Magic bytes are the first few bytes of a file that uniquely identify its format. They act like a digital fingerprint — for example, PNG images always start with 89 50 4E 47 (hex), which spells ‰PNG in ASCII. PDF files begin with 25 50 44 46 (%PDF), and ZIP archives start with 50 4B 03 04 (PK). These signatures allow operating systems and software to recognize file types regardless of their extension.

MIME (Multipurpose Internet Mail Extensions) types are standardized identifiers used by browsers, web servers, and operating systems to determine how to handle a file. Examples include image/png, application/pdf, and audio/mpeg. Knowing the correct MIME type is crucial for web development, file uploads, API responses, and ensuring files open in the right application.

Browsers often determine MIME types based on file extensions rather than actual file content. If a file has been renamed with the wrong extension (e.g., a PNG image saved as .jpg), the browser may report an incorrect MIME type. Our tool reads the actual magic bytes from the file's binary data, providing a more reliable identification that reflects the file's true format.

Yes, magic bytes can technically be spoofed by manually editing a file's header. However, most legitimate files have accurate signatures. In cybersecurity and digital forensics, magic byte analysis is a first-line method for file identification, but it should be combined with deeper content analysis for complete certainty, especially when dealing with suspicious files.

Some formats use common container structures. For example, DOCX, XLSX, PPTX, JAR, and APK files all start with 50 4B 03 04 because they're all ZIP-based formats. Similarly, WAV, AVI, and WebP share the RIFF container signature (52 49 46 46). In these cases, additional bytes deeper in the file (like WAVE or WEBP identifiers) help distinguish the exact format. Our tool shows all possible matches when the signature is ambiguous.

This tool processes everything locally in your browser using JavaScript's FileReader API. Your file never leaves your device — no upload to any server occurs. You can also use command-line tools like file (Linux/Mac), hex editors like HxD (Windows), or the xxd command to inspect magic bytes locally.

Key signatures to recognize: PNG = 89 50 4E 47, JPEG = FF D8 FF, GIF = 47 49 46 38, PDF = 25 50 44 46, ZIP/DOCX = 50 4B 03 04, MP3 = FF FB or 49 44 33, MP4 = ...ftyp at offset 4, ELF = 7F 45 4C 46, and Windows EXE = 4D 5A. See the reference table below for a comprehensive list.