Reads the first bytes of a file to identify its real format, then compares it with the file extension and the MIME type your browser reports. Useful when a file might be disguised, like invoice.pdf.exe.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsDrop files here to check their type
You can check several files at once
Only the first 512 bytes of each file are read, and they stay in this browser. Nothing is uploaded.
This tool identifies file formats only. It does not scan for viruses or malware. Even when a file is flagged as possibly disguised, confirm with a proper antivirus scan or a security professional.
Check What a File Really Is, Whatever Its Extension Says
Most people judge a file by its extension (.jpg, .pdf, .docx). But an extension is just part of the name, and anyone can change it. Disguising a program as a picture or document is an old way to spread malware.
This tool reads the magic bytes at the start of a file and matches them against a list of known signatures. It then compares three things: the extension in the file name, the MIME type your browser reports, and the format found in the file itself. If they disagree, the result is flagged.
Use it to check a suspicious attachment before opening it, to identify a download with no extension, or to test whether your own upload code relies on file names alone.
When to Check a File's Signature
Before opening an email attachment
A file named invoice.pdf can be a program under a document name. Checking its detected format shows whether the extension matches what is inside.
Files with a missing or unfamiliar extension
Downloads and recovered files often lose their extensions. The detected format tells you what kind of file it is and which app should open it.
Testing a file upload feature
Rename sample files with the wrong extension and see what your own validation catches. The hex dump shows the signature bytes to look for.
Comparing browser MIME type and real format
The MIME type a browser reports for a selected file is usually based on its extension. Seeing it next to the detected format shows where the two differ.
How to Check a File's Real Format
- Drag and drop files onto the drop zone, or select Choose files.
- The tool reads the first 512 bytes of each file and matches them against its signature list.
- Check the result badge: Extension matches, Extension mismatch, Possibly disguised, No extension to compare, or Can't identify.
- Select Show details to see the browser-reported MIME type, the MIME type of the detected format, and a hex dump of the first 64 bytes.
Note: Drop several files at once to get a result for each. Use Copy all results to copy a plain-text report.
Limits and Things to Know
- The tool identifies formats only. It does not scan for viruses or malware, and a matching result does not mean a file is safe.
- ZIP-based formats (DOCX, XLSX, PPTX, JAR, APK, ODT, EPUB) are detected as ZIP. The archive is not opened.
- Only the first 512 bytes are read. Formats missing from the signature list, damaged files, and files with unusual headers can show as unknown or be misidentified.
- Text formats such as TXT, CSV, and JSON have no signature. They show as plain text (estimated) when the first bytes are readable UTF-8 text.
- Files stay on your device. Only the first 512 bytes are read, in your browser.
Formats This Tool Can Identify
A sample of the signature list. It also covers BMP, ICO, TAR, FLAC, OGG, WebM, ELF, Mach-O, Java class, SQLite, RTF, XML, and HTML files.
| Extension | Detected as | Signature (at the start of the file unless noted) |
|---|---|---|
| png | PNG image | 89 50 4E 47 0D 0A 1A 0A |
| jpg, jpeg | JPEG image | FF D8 FF |
| gif | GIF image | GIF87a or GIF89a (text) |
| PDF document | %PDF- (text) | |
| zip, docx, xlsx, pptx | ZIP archive or ZIP-based document | 50 4B 03 04 (or 50 4B 05 06) |
| rar, 7z, gz | RAR, 7-Zip, GZIP archive | 52 61 72 21 1A 07 / 37 7A BC AF 27 1C / 1F 8B |
| mp3 | MP3 audio | ID3 tag, or an MPEG frame sync (FF Ex) |
| wav, webp, avi | RIFF-based audio, image, video | RIFF, then WAVE, WEBP, or "AVI " at byte 8 |
| mp4, mov, m4a, heic | MP4 / MOV family | ftyp at byte 4 |
| exe, dll | Windows executable (high risk) | 4D 5A (MZ) |
| ttf, otf, woff, woff2 | Font file | 00 01 00 00 00 / OTTO / wOFF / wOF2 |
Formats without a signature, such as TXT, CSV, and JSON, show as plain text (estimated) when the first bytes are readable UTF-8 text.
How Fake File Extensions Work and What Magic Bytes Show
How to tell what a file is, and where the risks are.
