Inspect a file’s leading bytes and likely type

Choose a file and the page reads its first 64 KB: the leading bytes are matched against a signature table (PNG, JPEG, HEIC, PDF, ZIP, TAR, WOFF2, OTF, MP3, WAV, MP4, MOV, WASM and more) and, when nothing matches, the content is classified as text (JSON, XML, CSV, YAML, Markdown) or as binary data. The report sets the detected type and a suggested extension beside the browser-declared type and the filename extension, and marks the confidence — High for a signature, Medium for text structure, Low for empty or unknown binary data. Detection is a clue, not proof of file validity or safety.

Runs locally in your browser

View category: Files & Archives (5)

Local processing ·

PNG · JPEG · HEIC · PDF · ZIP · TAR · WOFF2 · OTF · MP3 · WAV · MP4 · MOV · WASM · JSON · CSV · YAML

Signature detection is a clue, not an antivirus verdict.

How to identify a file by its signature

Choose a local file and the page reads its first 64 KB: the leading bytes are matched against a signature table (PNG, JPEG, HEIC, PDF, ZIP, TAR, WOFF2, OTF, MP3, WAV, MP4, MOV, WASM and more) and, when no signature matches, the content is classified as text (JSON, XML/HTML/SVG, CSV/TSV, YAML, Markdown or plain) or as binary data. Nothing is uploaded: the report, the 24-byte hex preview and the 8-byte signature stay in the page.

The report puts the detected type and a suggested extension next to the browser-declared type and the filename extension, with a confidence level: High when a signature matched, Medium when the text structure alone decided, and Low for empty files and unrecognised binary data.

Drop a file onto the zone or click it to browse; there is no run button.

Read the type report: detected type, suggested extension, browser-declared type and filename extension.

Check Confidence, the Signature metric (first 8 bytes) and the hex preview (first 24 bytes).

Read the findings: extension match or mismatch, no extension, empty file, the 64 KB cutoff, partial JSON, binary data or a UTF-16/32 byte-order mark.

Press Clear to empty the input, preview, metrics and findings; the same file can then be picked again.

Which signatures are matched, how text detection works and what the report shows

Which signatures are matched

Images (PNG, JPEG, GIF, BMP, TIFF in both byte orders, ICO, WEBP and the HEIC/HEIF/AVIF brands), documents (PDF, PostScript, RTF, SQLite), archives (ZIP including the empty archive PK 05 06, GZIP, RAR, 7z and TAR at offset 257), executables and objects (ELF, Windows MZ, Java class, WASM), fonts (WOFF, WOFF2, TTF, OTF, TTC), audio (MP3 by ID3 tag or frame sync, WAV/AVI/WEBP through RIFF, OGG, FLAC, AIFF, MIDI) and video (MP4, QuickTime “qt ”, M4V, 3GP, 3G2, WebM).

In ISO base media files the brand four bytes after “ftyp” decides between HEIC, HEIF, AVIF, QuickTime, M4A and 3GP; an unknown brand is reported as video/mp4. An MP3 without an ID3 tag is matched by the frame sync bits, where bitrate index 0/15 and sample-rate index 3 are rejected so random data cannot match by accident.

Where the type comes from when no signature matches

Text detection: a successful JSON.parse gives application/json (a cut JSON adds the partial-JSON note), the first tag decides XML, HTML or SVG, a quote-aware delimiter scan decides CSV or TSV, YAML needs at least two mapping lines with structural values, Markdown markers are recognised, and everything else is plain text. A NUL byte, an invalid UTF-8 run with control bytes, or more than 30% control bytes gives application/octet-stream at Low confidence.

A UTF-16LE/BE or UTF-32 byte-order mark is read as text: without that check its FF FE prefix would look like an MP3 frame sync. Only the first 64 KB are read, so a larger file carries the truncation note and, when it starts like JSON, the partial-JSON note instead of a wrong type.

The report, the extension check and privacy

The extension is compared with the detected type through known equivalences (jpg/jpeg, tif/tiff, htm/html, yml/yaml, md/markdown, csv/tsv, heic/heif, m4a/m4b, 3gp/3g2, aif/aiff, mov/qt); text files (txt/text/log/md/markdown/rst/adoc) accept txt or md; files without an extension, including dotfiles, report “no filename extension to compare” instead of a mismatch. Content wins over the name: a .png file holding JPEG bytes is reported as image/jpeg with a mismatch warning.

Confidence is High when a signature matched, Medium when only the text structure decided, and Low for empty files and unknown binary data. Detection is a clue, not an antivirus verdict; everything runs in the page, nothing is uploaded, and the tool keeps working offline.