File Type Detector

File extensions are convenient and unreliable. The extension is just text appended to a filename — anyone can change it, the OS sometimes guesses wrong, downloads from URLs without extensions land with default ones, file transfers across operating systems re-derive extensions in unpredictable ways. The actual format of a file is determined by its content, specifically the first few bytes which contain a format-defining signature called "magic bytes." This tool reads those magic bytes and tells you what the file really is.

**How magic bytes work**. Every common file format has a fixed-position signature near the beginning of the file. JPEG files start with the bytes FF D8 FF. PNG files start with 89 50 4E 47 0D 0A 1A 0A. PDF files start with the ASCII characters %PDF-. ZIP files (and everything built on ZIP — Office docs, JARs, APKs) start with PK followed by control bytes. ELF executables on Linux start with 7F 45 4C 46. Mach-O executables on macOS start with CE FA ED FE or CA FE BA BE depending on architecture. These signatures are in the format specs and don't depend on the filename. Reading the first 4 KB of any file and matching against a table of known signatures correctly identifies 100+ common formats.

The library powering this tool, **magic-bytes.js**, maintains that table. It's a small TypeScript port of the libmagic database (the same database used by the Linux `file` command). The tool lazy-loads it on the first detection (~20 KB) and runs the match in milliseconds.

**Common use cases**:

- **"I got a file with no extension and I don't know what to open it with."** Drop it, the tool tells you, then you know what app to use. (Sometimes drag-to-app works without knowing the type, but for files that need a specific opener, knowing the type first is faster.) - **"This .jpg file won't open as an image."** Drop it; it might really be a PDF, a video file, or something else. Renaming back to the correct extension usually fixes the issue. - **"I downloaded this file from a sketchy site and want to check what it is."** First-line safety check before opening. If a file claiming to be a .docx really is a .exe, do not open it. - **"I'm building a file-handling system and need to verify uploaded files."** Show users what magic-bytes detection produces for various inputs to test your validation logic. - **"My image file is corrupt and I want to see what's actually in it."** Tools that fail to open the file still leave you in the dark about format. Magic-bytes detection at least tells you what the file claims to be.

**Mismatch types and what they mean**:

- **Mismatch with one extra format detected**: the file is the wrong type. Either someone renamed it deliberately or it was incorrectly named on download. Common: .jpg that's actually .png; .pdf that's actually .docx; .zip that's actually .gz. - **Mismatch with no recognized format**: the file is in an obscure format that magic-bytes doesn't know about, or it's plain text (which has no magic bytes), or it's corrupted. Check the header-bytes hex view for clues. - **Multiple detected formats for one file**: usually a "ZIP-family" file (Office docs, JAR, etc.) where multiple distinct format names share the same magic-byte signature. This is normal.

**Plain text files**: most text files don't have magic bytes (no signature is part of the text-file spec). The detector will return "Format not recognized" for them. To distinguish from a corrupt binary, check the header bytes — text files have printable ASCII at the start, while corrupt binaries have arbitrary bytes.

**Format spoofing**: file format spoofing — where a malicious file is given a benign extension to bypass filters — is a real attack pattern. This tool catches the easy cases (binary file with text extension, executable with image extension). Sophisticated attacks can defeat magic-bytes detection by crafting files that have legitimate magic bytes for one format but contain malicious content payload (e.g., a "polyglot" file that's a valid PDF AND a valid HTML AND contains malicious JavaScript). Magic-bytes detection is the first line, not the last; for real security, sandboxed execution or AV scanning is needed.

**Limits**:

- Doesn't validate that the rest of the file is well-formed. A file with PDF magic bytes followed by random garbage detects as PDF; whether it actually opens as a PDF requires opening it in a PDF viewer. - Doesn't decode embedded metadata. For EXIF data on photos, use the <a href="/tools/exif-viewer">EXIF Viewer</a>. For PDF metadata, use the <a href="/tools/pdf-metadata">PDF Metadata Viewer</a>. - Doesn't detect text encodings. UTF-8 vs UTF-16 vs Latin-1 — these are text-content properties, not magic-byte properties (except UTF-8 with BOM and UTF-16 with BOM, which have signatures).

**Privacy**. The file's first 4 KB is read into your browser's memory via the File API. magic-bytes.js runs the signature match locally. Results display in your tab. Nothing crosses the network. Verify in DevTools — drop any file, watch the network panel stay empty. The remaining 99.9%+ of file bytes are not even read, let alone transmitted.

**Edge cases handled**: files smaller than 4 KB (reads what's available); empty files (reports "Format not recognized"); text files with no magic bytes (reports unknown); files with no extension (declared extension shown as "(none)"); files with multiple legitimate magic-byte matches (all reported); URL.createObjectURL not needed (no preview), so no lifecycle concerns.