File Type Detector

This tool reads the first 16 bytes of a file, compares them with a built-in list of file signatures (often called magic bytes), and tells you what format the file actually is. It also shows the extension in the file name and the hexadecimal values of those 16 bytes. It is useful when an extension has been changed, when a file has no extension, or when you want to check that the contents match the name. Be clear about its scope. It recognises only about a dozen formats, and when nothing matches it simply says it cannot recognise the file, which does not mean anything is wrong with it. It is also not antivirus software and cannot say whether a file is safe.

How to use it

1. Click the dashed box that says Click to select any file and choose a file of any type. Detection runs immediately; there is no other button.
2. In Detection result, read two items. File extension shows the suffix at the end of the name, such as .png. Actual type shows the format worked out from the content. If there is no suffix you will see (no extension).
3. In File header bytes (hex), look at the first 16 bytes, for example 89 50 4e 47 0d 0a 1a 0a ..., and compare them with the published signature of the format you expect.
4. If Actual type is shown in red as Unrecognized (may be an uncommon format), the start of the file is not in the built-in list.

Formats the tool recognises

The built-in rules are: PNG image (starts 89 50 4E 47), JPEG image (FF D8 FF), GIF image (47 49 46 38), PDF document (25 50 44 46, which is %PDF), ZIP archive (50 4B 03 04, which is also the container for modern Office files such as docx, xlsx and pptx), RAR archive (52 61 72 21), GZIP compressed file (1F 8B), BMP image (42 4D, with a zero reserved field and a valid DIB header size), MP3 audio with an ID3 tag (49 44 33), ISO media container (bytes 5 to 8 spell ftyp, then bytes 9 to 12 give a brand that separates MP4 video, HEIC/HEIF image, AVIF image, MOV video, M4A audio and 3GP video), 7z archive (37 7A BC AF 27 1C), legacy Office document (D0 CF 11 E0 A1 B1 1A E1), and WEBP image (starts with RIFF and bytes 9 to 12 are WEBP). A file that starts with RIFF but is not WEBP is shown as a RIFF container format that could be WAV audio or AVI video. That list is everything the tool can identify; any other format is reported as unrecognized.

Results from real test inputs

These results come from running the tool's own matching rules on several byte sequences. The standard PNG start 89 50 4E 47 0D 0A 1A 0A is identified as a PNG image. Data starting 50 4B 03 04 is identified as a ZIP archive (possibly a modern Office file). A JSON text such as {"a":1} comes out as unrecognized, while the header D0 CF 11 E0 A1 B1 1A E1 used by legacy Word and Excel (.doc and .xls) files is identified as a legacy Office document. Text beginning with BM (such as BMW notes) is no longer taken for a BMP, and a HEIC header (ftyp plus heic) is identified as a HEIC/HEIF image.

Limits and known quirks

• BMP and the ftyp family (MP4 / HEIC / MOV and so on) are judged loosely: besides BM, BMP also checks the reserved field and the DIB header size, and ftyp files are told apart by the brand in bytes 9 to 12. An unknown brand is shown as ISO media container (ftyp brand: xxxx). Rare brands or variant files can still be misjudged, so check the hex bytes.
• WAV and AVI both show only as a RIFF container; they are not told apart.
• Formats with no rule include plain text, JSON, HTML, SVG, MP3 without an ID3 tag, WebM, FLAC, OGG and executables. All of them show as unrecognized.
• Only the first 16 bytes are read, so the tool cannot see whether later parts of the file were altered or contain hidden data. A file that begins with a valid signature may still be problematic.
• File extension takes whatever follows the last dot in the file name, so suffixes with Chinese or other non-English characters are shown too.
• An empty file has no bytes and is shown as unrecognized.

If the extension and actual type differ, is the file bad?

Not necessarily. Sometimes that is normal: a .docx file is really a ZIP archive, because docx uses ZIP as its container. Sometimes the cause is a download or renaming mistake, and sometimes it is a misjudgement by this tool itself, as with the BMP and ftyp cases above. A mismatch is a hint, not a verdict on safety.

Can it tell me whether a file has a virus?

No. It looks only at a few bytes at the start. If malware has been renamed to .jpg, the tool can tell you that the header is not an image, which might save you from being fooled by the name. But the reverse does not hold: a normal-looking header does not mean a file is safe. Use antivirus software or a trusted scanning service for suspicious files.

Why does my file say Unrecognized?

Most often its format is simply not among the dozen or so built-in rules, as with text, JSON, HTML or WebM. That is normal and does not mean the file is damaged. You can compare the hex bytes with a public file signature list.

Privacy and processing

Detection happens in your browser. The code reads only the first 16 bytes of the file to match the rules and displays the file name, the extension and those bytes. The page contains no code that uploads the file, the rest of the file contents are not read into the page, and no record is kept. The result is cleared when you refresh or close the page.