How to Read a Hex Dump (Offsets, Bytes and ASCII)

Anatomy of a Hex Dump Line

Here are the first two lines of a small PNG image, as shown by hexdump -C or a hex viewer:

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 01 00 00 00 00 c8  08 06 00 00 00 5c 72 a8  |.............\r.|

Reading the first line:

• 00000000 is the offset: this line starts at byte 0.
• 89 50 4e 47 0d 0a 1a 0a are the first eight bytes, PNG's signature.
• 00 00 00 0d is a length (13), and 49 48 44 52 spells IHDR, the name of PNG's header chunk.
• |.PNG........IHDR| shows the same sixteen bytes as characters. 50 4E 47 is "PNG"; the others aren't printable, so they appear as dots.

The second line starts at offset 00000010, which is hexadecimal for 16, because the first line held bytes 0 to 15.

Hexadecimal in Two Minutes

Hexadecimal (base 16) uses the digits 0–9 and A–F, where A=10 and F=15. Two hex digits describe exactly one byte, from 00 (0) to FF (255). That neat fit is why hex is used instead of decimal.

To convert a two-digit hex value to decimal, multiply the first digit by 16 and add the second:

• 4E = 4 × 16 + 14 = 78
• C8 = 12 × 16 + 8 = 200
• 0D = 0 × 16 + 13 = 13

Each hex digit also maps to four binary digits, so C8 is 1100 1000 = 11001000. If you need to see individual bits, for example in a flags byte, a viewer's binary mode does this for you.

Reading the Offset Column

Offsets are positions, counted from zero. Because they're in hex, 00000100 is byte 256, not byte 100. When a format specification says "the width is stored at byte 16", you look on the line starting 00000010, first column of bytes.

Most viewers let you type an offset to jump to it. A binary file viewer also shows the offset of whichever byte you select, in both hex and decimal, which saves the mental arithmetic.

Multi-Byte Numbers and Endianness

Single bytes only go up to 255, so larger numbers span several bytes. The order of those bytes is called endianness:

• Big-endian: most significant byte first. PNG uses this. In the dump above, the bytes 00 00 01 00 at offset 16 are the image width: 256 pixels.
• Little-endian: least significant byte first. x86 processors, Windows executables, ZIP files and BMP images use this. The same bytes 00 01 00 00 would mean 256 in little-endian.

You can't tell which applies just by looking; the file format defines it. If a number looks absurdly large, try reading the bytes in the other order. The byte inspector in our viewer does this for you: select a byte and it shows the multi-byte values starting there, with a switch between little-endian and big-endian.

What the ASCII Column Is Good For

The ASCII column is your shortcut for spotting structure:

• Format names and markers, like IHDR, PDF, JFIF or ftyp.
• Embedded text: file names in archives, metadata in images, messages in executables.
• Text files in disguise: if the whole column reads like prose, it's a text file.

It only shows single-byte characters, though. UTF-16 text appears with a dot between letters (H.e.l.l.o.), and UTF-8 accented letters show as two dots. That's normal.

Practising on Your Own Files

The quickest way to get comfortable is to look at files you know:

1. Open a small PNG, JPEG and PDF in a hex viewer and compare their first bytes with the signatures in file signatures and magic numbers.
2. Open a short text file and find the 0A (or 0D 0A) bytes at the end of each line.
3. Save the same text as UTF-8 and UTF-16 and compare the dumps.

You can do all of this in the online binary viewer, which reads files in your browser and lets you click a byte to see its value in hex, decimal and binary. If you don't have a viewer yet, how to view a binary file covers the built-in options on each operating system.

Summary

Offset on the left, bytes in the middle, characters on the right. With hex-to-decimal conversion and an awareness of byte order, you can read any hex dump and match it against a format's documentation.