File Signatures (Magic Numbers)

All tools

Identify any file from its leading bytes — search 100+ format signatures by name, extension or hex, see the magic-number bytes, their ASCII rendering, the byte offset and the format category, and copy any signature with one click. In your browser, free.

Every signature runs from a built-in reference in your browser — nothing is uploaded and no file is ever read by a server.

Try:
Format Extension Hex signature ASCII Offset Category
No signature matches your search.
Try a format name, an extension or hex bytes — for example PNG, .zip or 25 50 44 46.

About File Signatures (Magic Numbers)

File signatures — also called magic numbers — are the fixed byte sequences at (or near) the start of a file that identify its true format regardless of its name or extension. This reference catalogs the signatures of more than 100 formats, each with its hex bytes, the printable ASCII rendering where one exists, the byte offset where the signature appears and a format category.

Search works from any angle: type a format name like PNG, an extension like .pdf, or raw hex bytes like 50 4B, and the matching signatures appear instantly. Category chips narrow the list to image, audio, video, document, archive, executable, font, database or other formats, and any hex signature copies in one click.

This is the table you need when a file’s extension can’t be trusted: open the file in any hex viewer, read its first bytes and match them here. It is a core technique in file-format debugging, upload validation and digital forensics — and it runs entirely in your browser, since no file is ever uploaded or read by a server.

How to use File Signatures (Magic Numbers)

  1. Open the file you want to identify in a hex viewer or editor and note its first bytes.
  2. Paste or type those hex bytes into the search box — for example 25 50 44 46.
  3. Alternatively, search by format name or extension to find the signature a format should have.
  4. Use the category chips to narrow results to images, archives, executables and so on.
  5. Compare the listed offset — some signatures start past byte 0 — and copy the hex signature if you need it elsewhere.

Frequently asked questions

It is a short, fixed byte sequence placed at a known offset — usually the very start — that declares the file’s format. PNG files begin with 89 50 4E 47, PDFs with 25 50 44 46 (“%PDF”). Programs check these bytes rather than trusting the extension.

Because extensions are just part of the file name — anyone can rename evil.exe to photo.jpg. The signature reflects what the bytes actually are. When they disagree, trust the signature; that mismatch is exactly how upload validators and malware scanners catch disguised files.

A few formats reserve their opening bytes for other data. ISO images place their CD001 marker at offset 32769, for example. The offset column tells you where to look, so start your hex comparison at that byte, not at the beginning.

Because modern Office documents, JAR files and many other containers literally are ZIP archives, so they all start with PK (50 4B). Distinguishing them requires looking inside the archive at its contents, not just at the leading bytes.

Use any hex viewer: xxd file | head on Linux and macOS, or a hex editor on Windows. The first line of output shows the leading bytes in hex — paste them into the search box here to match the format.

Yes. The database ships with the page and searching happens locally in your browser. No file is uploaded, no server reads your data, and there is no cost or account.
Share this
Related Tools
HTTP Status Codes Look up every HTTP response status code (1xx–5xx) in a searchable, filterable directory — then open any code for what it means, when to use it, whether it is cacheable and the RFC that defines it. In your browser, free. Free
HTTP Methods A scannable reference for every HTTP request method — GET, POST, PUT, PATCH, DELETE and the rest, plus WebDAV — showing at a glance whether each one is safe, idempotent and cacheable, if it takes a body, and a typical example. In your browser, free. Free
HTTP Headers Reference Look up common HTTP request and response headers in a searchable directory — filter by direction and category, read a one-line description and a realistic example, and copy any header name with one click. In your browser, free. Free
DNS Record Types Browse every common DNS record type — A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA, DNSKEY, DS, TLSA and more — with its purpose, a copyable zone-file example and a category. Search and filter instantly, in your browser, free. Free
TCP/UDP Port Numbers Look up well-known and commonly-used network ports in a searchable table — FTP, SSH, HTTP, HTTPS, MySQL, Postgres, RDP, Redis, MongoDB and 120+ more, each with its transport protocol, service, description and category. Search by port number or service name and copy values instantly. In your browser, free. Free
Subnet / CIDR Calculator Calculate IPv4 subnets from CIDR or mask: network, broadcast, host range, wildcard and more. Free
Need help?
Found an issue with this tool? Let our team know.
Report an issue

Add this free tool to your own website — copy and paste the code below.