File Signatures (Magic Bytes) List
Search twelve source-checked file signatures by format, extension, hexadecimal prefix, or note and copy the exact offset-zero bytes.
Privacy: your files never leave your device. All processing happens locally in your browser.
How to use
- 1.Search by format, extension, bytes, or a note such as container.
- 2.Compare the offset-zero hexadecimal sequence with a trusted binary view.
- 3.Copy the prefix for documentation or a tested detection rule.
- 4.Confirm the full structure with a maintained parser before trusting or processing the file.
About File Signatures (Magic Bytes) List
File Signatures Magic Bytes List is a compact reference for twelve common binary prefixes. Search by format, extension, hexadecimal bytes, or description, then copy the offset-zero signature. The table covers JPEG, PNG, both common GIF headers, PDF, ZIP, GZIP, 7-Zip, RAR 4, RAR 5, ELF, and SQLite 3. Values are presented as space-separated uppercase hexadecimal bytes so they can be compared with a hex viewer, binary parser, upload inspection rule, or incident-analysis note without converting from another notation.
A file signature is a byte pattern associated with a format, often near the beginning of a file. It can be more reliable than a filename extension, but it is not complete proof of type or safety. Some formats allow leading data, multiple valid signatures, or version-specific headers. A short prefix may collide with unrelated content. A malicious file can copy expected bytes while carrying invalid or dangerous payload data later. Use magic bytes as one signal alongside structural parsing, size limits, trusted decoders, and context-specific security controls.
Container formats create important ambiguity. The ZIP local-file header also appears in Office Open XML documents such as DOCX and XLSX, Java JAR archives, EPUB files, and other packages. Identifying the container does not identify the contained application format. A robust detector must inspect required internal paths, metadata, relationships, and content types while defending against decompression bombs and path traversal. The table explicitly labels this limitation instead of claiming that 50 4B 03 04 uniquely means a .zip download.
The entries are fixed at offset zero for a clear, testable scope. General-purpose libmagic rules can evaluate byte sequences at other offsets, indirect offsets, masks, numeric endianness, strings, and nested conditions. This tool does not reproduce those rules or scan uploaded files. It also does not include executable subtypes, media codecs, disk images, fonts, mail formats, or every archive variation. Consult the linked primary database and the format specification when implementing production detection beyond these common examples.
Never authorize an upload solely because its prefix matches a list. Validate the complete file with a maintained parser, enforce an allowlist, rename server-side, isolate storage, block active content where appropriate, and serve downloads with safe headers. Antivirus or sandbox analysis may be necessary for higher-risk workflows. Reject truncated inputs even if the first bytes match. Avoid exposing parser errors, filesystem paths, or internal rules to untrusted users. Keep detection libraries and decoders patched, and test malformed, polyglot, oversized, and nested samples.
This reference runs entirely in the browser and does not request or read a local file. Searches and copies stay in the current tab, no account is required, and no dependency is added. The twelve rows are source-checked and protected by tests for exact size and uniqueness, but standards and implementations can evolve. Verify critical production rules against current upstream documentation, record the rule version, and maintain regression samples that include both accepted formats and adversarial near-matches. Record both the observed bytes and the parser verdict so later reviewers can distinguish a prefix match from a validated file structure.
Methodology & sources
Stores twelve source-checked offset-zero byte prefixes with unique identifiers and format-plus-hex pairs, normalizes search across format/extensions/hex/notes, and copies the displayed uppercase hexadecimal sequence without reading user files.
Frequently asked questions
- Do matching magic bytes prove a file is safe?
- No. A prefix is only one signal. Validate the full structure, enforce allowlists and limits, isolate uploads, and use security scanning appropriate to the risk.
- Why can DOCX and XLSX match ZIP?
- They are ZIP-based container formats. Inspect required internal package files and metadata to distinguish the application format.
- Does this tool scan uploaded files?
- No. It is a searchable reference only and never requests, reads, uploads, or parses a local file.
Related tools
- Dummy File GeneratorCreate an exactly sized zero-filled, secure-random, or repeated-text file locally for upload, storage, and transfer testing.
- ANSI Color Codes GeneratorBuild and copy raw SGR escape sequences and search the standard 8 plus bright 8 terminal color codes.
- ASCII TableLook up every standard 7-bit ASCII code with exact decimal, hexadecimal, octal, and binary values.
- Badge GeneratorBuild a Shields.io badge URL, Markdown snippet, and HTML image tag without memorizing path escapes or query parameters.
- BOM RemoverRemove exactly one leading U+FEFF from pasted decoded text locally while preserving every internal, trailing, or second leading occurrence.
- Chmod CalculatorConvert Unix permission bits between strict octal and complete rwx notation, including setuid, setgid, and sticky states.