b2KIT

File Signature / Magic Number Detector

Detect file types by reading magic bytes (file signatures) regardless of extension.

Tested tool guide Tested browser tools Checked August 16, 2026

What File Signature / Magic Number Detector does and how it behaves

File Signature / Magic Number Detector examines the identifying byte sequence stored inside a file and reports the format associated with that signature. The filename and extension do not determine the result, so a renamed PNG can still be recognized as PNG. The common surprise is that a signature may identify only a container family. ZIP-based formats, including some office documents and ebooks, can share the same opening bytes and may require deeper inspection to distinguish.

How the result is produced

1

Byte signature matching

The detector reads binary values from the file and compares relevant starting bytes with recognized format signatures. For example, PNG files have a defined eight-byte signature, while several ZIP-based formats begin with the same ZIP marker. Matching is performed on byte values, not on how those bytes would appear if decoded as ordinary text.

2

Classification scope

A match indicates that the inspected bytes correspond to a known file signature. It does not necessarily identify every subtype stored inside a container. When several formats share a signature, the most defensible result may be the broader container type. An unrecognized result means no supported signature matched, not that the file has no format.

Good uses

  • Checking whether a downloaded image is really a PNG, JPEG, GIF, or another format despite its extension.
  • Identifying extensionless files recovered from caches, attachments, temporary directories, or disk images.
  • Confirming that an exported or transferred file begins with the signature expected for its claimed format.

Limits and checks

  • Some valid formats have no fixed magic number, and a format may be absent from the detector's recognized signature set.
  • Shared signatures create ambiguity. A ZIP match alone cannot reliably distinguish a plain archive from every document or package format built on ZIP.
  • A matching header does not prove that the rest of the file is complete, internally valid, trustworthy, or safe to open.

Common questions

Can it identify a file with the wrong extension or no extension?

Yes, when the file contains a recognized signature in the expected bytes. Changing a filename from .png to .txt does not change its PNG signature. The answer can still be unknown when the format lacks a distinctive signature, the relevant bytes are missing, or the detector does not recognize that format.

Does a detected type prove that the file is valid and safe?

No. Signature detection classifies bytes near defined identification positions; it is not a complete parser, integrity check, malware scan, or authenticity test. A damaged or deliberately misleading file can retain a legitimate-looking signature. Use format-specific validation or security analysis when correctness or safety matters.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools