File signature checker

How file signatures work

Most file formats begin with a fixed run of bytes, chosen by whoever designed the format, so that a program can tell what it has been given before reading any further. Those bytes are the file signature, or magic number. The name of a file, and its extension, is just a label: it is not stored in the file, and renaming a file changes nothing inside it.

• Usually at offset 0. PNG, JPEG, GIF, PDF, ZIP, ELF and most others start at the very first byte.
• Sometimes further in. A tar archive's ustar sits at byte 257, DICOM's DICM at byte 128, after a free preamble, and an ISO 9660 disc image's CD001 at byte 32,769 (0x8001), after 32 KB the format leaves for boot code.
• Containers need a second look. A signature can say "ZIP" or "RIFF" or "ISO media" when what you want to know is DOCX, WebP or HEIC. The answer is a little further in: the entry names, the form type, the brand.
• Byte order shows. A magic number stored as a 32-bit integer appears reversed on little-endian machines, which is why a 64-bit Mach-O program on an Intel or Apple silicon Mac starts CF FA ED FE rather than FE ED FA CF.
• Text has none. CSV, JSON, Markdown and source code are just characters. A byte order mark or a telling start such as <?xml or #! is as close as text gets.

The Unix file command works this way, from a database of these patterns; this page's tests check its answers against it. To read the bytes yourself, the ASCII table gives the letters behind the hex and hex to binary shows the bits.

Why PNG starts with 89 50 4E 47 0D 0A 1A 0A

PNG's eight bytes were chosen with care. Apart from the three letters of the name, each one catches a way that files used to get damaged when they were copied between systems, so a broken PNG is spotted in its first eight bytes instead of half way through decoding.

One signature, many formats

Several popular formats are containers with agreed contents, so their first bytes say only what the container is. ZIP archives start 50 4B 03 04 (PK, after Phil Katz of PKZIP), and these formats are all ZIP archives underneath:

The ISO base media format behind MP4 is a tree of boxes, and the first is ftyp at byte 4. Its brand, a four-character code at byte 8, names the format:

RIFF works the same way for WebP, WAV and AVI: RIFF, a 4-byte size, then the form type WEBP, WAVE or AVI followed by a space, since a form type is always four characters.

CAFEBABE: Java class or Mach-O?

Two unrelated formats start with the same four bytes, CA FE BA BE. The next four bytes settle it. Here are the first eight bytes of a real class file, compiled by javac, and of a real macOS universal binary, made by lipo:

Famous magic numbers

Some magic numbers are chosen to be readable as words in hex, which makes them easy to spot in a dump. The same number looks different in memory depending on byte order:

File signature table

Every signature the checker knows, 70 of them, generated from the same data the checker uses. With the ZIP and ISO media kinds above and the text formats, it names 86 formats in all. ?? is a byte that can be anything.

Common mistakes

• Renaming to convert. Changing .png to .jpg makes a PNG with the wrong name, not a JPEG. Most image viewers still open it, which hides the problem until something stricter does not.
• An error page saved as the file. A download link that fails often hands back an HTML error page under the name you asked for, so "logo.png" turns out to be <!DOCTYPE html>. Try the HTML named .png example.
• Reading a little-endian magic number backwards. Zstandard's magic number is FD2FB528 but its files start 28 B5 2F FD, because it is stored low byte first.
• Treating "ZIP" as the whole answer. An Office document, an e-book and an Android app are all ZIP archives; the contents say which.
• Trusting a signature for safety. A valid header says how a file starts, not what the rest does. Files can be valid in two formats at once.