File Type Identifier

About this tool

A file's extension is only part of its name: anyone can rename a program to holiday.jpg. Most formats start with a fixed pattern of bytes (a signature or magic number) that says what they really are: a PNG starts with the bytes 89 50 4E 47, a PDF with %PDF-, a Windows program with MZ, a ZIP archive with PK. This tool reads the start of each file you drop (up to the first 16 MB), recognises more than 150 formats such as images, documents, archives, audio, video, fonts, databases and executables, and tells you the real type, its MIME type and what the name claims. If the two disagree it says so, and if a program (Windows EXE or DLL, Linux ELF, macOS Mach-O, installer) is hiding behind a name that suggests a picture, document or text file, it raises a red warning, and it does the same for names with two extensions such as invoice.pdf.exe, names with hidden text-direction characters, and scripts or Office containers hiding behind picture names. Text files are recognised too, with their encoding, and so are scripts, HTML, JSON, XML and SVG; a download that turns out to be a web page is usually an expired link or a login page. ZIP-based documents (DOCX, XLSX, PPTX, ODT, EPUB, JAR, APK) are understood as ZIP containers, so a .docx that is detected only as a plain ZIP is flagged as possibly damaged. The check reads only the first bytes and never opens, runs or uploads the file. It is a quick sanity check, not a virus scan: a file of an unrecognised type is not necessarily unsafe, and a recognised one is not necessarily safe. The first bytes are also shown as a hex dump. Results agree with the Linux file command on the test files we compared.

How to use it

1. Drop one or more files on the page, or choose them.
2. Read the type in the heading and the verdict under it.
3. Pay attention to orange and red results, where the name and the content disagree.
4. Open the hex dump if you want to see the signature bytes yourself.

Common problems

It says unrecognised binary data

Many specialised formats have no well-known signature, and others are encrypted or compressed so that their start looks random. That is not a sign of a problem by itself.

A .docx is reported as a ZIP

Word, Excel and PowerPoint files are ZIP containers with specific parts inside. If only the generic ZIP type is found, the file may be damaged or incomplete, so try downloading or saving it again.

It says a program is disguised as another file

Do not open it unless you are sure of its source. Delete it or scan it with your security software. Programs renamed to look like pictures or documents are a common way to spread malware.

The type is right but I do not trust the file

This tool checks the type, not whether the content is harmful. A genuine PDF or Office file can still carry malicious content, so keep your software up to date and scan unknown files.