File Signatures (Magic Numbers): Identify Any File Type

Why Signatures Beat Extensions

An extension is part of the file's name, and anyone can change it. A signature is part of the content. That makes signatures useful when:

• A download has no extension or the wrong one.
• A file was renamed (a .jpg that's really a WebP, a .7z that's really a RAR).
• You suspect a file is disguised, such as an executable posing as a document.
• An app reports a corrupt file and you want to check it's even the right format.

Operating systems handle this differently. Linux and macOS have the file command, which uses a database of signatures (libmagic). Windows mostly trusts the extension, which is one reason disguised files are a common trick.

Common File Signatures

?? means "any byte": in RIFF-based formats those four bytes store the file size, so they vary.

Reading the Table Correctly

A few details trip people up:

The Offset Matters

Not every signature sits at byte 0. MP4 files start with a four-byte box size, and ftyp follows at offset 4. DICOM files have a 128-byte preamble (often all zeros) before DICM. If you only check the first bytes, you'll miss these. A DICOM viewer relies on exactly that check.

Container Formats Share Signatures

Office documents (DOCX, XLSX, PPTX), Java archives, Android apps and EPUB books are all ZIP files internally, so they all start with PK. To tell them apart you need to look inside: a DOCX contains a word/ folder, an XLSX a xl/ folder.

Some Formats Have No Signature

Plain text, CSV, many MP3 files without ID3 tags, and lots of raw data formats have no fixed header. Identifying them takes heuristics, such as whether the bytes look like valid UTF-8 or match MP3 frame patterns. "Unknown" is a normal answer, not an error. Binary vs text files explains how tools tell text apart from binary data.

Signatures Aren't Proof

A signature tells you what the file claims to be at the start. A truncated or corrupted file can have a perfect signature and still fail to open, and a malicious file can carry a valid header. Treat it as identification, not validation.

How to Check a File's Signature

On macOS and Linux

file mystery.bin
xxd mystery.bin | head -n 2

file names the format if libmagic recognises it; xxd shows the bytes so you can compare them with the table.

On Windows

Format-Hex -Path .\mystery.bin | Select-Object -First 2

In the Browser

You can check a file's signature online without uploading it. Open the file and the File info tab compares its leading bytes with about 30 common signatures, including PNG, JPEG, PDF, ZIP, GIF and ELF, and reports any match along with its offset. The hex view shows the bytes themselves if you want to compare them manually. If you're new to reading those bytes, how to read a hex dump is a good primer.

Practical Examples

• "The archive is corrupt." If a .7z file starts with 52 61 72 21, it's actually a RAR; open it with a RAR opener instead. More archive errors are covered in fixing "Cannot open file as archive".
• "This image won't open." A .jpg beginning with RIFF....WEBP is a WebP image; rename it or open it with a WebP-capable app.
• "Downloaded PDF shows nothing." If the file begins <!DOCTYPE html, the server sent an error page, not a PDF.
• "Invoice.pdf.exe." A file starting with MZ is a Windows program, whatever its name suggests. Don't run it.

Summary

Look at the first few bytes, and at known offsets like 4 or 128, to identify a file regardless of its name. Keep a reference list handy, and remember that ZIP-based formats share one signature.