Skip to content
100% local

File signature identifier

Identify a file's type from its raw header bytes using a magic-number database.

Input
Output

File signature identifier

Paste the first bytes of a file — copied from a hex editor, a debugger, or a small script — and this tool matches them against a built-in database of magic numbers to tell you what kind of file they came from. It only needs the file header, so you never upload the actual file: a handful of bytes is enough to recognize a PNG, a ZIP archive, an ELF binary, a SQLite database and dozens of other common formats.

Four input formats are supported: hex with spaces (89 50 4E 47), continuous hex (89504E47), escaped \x bytes (\x89\x50\x4E\x47), and Base64. Turning on "show all matches" lists every signature found at the start of the buffer, sorted from the most specific down — handy when a short signature such as the two-byte Windows executable marker is ambiguous by itself. "Search nested signatures" scans the whole pasted buffer instead of just the start, which is how a ZIP or an image packed inside another file's data gets found. "Show first bytes as ASCII" prints a hex-and-ASCII preview of the header above the results, the way a hex editor would.

Each match reports the file extension, MIME type, the byte offset where the signature starts, and a short description. Some formats — WAV, WebP, AVI — only become identifiable from two markers together, a RIFF header plus a type tag a few bytes further in, not from a single run of bytes. Very short or generic signatures can match more than one format at once; when that happens every candidate is listed rather than guessed at.

Everything runs locally in your browser. The bytes you paste are never uploaded or sent anywhere, so it's safe to inspect files you haven't fully trusted yet. Copy the report, download it as a .txt file, or send it back into the input to run it through another tool.

FAQ

Which input format should I use?
Hex with spaces is the easiest to read and matches what most hex editors show. Use continuous hex or escaped \x bytes when pasting straight from code, and Base64 when that's already the form your data is in.
Why does it list more than one match?
Some signatures are short and generic — like the two-byte marker for Windows executables — so more than one format can start the same way. The tool lists every match rather than silently picking one for you.
What does 'Search nested signatures' find?
It scans the entire buffer, not just the start, so it can spot a ZIP, an image or another embedded file packed inside a larger file's data — useful for finding attachments hidden partway through a dump.
How many bytes do I need to paste?
Usually the first 16 to 64 bytes are enough — most signatures sit right at the start, though a few (like a Tar archive's 'ustar' marker) begin further in, at byte 257.
Is my file uploaded anywhere?
No. Identification runs entirely in your browser against a built-in signature database — nothing you paste is ever uploaded or sent to a server.