File Signature Checker
Find out what a file really is, regardless of extension.
About File Signature Checker
Reads the magic bytes at the start of a file and identifies its true format from a database of signatures, then flags any mismatch with the file extension — the quickest way to spot a .jpg that is actually an executable.
Extensions lie. A file called invoice.pdf can be anything at all, and the name is chosen by whoever sent it.
Read the magic bytes and identify the real format.
- Processed on your deviceEverything you open or type here is handled by this page and never uploaded anywhere.
- No queue, no limitsNothing waits on a server, so the only limit is your own hardware.
- No account neededNo sign-up and no email address required.
How File Signature Checker works in your browser
Nearly every binary format begins with a signature — a fixed sequence of bytes at a known offset. PDFs start with %PDF, ZIP-based formats including .docx and .xlsx start with PK, PNGs carry an eight-byte header. The first bytes of your file are matched against a database of these signatures.
The result is what the file actually is, independent of its name. A .txt that reports as a PDF is mislabelled; a .jpg that reports as an executable is something else entirely and should not be opened.
One limitation is worth stating: a ZIP-based signature identifies the container, not the contents. A .docx and a .xlsx both begin the same way, so the format inside is determined by looking at the entries rather than the header alone.
When to use it
Checking an unexpected attachment before opening it. Identifying a file that has lost its extension. Diagnosing why an upload was rejected as the wrong type. Verifying that a file is what a sender claims, without executing it.
Frequently asked questions
What does it actually check?
The magic bytes at the start of the file, which identify its true format regardless of what the extension claims.
Why does a mismatch matter?
Because an extension is just part of a filename. A file named .jpg that is really an executable is the oldest trick there is, and this is the quickest way to spot it.
Does a mismatch always mean something malicious?
No. Renamed files and unusual exports produce false alarms too. It tells you what the file actually is, and the interpretation is yours.