possible input is right. To test an answer you were given, see how to check a number; to see what is and is not checked across Toolmoz, see the accuracy ledger.
See a worked example
Worked example
A fixed demonstration, separate from the values you enter above.
- Or paste the first bytes as hex
- 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00 02 80 00 00 01 E0 08 02 00 00 00
- File name (optional)
- photo.png
Example result
| Check | Result |
|---|---|
| Best match | PNG image |
| MIME type | image/png |
| Usual extensions | .png |
| Rule that matched | 89 50 4E 47 0D 0A 1A 0A at offset 0 |
| Details | 640 × 480 pixels, bit depth 8 |
Only 29 bytes were given. Signatures that sit further into a file (the “ustar” mark of a TAR at byte 257, the ISO 9660 mark at byte 32,769) and the entries of ZIP or OLE2 containers need the whole file. Magic bytes show what a file claims to be, not that it is safe: a file can begin with the right bytes and still be harmful, damaged or something else further in.