File Type Identifier
Sniff a file's real type from its magic bytes (20+ signatures) and flag mismatches with its extension — catch files renamed to disguise themselves.
>_ USAGE GUIDE
Extensions can be renamed freely, but the first bytes of a file (the magic number) do not lie. This tool reads only the first 32 bytes, matches them against 20+ built-in signatures, and compares the result with the file's extension — for upload validation, tracing "files that won't open", and unmasking renamed files. The detection result sits next to a hex dump of the header, so every verdict can be verified byte by byte.
- Drop a file: any file; only 32 header bytes are read, fully locally
- Read the result: matching signatures and MIME are listed; RIFF/ISOBMFF families also surface their brand bytes
- Check the extension: a mismatch is flagged explicitly as a likely renamed file
- Study the hex dump: offset, hexadecimal and ASCII columns aligned — compare against any format spec directly
>_ FAQ
Q1 · Why are docx and apk detected as ZIP?
They truly are ZIP containers: Office 2007+ documents, Android packages and JARs all add convention directories on top of a ZIP. The tool reports ZIP with an ambiguity note; disambiguation requires unpacking [Content_Types].xml (Office) or AndroidManifest.xml (APK). That is the nature of container formats, not a detection failure.
Q2 · What does a file header actually look like?
Every format starts with fixed bytes: PNG is 89 50 4E 47 (".PNG"), JPEG is FF D8 FF, PDF is %PDF, ZIP is PK.., GIF is GIF8. The hex dump below lists them by offset, ready to verify against public magic-number lists.
Q3 · What does an empty result mean?
Zero matches means the header is not in the built-in signature table: plain text (txt/csv/json/md), Markdown, source code and exotic formats all fall here. These files have nothing to disguise — opening them as text usually confirms what they are.
Q4 · Why is this more reliable than the extension?
The extension is declared by the sender — renaming .exe to .jpg bypasses a naive whitelist; magic bytes come from the content itself and cannot be casually faked. Strict upload validation stacks three layers: extension, declared MIME, and header sniffing — this tool is the local implementation of the third layer.
Q5 · Could file content leak?
No. The tool reads only the first 32 bytes (a sliced readAsArrayBuffer), and both reading and matching happen locally with zero network requests. Even confidential files can be checked with confidence.