File format identification and magic number query engine

File Signature (Magic Number) Lookup File Magic Digital Identification Tool

By analyzing the Magic Number in the first few bytes of the file, you can quickly identify the actual file format and no longer rely solely on the file extension. Suitable for digital forensics, information security analysis, format verification and other scenarios.

Drag file here

or

Only the first 64 Bytes are read, large files can be analyzed instantly

Frequently Asked Questions (FAQ)

What is a Magic Number?
Magic Number (magic number, also known as file signature) is a fixed sequence of bytes located at the beginning of the file, used to uniquely identify the file format. For example, a JPEG file always begins with FF D8 FF, PNG is based on 89 50 4E 47 Beginning. The operating system and applications use these bytes to determine how to correctly parse the file contents.
Why can't we just look at the file extension to determine the file format?
The file extension is just a text label and can be changed by anyone. Hackers often disguise malicious programs as .jpg or .pdf, bypassing security checks. Magic Number is a binary characteristic of the file itself and cannot be forged by renaming it. Therefore, digital forensics and security analysis rely on Magic Numbers rather than file extensions.
How to identify fake files?
Use the "Upload File" function of this tool to upload suspicious files, and the system will automatically read its Magic Number and compare it with the true format. If the format of the result display does not match the file extension (for example, the file extension is .jpg However, if the Magic Number is displayed as ZIP), it means that the file has been renamed to disguise it and should be handled with caution. This tool automatically flags such inconsistencies.
What is the ZIP container format? Why are DOCX, APK, and EPUB all ZIP?
Files (DOCX, XLSX, PPTX), Android installation packages (APK), e-books (EPUB) and other formats after Microsoft Office 2007 are essentially a ZIP compression container containing multiple XML files and resources. Their Magic Numbers are all 50 4B 03 04(ZIP signature). To further differentiate, it is necessary to analyze the internal structure of the container, such as checking whether there is [Content_Types].xml or AndroidManifest.xml and other characteristic files.
Are all Magic Numbers at the beginning of the file?
Not necessarily. In most formats the Magic Number is located at offset 0 (beginning of the archive), but there are exceptions. For example, the Magic Number of a TAR archive is located at offset 257 bytes (string ustar), the identification string for the ISO 9660 disc image is located at offset 32769. This tool will automatically detect Magic Numbers with different offsets to ensure identification accuracy.
Will this tool upload my files to the server?
Not at all. This tool is a pure front-end application. All file reading and analysis are performed in your browser. Only the first 64 bytes of the file are read and no data is transmitted to the network. You can use it with confidence to analyze confidential files.
What are the common Magic Numbers?
Here are a few of the most common profile signatures:
• FF D8 FF — JPEG images
• 89 50 4E 47 — PNG images
• 25 50 44 46 — PDF file
• 50 4B 03 04 — ZIP archive
• 4D 5A — Windows EXE executable file
• 7F 45 4C 46 — Linux ELF executable file
• CA FE BA BE — Java Class category file

Understanding Magic Number: the cornerstone of file format recognition

What is a Magic Number?

A Magic Number, also known as a File Signature, is a fixed set of bytes defined in the file format standard and located at a specific offset in the file (usually the beginning). These bytes are like the "DNA" of the file and can uniquely identify its true format and are not affected by the file extension.

For example, the first 4 bytes of any standard-compliant PDF file must be 25 50 44 46(i.e. the string "%PDF"). The first 8 bytes of any PNG image must be 89 50 4E 47 0D 0A 1A 0A。

Why can't we just rely on the extension?

The file extension (such as .jpg, .exe, .pdf) is just a label attribute in the file system, and anyone can change it at will by renaming it. Windows' default setting to hide known file extensions makes it even more difficult for users to detect. A real piece of malware might be named document.pdf.exe, while Windows only displays "document.pdf", misleading users to click.

Magic Numbers cannot be forged—unless the attacker completely forges the entire file format, the structure of the internal bytes cannot be changed. Therefore, in the field of information security, Magic Number check is one of the most basic and reliable file verification methods.

How to identify fake files?

When using this tool to analyze suspicious files, please follow these steps:

  1. Upload suspicious files through the "Upload Files" tab
  2. Observe whether the "File Format" in the results is consistent with the actual file extension
  3. If a "⚠️ file extension is inconsistent with the actual format" warning appears, you should be highly vigilant.
  4. Use the "Copy Signature" function to record evidence, or download the JSON / TXT report for storage

A typical camouflage case is to disguise a malicious executable file as an image or document file. For example, a name is photo.jpg file if its Magic Number is 4D 5A(MZ executable signature), it is actually a Windows executable file.

Common file format classifications

🖼️ Image format

JPEG、PNG、GIF、BMP、WebP、TIFF、HEIC、AVIF、ICO、PSD、SVG

📦 Compression and archiving

ZIP、RAR、7z、GZip、BZip2、XZ、TAR、Zstandard

📄 File format

PDF、DOC/DOCX、XLS/XLSX、PPT/PPTX、RTF、ODT、EPUB

⚙️Executable file

Windows EXE/DLL、Linux ELF、macOS Mach-O、Java Class、APK

🎵 Audio format

MP3、WAV、FLAC、OGG、AAC、WMA、MIDI、Opus

🎬Video format

MP4、AVI、MKV、WebM、MOV、FLV、WMV、3GP

✅