Why the signature is a better clue than the name
Many formats put a fixed byte pattern at the start of the file. A PNG image starts with 89 50 4E 47 0D 0A 1A 0A, and a PDF starts with the text %PDF-.
A file name can be changed in a second, but the bytes inside the file stay as they are. That makes the signature a more reliable clue to the format than the extension.
Double extensions and hidden endings
In a name like invoice.pdf.exe, the operating system treats .exe as the real extension. If extensions are hidden, only invoice.pdf is shown.
This tool flags names whose last extension runs a program or script and whose previous extension looks like a document, image, media, or archive file. It also flags names that contain invisible text-direction characters, and executables saved under a non-executable extension.
Why the browser's MIME type can be wrong
The file.type value a browser gives for a selected file is usually derived from the file's extension. It does not come from analyzing the content.
For a renamed file, the browser-reported MIME type therefore describes the new name, not the real format. The details view lists it next to the MIME type of the detected format so you can compare them.
What a result can and cannot tell you
The tool checks the format and compares it with the file name. It does not look for malicious code, macros, or known malware.
A matching result does not mean a file is safe. Use antivirus software or a security professional for anything suspicious.
Common Mistakes With File Extensions
Trusting the extension alone
Assuming a file is safe because it ends in .jpg or .pdf, then opening it without checking what is inside.
💡 See the solution▼
Missing a double extension like report.pdf.exe
Extensions are hidden in the system settings, so the file appears as report.pdf and gets opened by mistake.
💡 See the solution▼
Validating uploads by file name only
A web app checks only the extension string when accepting uploads, so a renamed file gets through.
💡 See the solution▼
Assuming a ZIP result means an Office document
Seeing ZIP and concluding the file must be a DOCX or XLSX, when it is a different kind of archive.
💡 See the solution▼
Reading a match as "safe"
Believing a file is free of malware because its extension matches its format.
💡 See the solution▼
FAQ: Magic Bytes, Double Extensions, and Privacy
Q.What are magic bytes (a file signature)?
A. Many file formats begin with a fixed sequence of bytes that identifies the format. PNG files start with 89 50 4E 47 0D 0A 1A 0A, and PDF files start with the text %PDF-. These bytes are called magic bytes, a magic number, or a file signature. Renaming a file changes its name but not these bytes, so they are a better clue to the format than the extension.
Q.Can this tool spot a file with a fake extension?
A. In many cases, yes. It compares the extension in the file name with the format found in the file's first bytes. If they differ, the result is "Extension mismatch". If the file is an executable (EXE, ELF, Mach-O, or Java class) under a different extension, the result is "Possibly disguised". It can only do this for formats on its signature list. Other formats show as plain text (estimated) or as an unknown format.
Q.What is a double extension, and why is it risky?
A. A double extension is a name like invoice.pdf.exe. The first extension looks harmless, but the last one decides how the system treats the file. Windows hides the extensions of known file types by default, so the name can appear as invoice.pdf in File Explorer. This tool flags names that end in a program or script extension (such as exe, scr, bat, cmd, js, vbs, ps1, or msi) right after a document, image, media, or archive extension.
Q.Are there other ways a file name can hide its real ending?
A. Yes. A name can contain invisible Unicode characters that change text direction, which can make part of the name display in a different order. The tool flags any file name that contains these direction-control characters (U+202A to U+202E and U+2066 to U+2069).
Q.Why are DOCX and XLSX files detected as ZIP?
A. Office Open XML files (.docx, .xlsx, .pptx) are ZIP containers with XML files inside, so they start with the same bytes as a ZIP file. The tool reports ZIP and treats DOCX, XLSX, PPTX, JAR, APK, ODT, ODS, ODP, and EPUB extensions as a match. It does not open the archive to see what is inside.
Q.What happens with a format that is not on the signature list?
A. Files with no known signature are shown as "Plain text (estimated)" when their first bytes are readable UTF-8 text with few control characters. Otherwise they show as "Unknown format". TXT, CSV, and JSON files have no signature, so they usually appear as plain text.
Q.Can it detect viruses or malware?
A. No. The tool identifies file formats and compares them with the file name. It has no virus or malware detection. A "Possibly disguised" result is a warning to look closer, and an "Extension matches" result does not mean the file is safe. Scan suspicious files with antivirus software.
Q.Are my files uploaded anywhere?
A. No. The tool reads only the first 512 bytes of each file in your browser and compares them with its signature list. The file is not sent to a server.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.