Online — everything still runs locally
LocalConverter File inspector
100% local

What file type is this, really?

An extension is just part of a filename — anyone can change it, and plenty of files arrive with the wrong one. Drop a file here and its actual format is read from the magic bytes stored inside it, then cross-checked against the extension and the type your browser reported.

Drop a file to identify it
or click to browse · paste from clipboard · drop a whole folder
Over 80 formats recognised by signature across images, video, audio, archives, documents, fonts, executables and data files.

Three different claims about one file

Every file makes up to three separate assertions about what it is, and they can all disagree.

The extension — Text after the last dot in the filename. Purely a label. Renaming photo.jpg to photo.png changes nothing inside the file.
The reported MIME type — What your operating system tells the browser when you pick the file. On Windows and macOS this is usually derived from the extension, so it inherits the same lie.
The magic bytes — A signature stored inside the file by whatever wrote it. This is the only one of the three that reflects actual content, and the only one that is hard to fake accidentally.

This page reports all three separately and tells you when they conflict, rather than quietly picking one.

Why extensions end up wrong

Most mismatches are innocent:

Some are worth a second look. Executable content disguised with a document or image extension is a standard delivery technique — a file named invoice.pdf whose bytes begin MZ is a Windows executable, not an invoice. This page flags that as a mismatch. It does not scan for malware, and a mismatch on its own is not proof of anything; it means the filename is not telling you what the file is.

When the format is a container

Some signatures identify a wrapper rather than a format, so identification has to go deeper.

A .docx, an .xlsx, an .epub, an Android .apk and a Java .jar all start with the same four bytes: 50 4B 03 04. They are all ZIP archives. Stopping at the signature would report every one of them as "a ZIP", which is true and useless.

Detection here looks inside for the entry names that distinguish them — word/document.xml for a Word file, AndroidManifest.xml for an Android package — and reports the specific format while still showing that ZIP matched underneath.

The same problem exists in the ISO base media family. MP4, MOV, M4A, HEIC and AVIF share a container and are separated by a four-character brand code a few bytes in. An AVIF image and an MP4 video are structurally the same kind of file; only the brand says which.

File signature reference

The signatures this page checks for, generated directly from the detector so the two cannot disagree. ?? matches any byte. Offsets are where the signature sits in the file — almost always the start, with TAR a notable exception.

