File Signature Identifier & MIME Types
Recognise files by their first bytes (the magic number), or look up the MIME type for a file extension. Drop a file in your browser or paste a hex header — great for DFIR, malware triage, upload checks, or working out what an unknown blob really is.
Drop a file here
or · only the first 64 KiB are read, nothing is uploaded
Examples: 4D 5A 90 00 (Windows PE), 7F 45 4C 46 (ELF), 50 4B 03 04 (ZIP/OOXML).
Common signatures
Click a row to load its hex prefix into the input above.
Why magic numbers matter
- Many malware samples are renamed (
invoice.pdf.exe) — the extension lies, the magic number does not. - Email gateways and EDRs use signatures to enforce file-type policy regardless of name or MIME.
- OLE2/MS Office macro files share the same magic (
D0 CF 11 E0) as legacy.doc/.xls/.ppt— combine with Office content sniffing for accurate triage. - OOXML files (
.docx,.xlsx,.pptx) and Java JARs are all ZIP archives (50 4B 03 04) — inspect the inner structure to disambiguate.
Examples: .json, mp4, video, officedocument. Results update as you type.
Browse by category
Content-Type versus the real bytes
A MIME type is what a server, a browser or an upload form claims a file is; it comes from the extension or the sender and is not checked against the content. The magic number is what the bytes actually are. For upload validation and triage, check both: identify the bytes and compare with the type you expected.
How to identify a file type from its header
- Drop the file on the box above, or click choose a file. Only the first 64 KiB are read, so a large disk image is as quick as a small PDF.
- If you only have bytes from a hex editor, a log or a packet capture, paste them in the hex field instead.
4D 5A 90 00,4d5a9000and0x4D,0x5Aall work. Then press Identify. - Compare the top match with the file name. The tool warns when the extension does not fit the content: a renamed file is a classic way to slip malware past a quick look.
Reading the result
The first card is the most specific match: the longest signature that fits. It shows the magic bytes, the offset where they were found, the usual extensions and the MIME type. For containers and executables it reads a little further to name the exact format: the architecture and DLL/console/GUI type of a Windows PE file, the class and machine of an ELF file, the real format inside a ZIP (Word, Excel, PowerPoint, JAR, APK, EPUB, OpenDocument), the brand of an MP4/HEIC/AVIF file, and WAV/AVI/WebP inside RIFF. Shorter signatures that also match appear as “Possible”. For example 52 61 72 21 1A 07 01 00 is shown as RAR v5, with the shorter RAR 1.5+ signature listed below it.
Some results need a second look. 50 4B 03 04 pasted as hex means a ZIP container, which also covers .docx, .xlsx, .jar and .apk; a dropped file usually gets the exact name. D0 CF 11 E0 covers legacy Office files, .msi and .msg. A single { or [ is a weak match that any text file can produce. “No known signature matched” often means plain text, an encrypted or compressed payload with no header, or a format that is not in the table.
Looking up a MIME type
Open the MIME types tab and type an extension, with or without the dot (.json or json), or part of a MIME type (video, officedocument). Or pick a category to browse. Copy puts the exact type on your clipboard, ready for a Content-Type header, an accept attribute or a server config. The list covers common images, video, audio, text, documents, archives, fonts and source-code extensions.
Some signatures sit deeper in the file: TAR (ustar at offset 257), GPT (EFI PART at offset 512), the VirtualBox VDI magic at 64 and ISO 9660 (CD001 at 32769). A dropped file is read up to 64 KiB, so they are found; pasted hex must be long enough to reach them.
Frequently asked questions
What is a file signature or magic number?
It is a fixed byte sequence, usually at the very start of a file, that marks its format. A PNG always begins with 89 50 4E 47 0D 0A 1A 0A and a Windows executable with 4D 5A ("MZ"), whatever the file is called.
How can I tell if a file extension is fake?
Check the header bytes. If invoice.pdf starts with 4D 5A instead of 25 50 44 46 ("%PDF"), it is an executable with a renamed extension. On Linux, file invoice.pdf gives the same answer from the command line.
Is my file uploaded when I drop it here?
No. The browser reads the first 64 KiB locally and the rest of the file is never opened. Nothing is sent to the server, so it is reasonable for suspicious samples, but do not open or run the file itself on your workstation.
Why does a .docx file show up as ZIP?
Office Open XML files (.docx, .xlsx, .pptx) are ZIP archives of XML parts, as are .jar, .apk and .epub. The magic number only tells you the container. When you drop the file, the tool also reads the names of the first entries in the archive ([Content_Types].xml with word/, META-INF/, AndroidManifest.xml, the mimetype entry of EPUB and OpenDocument) and names the real format.
What should I do after identifying a suspicious file?
Hash it with the hash generator and search the hash in your threat intelligence sources. The MIME types tab helps when a server or gateway reports a Content-Type that does not match the bytes.
What is a MIME type and why does Content-Type matter?
A MIME type (media type) tells a browser, mail client or API how to interpret a stream of bytes, for example image/png or application/json. Servers send it in the Content-Type response header; get it wrong and a browser may download a file it should have displayed, or refuse to run a script it should have executed.
What is the difference between application/octet-stream and a specific MIME type?
application/octet-stream means “arbitrary binary data, no further guarantee.” It is the correct fallback when you genuinely do not know the format, but using it for a known type (a PDF, a font) loses information the client could have used, such as opening a PDF inline instead of forcing a download.
Can a MIME type be spoofed, and what is MIME confusion?
Yes. The Content-Type header is set by whoever serves the file and is not itself verified against the actual bytes. Some older browsers used to guess (“MIME sniff”) when the header looked wrong, which attackers abused to get an uploaded file executed as HTML or script. The X-Content-Type-Options: nosniff header disables that guessing and is the standard mitigation.
What MIME type should a file upload or API endpoint accept?
Validate against an explicit allowlist of MIME types your application actually needs, and check the file’s real content (magic bytes) rather than trusting the client-supplied Content-Type or the extension alone; both are attacker-controlled input. The Identify tab shows how magic-byte detection works.
What is the difference between text/html and application/xhtml+xml?
text/html is parsed with the forgiving HTML5 parser, which recovers from malformed markup. application/xhtml+xml must be well-formed XML; a single unescaped & or unclosed tag makes the browser show a parse error instead of the page, which is why almost no site serves it despite XHTML being technically stricter.