File header analyzer
Upload a file and we read only the beginning of the file — the header — to guess what it really is. That is more reliable than trusting the filename alone. We never store your file; only a small slice is sent for analysis.
Only the first 64 KB of the file is sent for analysis. The chunk is processed in server memory for the request and is not written to persistent storage.
What are magic bytes?
Files are just bytes on disk. Many formats begin with a fixed pattern of bytes (sometimes readable ASCII like %PDF) so programs can recognize them without guessing from the name.
Those fixed patterns are often called magic numbers or magic bytes. They live at the start of the file (or at a well-known offset) and identify the container or format family. Our tool compares the start of your upload against a curated set of signatures — not every format in the world, but common types people hit in real life.
Why file extensions can lie
The letters after the dot in a filename are only a hint. Anyone can rename report.pdf to report.png; the bytes inside are still PDF. Downloads, email attachments, and “double extensions” are common reasons the visible extension does not match reality. Header inspection is a quick sanity check before you trust what the icon suggests.
Examples you might recognize
Typical beginnings (hex or ASCII) — your exact file may vary slightly (for example JPEG markers).
- PDF — often starts with the ASCII sequence %PDF-
- ZIP-based formats (including many .docx / .xlsx and Java .jar) — often start with PK followed by control bytes (ZIP local file header)
- PNG — signature bytes 89 50 4E 47 … (“.PNG” in ASCII after the first byte)
- JPEG — often starts with FF D8 FF
- Windows PE executables and many libraries — usually start with MZ (bytes 4D 5A); this does not tell .exe from .dll by header alone
- APK (Android package) — is a ZIP archive internally, so it also matches the ZIP header; we label ZIP unless we add APK-specific heuristics
What this tool does not do
- It is not antivirus or malware analysis — we only match a small header signature set.
- It does not read past the first 64 KB, so formats that only reveal themselves later may be misread or unknown.
- Many formats share the same container (ZIP is everywhere); we return the first matching rule, which may be generic.
- We do not distinguish every PE subtype (.exe vs .dll vs some drivers) — only that it looks like a Windows PE file.
- Encrypted, corrupted, or deliberately malformed files may not match anything useful.
Privacy and data handling
Built for trust: minimal data leaves your device.
- Only the first 64 KB of the file is transmitted — not a full upload of large files.
- We do not store the uploaded bytes as a file on disk for reuse; analysis happens in memory for the request.
- The original filename is sent with the header so we can show what the extension claims versus what the bytes suggest.
- For details in context of the rest of the site, see our privacy policy.
Extension guides for common formats
Deep dives on opening, security, and troubleshooting — independent of this header check.
Windows PE (.exe / .dll family): we may detect the MZ header above; there is no separate .exe guide in the index yet — compare bytes to filename and use caution with unknown binaries.