File Signature Inspector

The File Signature Inspector identifies a file's real format by reading its first 16 bytes and matching them against a database of roughly 90 magic-number signatures, so the result is independent of the extension and any browser-reported MIME type. Drop a file onto the upload zone or click Choose a file and the tool slices the leading bytes, renders a hex and ASCII dump, and runs them through a signature table covering images, video, audio, archives, documents, executables, fonts, and other common formats. The Detection result section reports the detected type, category, MIME value, and a confidence label: Exact match when the magic is distinctive, or Partial (generic) when the header is shared, such as the PK bytes that start every ZIP-based file including DOCX, XLSX, and JAR. Notes on the matched signature appear in a dedicated panel, and the tool compares the detected MIME with the browser-reported one, surfacing a green MIME matches banner or a red mismatch warning when the file appears renamed. The hex dump card shows the exact bytes read, while a searchable Signature reference table lists every entry in the database. All scanning happens locally in the browser, so opaque or confidential files never leave your machine.

1. 1

   Click "Choose a file" or drag a file onto the dashed drop zone; the button shows a spinner labelled "Reading…" while the header is analysed.

2. 2

   Review the Detection result cards for Detected type, Category, MIME, and the Confidence label ("Exact match" or "Partial").

3. 3

   Check the Notes panel and the green "MIME matches" or red "MIME mismatch" banner that compares the magic bytes with the browser type.

4. 4

   Confirm the raw bytes in the "Hex dump (first 16 bytes)" card, which shows an offset guide, the hexadecimal row, and an ASCII column.

5. 5

   Search the Signature reference table by name, MIME, hex, or category to inspect the full database of known signatures.

• Verifying that a downloaded executable truly is a PE binary before opening it.
• Identifying a file whose extension was lost or renamed during transfer or upload.
• Disambiguating ZIP-based formats like DOCX, XLSX, JAR, and EPUB when only the container header is visible.
• Auditing ingested attachments so disguised executable content is caught before it reaches other users.
• Confirming container formats against their declared MIME types during archival or forensic checks.
• Learning to read magic numbers by pairing the hex dump with the signature reference table.

• Treat renamed files with care — an executable carrying a PDF extension is a classic spoofing vector that the mismatch banner exposes.
• Expect Partial confidence on PK headers as normal, since every ZIP-based document starts with the same 50 4B 03 04 bytes.
• Never treat the browser-reported file.type as ground truth; it can be empty or derived purely from the filename.
• Keep the 16-byte probe in mind: formats with markers beyond it, such as tar's ustar header at offset 257, report Unknown file signature.
• Remember a plain-text file without a magic number will report Unknown, which is expected rather than a failure.
• Review the hex dump alongside the ASCII column to spot text-like data that binary-only signatures would miss.

• The ASF header 30 26 B2 75 reveals WMV video even when the file carries a generic extension.
• JSON, a UTF-8 BOM, and SQLite have dedicated signatures, so text-like data still gets classified.
• Eyeball common patterns like FF D8 FF E0 for JPEG against the hex dump to build recognition skill.
• Rename a suspect file and re-run the inspector — detection never changes, which confirms its independence from extensions.