File Type Detector

Why the file extension lies, and the first bytes don't

A file's extension — .jpg, .pdf, .zip — is just part of its name. Rename a PNG to photo.pdf and nothing about the actual data changes; only the label does. Software that trusts the extension can be fooled, which is how malicious files sometimes slip through. The reliable way to know what a file truly is comes from its magic number: a short, fixed sequence of bytes at the very start of the file that identifies its real format. This tool reads those opening bytes and matches them against a table of known signatures, telling you the genuine type regardless of what the file is named.

How magic-number detection works

Almost every binary format begins with a distinctive marker. A PNG always starts with the eight bytes 89 50 4E 47 0D 0A 1A 0A — the 50 4E 47 in the middle is literally "PNG" in ASCII. A PDF begins with 25 50 44 46, which spells %PDF. A JPEG opens with FF D8 FF. The tool reads the first chunk of your file, then walks through its signature table comparing those leading bytes; the first signature that matches wins.

Signatures that need a second look

Some formats share an opening marker, so a single check isn't enough. WebP, WAV, and AVI all begin with 52 49 46 46 — the ASCII RIFF container tag. To tell them apart the tool checks a second signature a few bytes in: WEBP at offset 8 means an image, WAVE means audio, AVI  means video. Likewise, modern Office files (.docx, .xlsx) are really ZIP archives, so they share the PK signature with plain ZIPs — which is why the tool reports them together. The TAR signature lives at offset 257, not the start, so it's checked at that exact position.

A worked example

Drop in a file someone emailed you called invoice.pdf. The tool reads its first bytes and shows them as hex: FF D8 FF E0 00 10 4A 46 49 46…. That FF D8 FF opening is the JPEG signature, and 4A 46 49 46 spells JFIF. The detector reports JPEG, image/jpeg even though the name ends in .pdf. Now you know the file is actually a photo with a misleading name — exactly the kind of mismatch worth catching before opening or forwarding it.

Real uses

• Spot mislabeled or suspicious files. A mismatch between the extension and the detected type is a red flag worth investigating.
• Identify a file with no extension. Downloads, email attachments, and forensic artifacts sometimes lose their suffix; the magic number recovers the format.
• Confirm a conversion worked. After exporting to a new format, verify the bytes really changed, not just the filename.
• Debug uploads. When a server rejects a "PNG" that won't display, checking the true type often explains why.

What it can and can't tell you

This is a fast, reliable check for the container format, but a magic number only proves the first bytes match a known header — it does not validate that the rest of the file is well-formed or safe. A file can carry a valid PNG header and still be corrupt past the first few bytes. The tool recognises a fixed set of common image, audio, video, archive, document, and executable formats; anything outside that list, or a plain-text file (which has no binary signature), is reported as Unknown with the generic application/octet-stream type. That's expected, not a failure.

Privacy and a note on how it reads files

Detection happens entirely on your device. The tool reads only the first 512 bytes of the file using the browser's local FileReader — your file is never uploaded, and nothing leaves your computer. Reading just the opening slice also means it works instantly even on very large files, since it never touches the full contents. You can confirm the privacy claim by disconnecting from the network: detection still works, because there's nothing to send.