HesapHanem

File Signature (Magic Number) Lookup

Paste a file's leading bytes in hex to identify its file type.

How it is calculated

The tool cleans your input: it removes any 0x prefixes, then drops every character that is not a hex digit (spaces, colons and dashes are fine), upper-cases the rest, and if an odd number of digits is left it discards the last one so that whole bytes remain. It then compares the start of the byte string with a built-in table of signatures such as 89 50 4E 47 0D 0A 1A 0A for PNG, 25 50 44 46 for PDF and FF D8 FF for JPEG, and reports the longest match as the type, with its usual extension.

Only the beginning of the file is checked, so paste the first bytes of a hex dump. MP4 is recognised by the text ftyp at byte 4, so it needs at least 8 bytes, and TAR by ustar at byte 257, so it needs over 260 bytes. If nothing matches, the type shows Unknown. The table is short (about 25 entries) and a signature only suggests a format: ZIP also covers DOCX, XLSX and JAR files, and RIFF covers WAV, AVI and WebP without telling them apart.

Worked example

You open a file with no extension in a hex viewer and see FF D8 FF E0 00 10 4A 46. Pasting the first four bytes, FF D8 FF E0, the tool upper-cases the digits and compares the start of the string with its table. The three-byte signature FF D8 FF matches, so it reports JPEG image with the typical extension .jpg, and echoes the bytes as FF D8 FF E0. The extra byte E0 is not part of the signature but does no harm. If you pasted only 00 11, the tool would answer Unknown, and with 25 50 44 46 it would answer PDF document.

Try this example →

Common mistakes

  • Pasting bytes from the middle of a file. Signatures only count at the start of the file.
  • Pasting a text string like "%PDF" instead of its hex. The tool needs hex digits, so use 25 50 44 46.
  • Pasting too few bytes for the format. FF D8 FF E0 is enough for JPEG, but an MP4 needs the first 8 bytes (to reach ftyp), and a TAR file cannot be recognised from a short snippet at all.
  • Trusting the result as proof of safety. A matching signature only says how a file starts; a malicious file can begin with valid image bytes.
  • Reading ZIP or RIFF as the exact format. ZIP is also DOCX, XLSX or JAR, and RIFF can be WAV, AVI or WebP, so look at the rest of the file to tell them apart.

About this calculator

Most file formats begin with a fixed sequence of bytes called a magic number or file signature — for example JPEG images start with FF D8 FF, PDFs with 25 50 44 46 ("%PDF"), and ZIP-based formats (including DOCX and XLSX) with 50 4B 03 04 — that identify the format regardless of the file's extension. Because signatures live in the file's actual content rather than its name, they're the basis for tools like the Unix `file` command and are far more reliable than trusting a renamed or extension-stripped file.

This lookup takes the leading bytes of a file, entered as hex, and matches them against a reference table of common image, archive, document, and executable signatures to identify the true format. Digital forensics investigators, malware analysts, and developers building upload validators or file-type detectors use it to confirm what a file actually is — catching disguised executables, corrupted downloads, or mislabeled files that a simple extension check would miss.

Was this helpful?

You can pick up to 3 reactions.

Comments (1)

  • Editorial team

    A signature tells you the container, not the contents. 50 4B 03 04 reports ZIP / Office Open XML, and that same start is shared by DOCX, XLSX, APK and JAR files, so it cannot say which one you have. RIFF is also ambiguous: the tool shows RIFF (WAV/AVI/WebP) with no extension, and you must read the four bytes at offset 8 yourself. Which file type returned Unknown for you, and what were its first bytes?

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators