What magic bytes are
Most file formats begin with a short, fixed sequence of bytes that identifies them, often called magic bytes or a file signature. A PNG image always starts with 89 50 4E 47. A PDF starts with 25 50 44 46, which is the text "%PDF". Programs use these markers to decide how to read the rest of the data.
The file extension and the MIME type reported by a browser are only labels. Anyone can rename photo.png to photo.pdf in a second and the contents do not change. Browsers also often guess the MIME type from the extension alone. Reading the first bytes is a more direct way to learn what a file actually is, and this tool compares them with a built-in list of known signatures.
When detecting the real type is useful
The need usually arises when something does not add up: a file will not open in the expected program, a download has no extension, or an attachment's name says one thing while your software complains about another. It is also useful before uploading to a system that checks only the extension.
It is a quick sanity check for files from unfamiliar sources too. If invoice.pdf turns out to start with the signature of a Windows executable, that is a strong reason not to open it. The tool does not scan for malware, but a mismatch between name and contents is a useful red flag. Developers use the same idea when debugging uploads, since a mislabeled file is a common cause of "corrupt file" errors.
How to check a file
- Drag a file onto the drop area, or click it to browse. The tool takes one file.
- The tool reads only the first few bytes and works out the result immediately.
- Look at the summary boxes: Reported name, Browser MIME type (shown as "unknown" if the browser has none) and Size.
- Read the Detected line for the recognized format, and the First bytes line, which shows the opening bytes in hexadecimal.
The file is not uploaded. Only its first 16 bytes are read inside your browser. There is no reset button once a file is loaded, so reload the page to check another. To confirm that two copies of a file are identical, a hash generator is a better fit.
What it recognizes and what it does not
The detector knows eleven signatures: PNG, JPEG, GIF, PDF, ZIP, RIFF, MP3 with an ID3 tag, WebM/Matroska, BMP, Windows executables and Linux ELF executables. Anything else shows "Unknown (no recognized magic bytes)", which only means it is not on the list. MP4, 7z, RAR, TIFF and plain text are not included.
- ZIP is also the container for DOCX, XLSX and PPTX, so a Word document appears as a ZIP archive.
- RIFF is shared by WAV and AVI, and other formats such as WebP use it too, so the result is deliberately broad.
- MP3 is detected only when the file begins with an ID3 tag.
- The BMP and executable checks use just two bytes each, so a text file starting with "BM" or "MZ" could be misreported.
Treat the result as strong evidence, not proof.