🔬 File Type Detector

📁 Select a file

📁

Drop file here! Drag and drop a file here

or

Detection runs locally — the file never leaves your browser.

Selected Files ({{ selectedFiles.length }})
Total Files: {{ fileCount }} Total Size: {{ formatFileSize(totalSize) }}

⚙️ Actions

Resets the selected file and detection result.

📤 Detected Type

{{ primaryDisplay }}

🔎 Match Details

MIME type
{{ detectedMime || '—' }}
Signature (hex)
{{ detectedSignature || '—' }}
Offset
{{ detectedOffset !== '' ? detectedOffset : '—' }}
Confidence
{{ confidence || '—' }}

🧬 First 16 Bytes (hex)

{{ hexPreview || '—' }}

Useful when no signature matches: paste these bytes into a signature reference to identify the format manually.

⚠️

ℹ️ About File Type Detector

What this tool does

File Type Detector reads the first 264 bytes of a file you select and compares that prefix against a curated table of magic-byte signatures — short, format-defining byte sequences that almost every binary format places at a known offset. The match yields the format name, its IANA media type, the matched signature, the offset where it appears, and a confidence label.

The file never leaves your browser. The page uses the FileReader API with a sliced Blob so only the header is read into memory — multi-gigabyte files are inspected in milliseconds. No network request is made; there is no upload, no API endpoint, no telemetry. This is one of a small set of tools on the site that deliberately ship without a public API because uploading the file would defeat the privacy guarantee.

Why magic bytes, not file extensions?

A file extension (.jpg, .zip, .exe) is metadata stored alongside the file by the operating system. It can be set to anything; it is not part of the file's bytes. Renaming secret.exe to holiday.jpg changes the operating system's hint but leaves the file's actual format unchanged.

Magic bytes live inside the file and were chosen by each format's designers specifically to be recognisable. PNG starts with 89 50 4E 47 0D 0A 1A 0A, PDF with %PDF-, ZIP with PK\x03\x04. Tools like the Unix file command and content-type guessers in libraries such as file-type work the same way.

Supported formats

The signature table includes 30+ entries across these categories:

  • Images: JPEG, PNG, GIF87a, GIF89a, BMP, WebP, TIFF (both endians), ICO, ICNS, PSD
  • Documents: PDF, RTF, legacy MS Office (Compound File Binary)
  • Archives: ZIP (3 variants), RAR 1.5/5+, 7z, GZIP, BZIP2, XZ, TAR ustar, Zstandard
  • Audio: MP3 (ID3-tagged and frame-sync via bitmask), WAV, FLAC, OGG, AIFF
  • Video: MP4 / ISO Base Media (ftyp box), AVI, Matroska/WebM, Flash Video
  • Executables: ELF, PE/EXE/DLL, Mach-O (all 5 variants), Java class, Python bytecode, DEX, WebAssembly
  • Databases: SQLite 3
  • Fonts: TrueType, OpenType, WOFF, WOFF2

Confidence labels

The result panel shows one of four confidence levels. They reflect how discriminating the matched signature is, not how accurate the detection is in general:

  • high — exact byte match, 6+ bytes long, no mask. Effectively zero false positives for random binary input.
  • medium — exact match, 3–5 bytes. Distinctive but a random file has a small chance of colliding.
  • low — short signature or one that uses a bitmask (e.g. MP3 frame sync). False positives are possible.
  • none — no signature matched. The hex preview is still shown so you can search the bytes elsewhere.

Limitations

  • First-match wins. Java .class and Mach-O universal binaries share the CA FE BA BE magic; the table lists Mach-O first. Disambiguate by extension or by reading the version word that follows.
  • Polyglots aren't unpacked. A ZIP-in-image polyglot will report as the outer format only.
  • Text formats have no magic bytes. Plain text, JSON, CSV, XML, HTML, source code, and many configuration formats start with arbitrary bytes — they show up as "Unknown" and you should rely on extension or content inspection.
  • Encrypted containers look random. An encrypted ZIP or AES-encrypted blob has no usable header and will be reported as Unknown.

Self-test mode

Appending ?dev=1 to the URL runs a small in-page self-test against the signature table (PNG, PDF, plain-text non-match, MP3 frame mask) and prints the results to the browser console. It does not change production behaviour — the production page logs nothing.

References

Ready