← All Tools
File Signature Identifier
Recognise files by their first bytes (the magic number). Drop a file in your browser or paste a hex header — great for DFIR, malware triage, or working out what an unknown blob really is.
100% client-side. Files are never uploaded. Only the first 64 bytes are read locally with the browser's FileReader API. Nothing is stored, logged, or transmitted.
Drop a file here
or · only the first 64 bytes are read
Examples: 4D 5A 90 00 (Windows PE), 7F 45 4C 46 (ELF), 50 4B 03 04 (ZIP/OOXML).
Common signatures
Click a row to copy the hex prefix to your clipboard.
Why magic numbers matter
- Many malware samples are renamed (
invoice.pdf.exe) — the extension lies, the magic number does not. - Email gateways and EDRs use signatures to enforce file-type policy regardless of name or MIME.
- OLE2/MS Office macro files share the same magic (
D0 CF 11 E0) as legacy.doc/.xls/.ppt— combine with Office content sniffing for accurate triage. - OOXML files (
.docx,.xlsx,.pptx) and Java JARs are all ZIP archives (50 4B 03 04) — inspect the inner structure to disambiguate.