Magic bytesExtensionFormatOffset
FF D8 FF .jpg, .jpeg, .jpe JPEG image 0
89 50 4E 47 0D 0A 1A 0A .png PNG image 0
47 49 46 38 .gif GIF image 0
52 49 46 46 ?? ?? ?? ?? 57 45 42 50 .webp WebP image 0
42 4D .bmp, .dib BMP image 0
49 49 2A 00 .tif, .tiff TIFF image (little-endian) 0
4D 4D 00 2A .tif, .tiff TIFF image (big-endian) 0
49 49 2B 00 .tif, .tiff BigTIFF image (little-endian) 0
4D 4D 00 2B .tif, .tiff BigTIFF image (big-endian) 0
49 49 2A 00 10 00 00 00 43 52 .cr2 Canon CR2 raw image 0
00 00 01 00 .ico Windows icon 0
00 00 02 00 .cur Windows cursor 0
38 42 50 53 .psd, .psb Adobe Photoshop document 0
76 2F 31 01 .exr OpenEXR image 0
00 00 00 0C 6A 50 20 20 0D 0A 87 0A .jp2, .jpx, .jpf JPEG 2000 image 0
FF 4F FF 51 .j2k, .jpc JPEG 2000 codestream 0
FF 0A .jxl JPEG XL image (codestream) 0
00 00 00 0C 4A 58 4C 20 0D 0A 87 0A .jxl JPEG XL image 0
71 6F 69 66 .qoi QOI image 0
42 50 47 FB .bpg BPG image 0
67 69 6D 70 20 78 63 66 .xcf GIMP image 0
44 44 53 20 .dds DirectDraw Surface 0
0A ?? 01 .pcx PCX image 0
?? ?? ?? ?? 66 74 79 70 61 76 69 66 .avif AVIF image 0
?? ?? ?? ?? 66 74 79 70 61 76 69 73 .avifs AVIF image sequence 0
?? ?? ?? ?? 66 74 79 70 68 65 69 63 .heic HEIC image 0
?? ?? ?? ?? 66 74 79 70 6D 69 66 31 .heif HEIF image 0
?? ?? ?? ?? 66 74 79 70 .mp4, .m4v, .m4a ISO base media (MP4/MOV family) 0
1A 45 DF A3 .mkv, .webm Matroska/WebM container 0
52 49 46 46 ?? ?? ?? ?? 41 56 49 20 .avi AVI video 0
46 4C 56 01 .flv Flash video 0
30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C .asf, .wmv, .wma ASF container (WMV/WMA) 0
00 00 01 BA .mpg, .mpeg, .vob MPEG program stream 0
00 00 01 B3 .mpg, .mpeg MPEG video stream 0
4F 67 67 53 .ogg, .oga, .ogv Ogg container 0
2E 52 4D 46 .rm, .rmvb RealMedia 0
47 .ts, .m2ts, .mts MPEG transport stream 0
49 44 33 .mp3 MP3 audio (ID3v2) 0
FF FB .mp3 MP3 audio 0
FF F1 .aac AAC audio (ADTS) 0
52 49 46 46 ?? ?? ?? ?? 57 41 56 45 .wav WAV audio 0
66 4C 61 43 .flac FLAC audio 0
46 4F 52 4D ?? ?? ?? ?? 41 49 46 46 .aiff, .aif AIFF audio 0
4D 54 68 64 .mid, .midi MIDI sequence 0
23 21 41 4D 52 .amr AMR audio 0
4D 41 43 20 .ape Monkey's Audio 0
77 76 70 6B .wv WavPack audio 0
4D 50 43 4B .mpc Musepack audio 0
54 54 41 31 .tta True Audio 0
50 4B 03 04 .zip ZIP archive 0
50 4B 05 06 .zip ZIP archive (empty) 0
50 4B 07 08 .zip ZIP archive (spanned) 0
52 61 72 21 1A 07 00 .rar RAR archive (v1.5–4.x) 0
52 61 72 21 1A 07 01 00 .rar RAR archive (v5+) 0
37 7A BC AF 27 1C .7z 7-Zip archive 0
1F 8B .gz, .tgz gzip compressed data 0
42 5A 68 .bz2 bzip2 compressed data 0
FD 37 7A 58 5A 00 .xz XZ compressed data 0
28 B5 2F FD .zst Zstandard compressed data 0
04 22 4D 18 .lz4 LZ4 compressed data 0
4C 5A 49 50 .lz lzip compressed data 0
1F 9D .Z compress (.Z) data 0
75 73 74 61 72 .tar TAR archive 257
4D 53 43 46 .cab Microsoft Cabinet 0
21 3C 61 72 63 68 3E .a, .deb ar archive (or .deb package) 0
ED AB EE DB .rpm RPM package 0
78 61 72 21 .xar, .pkg XAR archive 0
25 50 44 46 2D .pdf PDF document 0
D0 CF 11 E0 A1 B1 1A E1 .doc, .xls, .ppt OLE2 compound document 0
7B 5C 72 74 66 .rtf Rich Text Format 0
25 21 50 53 .ps, .eps PostScript 0
41 54 26 54 46 4F 52 4D .djvu, .djv DjVu document 0
42 4F 4F 4B 4D 4F 42 49 .mobi, .prc Mobipocket e-book 60
53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 .sqlite, .db SQLite 3 database 0
00 01 00 00 00 .ttf TrueType font 0
4F 54 54 4F .otf OpenType font 0
77 4F 46 46 .woff WOFF font 0
77 4F 46 32 .woff2 WOFF2 font 0
74 74 63 66 .ttc TrueType collection 0
4D 5A .exe, .dll, .sys DOS/Windows executable 0
7F 45 4C 46 .elf, .so ELF executable 0
FE ED FA CE — Mach-O executable (32-bit) 0
FE ED FA CF — Mach-O executable (64-bit) 0
CE FA ED FE — Mach-O executable (32-bit, LE) 0
CF FA ED FE — Mach-O executable (64-bit, LE) 0
CA FE BA BE .class Java class / Mach-O fat binary 0
64 65 78 0A .dex Android DEX 0
00 61 73 6D .wasm WebAssembly module 0
23 21 .sh Script with shebang 0
2D 2D 2D 2D 2D 42 45 47 49 4E 20 .pem, .crt, .key PEM encoded data 0
85 02 .pgp, .gpg PGP message 0

Showing 91 of the signatures in the database. Container formats such as ZIP and ISO base media are narrowed further by inspecting their contents.

🔒 Why this is safe for confidential files

Nothing is uploaded The file is read directly from your disk by JavaScript in this tab. No network request carries its contents.
No server to trust There is no backend. Even if we wanted your files, there is nowhere for them to go.
Works with the network off Load the page once, disconnect, and every tool still works. That is the strongest proof that nothing is being sent.
Nothing is retained Close the tab and the file is gone from memory. No history, no accounts, no storage.

File type questions

Not by itself. Most mismatches are the result of someone renaming a file, or a service re-encoding an image without changing its name. It is worth attention when the detected type is executable — a Windows executable, an ELF binary, or a script — and the name suggests a document or image, because that combination is a common way of getting someone to open something they would not have chosen to. This tool identifies formats; it does not scan for malware.

Because it is one. Modern Office formats are ZIP archives containing XML. The detection looks inside for the parts that identify it specifically as a Word document and reports that, while still listing ZIP as the underlying container. Seeing both is correct.

Some formats have no signature at all — plain text, CSV and JSON are just characters, with nothing reserved to identify them. For those, the content is examined instead and the result is marked as identified heuristically. If a file is genuinely unrecognised it may be raw data, encrypted, a proprietary format, or simply one not yet in the database. The entropy reading is a useful next clue: close to 8 bits per byte suggests encrypted or compressed data.

For determining what a file actually contains, yes — the extension is a label anyone can change, while the signature was written by the program that created the file. The one caveat is that magic bytes can be deliberately forged: a crafted file can carry a valid PNG header and other content afterwards. For everyday identification the signature is far more reliable; for adversarial cases you need more than any single check.

No, and this is the single most common misunderstanding about file formats. Renaming changes the label, not the bytes. A JPEG renamed to .png is still a JPEG; some programs will open it anyway because they check the content, and others will refuse. To genuinely change the format you need to convert it, which re-encodes the image data.