File Type Identifier

A file extension is a label that anyone can change. Rename invoice.exe to invoice.pdf and Windows shows a different icon, but the contents are untouched. What does not change is the way the file begins. Most formats start with a fixed run of bytes, a magic number, that programs look at before they trust anything else. This checker reads those bytes, tells you what the file really is, and warns when the name and the content disagree.

How detection works

The page compares the first 64 KB of each dropped file with a table of 79 signatures: images, documents, archives, audio and video, fonts, databases, executables and disk images. A PNG starts with 89 50 4E 47 0D 0A 1A 0A, a PDF with %PDF-, a gzip file with 1F 8B, a Windows program with MZ, a Linux program with 7F 45 4C 46. Reading is done on your device; nothing is uploaded.

ZIP and MP4 families

Many formats share one container. A DOCX, an XLSX, a JAR and an Android APK are all ZIP archives that start with PK. To tell them apart, the page lists the entry names inside the archive: a word/ folder means a Word document, xl/ a workbook, ppt/ a presentation, a manifest with Java classes a JAR. MP4-family files all carry an ftyp box near the start, and the four-letter brand inside it decides whether the file is MP4, a QuickTime movie, a HEIC photo or an AVIF image.

A worked example

The sample button creates a tiny valid PNG called holiday.jpg. The result reads: detected type PNG image, MIME type image/png, usual extension .png, and a warning that the extension .jpg does not match the detected type. Below it the first 24 bytes appear as 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01: the eight signature bytes, then the length 13 of the IHDR chunk, the letters IHDR and a width and height of 1 pixel.

Why mismatches matter

Upload forms often check only the extension. Mail filters and chat apps preview by extension. A program saved as report.pdf, or a script saved as photo.png, passes those checks. When a program signature shows up under a harmless name, the warning is stronger than for an ordinary mismatch such as a PNG named .jpg, which usually means somebody renamed an export.

Limits

A matching signature says how the file starts, not what else it contains. A polyglot file can be valid as two formats at once, and malware can carry a clean header. Formats without a header, encrypted data and compressed streams come back as unrecognised. The tool does not scan for viruses.

Using the result in practice

If you accept uploads on a website, do not rely on the extension or on the browser-supplied content type; read the first bytes on the server and compare them with the types you allow. For files you receive, the mismatch warning is a prompt to slow down: open the document in a sandbox, check where it came from, and compare its checksum with the sender’s. When a result names a container such as ZIP, remember that the page only looked at its entry names, not at what each entry contains.

Related tools

• Hex Editor lets you look at the bytes behind a result.
• File Checksum Verifier compares a file with a published hash.
• Document Privacy Checker inspects Office and PDF files for hidden data.
• Hash Identifier works the same way for hash strings.