Files & BinaryLOCALRuns in your browser

Magic Number Reference

Identify a likely file format from its leading bytes, or search a curated table of file signatures by name or extension.

This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.

Leading bytes (hex) or format namee.g. 89 50 4e 47, or "zip", or png

Result

Several signatures match these bytes. The leading bytes alone cannot tell which format this is; read each entry's caution.

FF FE 00 00 is also the UTF-32 little-endian BOM. The leading bytes alone cannot tell UTF-32 LE from UTF-16 LE (a BOM followed by U+0000); the UTF-16 BOM (LE) entry below is only one candidate.

FF FE is also how the UTF-32 little-endian BOM (FF FE 00 00) begins. Too few bytes were entered to rule UTF-32 LE out.

No signature in the table matches these bytes. The data may be text, a format not in this table, or bytes that are not the start of the file; it does not mean the file is damaged.

No entry matches that name.

Format: PNG
Offset: 0
Signature: 89 50 4e 47 0d 0a 1a 0a
Extensions: .png
MIME: image/png
Notes: PNG image: the 8-byte PNG signature.

Format: JPEG
Offset: 0
Signature: ff d8 ff
Extensions: .jpg, .jpeg
MIME: image/jpeg
Notes: JPEG image: the SOI marker followed by the next marker (APPn or DQT).

Format: GIF
Offset: 0
Signature: 47 49 46 38 39 61
Extensions: .gif
MIME: image/gif
Notes: GIF image, version 89a.

Format: GIF
Offset: 0
Signature: 47 49 46 38 37 61
Extensions: .gif
MIME: image/gif
Notes: GIF image, version 87a.

Format: BMP
Offset: 0
Signature: 42 4d
Extensions: .bmp
MIME: image/bmp
Notes: Windows or OS/2 bitmap, starting with the text "BM".
Caution: This signature is short, so unrelated data can start with the same bytes by chance.

Format: TIFF (little-endian)
Offset: 0
Signature: 49 49 2a 00
Extensions: .tif, .tiff
MIME: image/tiff
Notes: TIFF image in Intel (little-endian) byte order.
Caution: Several camera RAW formats are also built on TIFF and start the same way.

Format: TIFF (big-endian)
Offset: 0
Signature: 4d 4d 00 2a
Extensions: .tif, .tiff
MIME: image/tiff
Notes: TIFF image in Motorola (big-endian) byte order.
Caution: Several camera RAW formats are also built on TIFF and start the same way.

Format: WebP
Offset: 0
Signature: 52 49 46 46 ·· ·· ·· ·· 57 45 42 50
Extensions: .webp
MIME: image/webp
Notes: WebP image: a RIFF container whose form type is WEBP.
Caution: RIFF is a container; the form type at byte offsets 8–11 (the 9th–12th bytes) tells the formats apart.

Format: WAV
Offset: 0
Signature: 52 49 46 46 ·· ·· ·· ·· 57 41 56 45
Extensions: .wav
MIME: audio/wav
Notes: WAVE audio: a RIFF container whose form type is WAVE.
Caution: RIFF is a container; the form type at byte offsets 8–11 (the 9th–12th bytes) tells the formats apart.

Format: AVI
Offset: 0
Signature: 52 49 46 46 ·· ·· ·· ·· 41 56 49 20
Extensions: .avi
MIME: video/x-msvideo
Notes: AVI video: a RIFF container whose form type is AVI.
Caution: RIFF is a container; the form type at byte offsets 8–11 (the 9th–12th bytes) tells the formats apart.

Format: ICO
Offset: 0
Signature: 00 00 01 00
Extensions: .ico
MIME: image/x-icon
Notes: Windows icon resource (ICO).
Caution: These four bytes are mostly zeros, so other binary data can start the same way.

Format: ISO Base Media (MP4/MOV/etc.)
Offset: 4
Signature: 66 74 79 70
Extensions: .mp4, .m4a, .mov
MIME: video/mp4
Notes: ISO base media file: an 'ftyp' box at offset 4. MP4, M4A, MOV, HEIC and AVIF all use it.
Caution: The brand that follows 'ftyp' is the clue to the exact format, and this tool does not read it; the MIME type shown is only the most common case.

Format: Matroska / WebM
Offset: 0
Signature: 1a 45 df a3
Extensions: .mkv, .mka, .webm
MIME: video/matroska
Notes: EBML header used by Matroska (RFC 9559) and WebM.
Caution: The DocType element inside the header tells Matroska from WebM, and this tool does not read it. RFC 9559 defines no magic number; this is the practical file(1) signature.

Format: Ogg
Offset: 0
Signature: 4f 67 67 53
Extensions: .ogg, .oga, .ogv
MIME: application/ogg
Notes: Ogg container ("OggS").
Caution: The codec, such as Vorbis, Opus or Theora, is named in the first packet, so audio and video Ogg files start alike.

Format: FLAC
Offset: 0
Signature: 66 4c 61 43
Extensions: .flac
MIME: audio/flac
Notes: FLAC lossless audio stream ("fLaC").

Format: MP3 (ID3v2)
Offset: 0
Signature: 49 44 33
Extensions: .mp3
MIME: audio/mpeg
Notes: An ID3v2 tag ("ID3"), usually in front of MP3 audio.
Caution: The tag only carries metadata; the audio format comes after it.

Format: MP3 (MPEG frame sync)
Offset: 0
Signature: ff fb
Extensions: .mp3
MIME: audio/mpeg
Notes: MPEG-1 Layer III frame header without CRC. Other MPEG versions and settings start with other bytes, such as FF FA, FF F3 or FF F2.
Caution: This signature is short, so unrelated data can start with the same bytes by chance.

Format: PDF
Offset: 0
Signature: 25 50 44 46
Extensions: .pdf
MIME: application/pdf
Notes: PDF document ("%PDF").

Format: PostScript
Offset: 0
Signature: 25 21 50 53
Extensions: .ps, .eps
MIME: application/postscript
Notes: PostScript program ("%!PS"), including EPS.

Format: RTF
Offset: 0
Signature: 7b 5c 72 74 66 31
Extensions: .rtf
MIME: application/rtf
Notes: Rich Text Format (RTF) document ("{\rtf1").

Format: ZIP (and docx/xlsx/pptx/jar/apk/epub/odf)
Offset: 0
Signature: 50 4b 03 04
Extensions: .zip, .docx, .xlsx, .pptx, .jar, .apk, .epub
MIME: application/zip
Notes: ZIP local file header ("PK\3\4"). Empty archives start with 50 4B 05 06 and spanned ones with 50 4B 07 08.
Caution: ZIP is a container: docx, xlsx, pptx, jar, apk, epub and OpenDocument files all start like this. Only the entries inside, such as [Content_Types].xml, META-INF/ or a stored mimetype file, tell them apart.

Format: gzip
Offset: 0
Signature: 1f 8b
Extensions: .gz, .tgz
MIME: application/gzip
Notes: gzip-compressed data (RFC 1952); a .tar.gz also starts like this.
Caution: This signature is short, so unrelated data can start with the same bytes by chance.

Format: bzip2
Offset: 0
Signature: 42 5a 68
Extensions: .bz2
MIME: application/x-bzip2
Notes: bzip2-compressed data ("BZh").

Format: xz
Offset: 0
Signature: fd 37 7a 58 5a 00
Extensions: .xz
MIME: application/x-xz
Notes: xz-compressed data.

Format: Zstandard
Offset: 0
Signature: 28 b5 2f fd
Extensions: .zst
MIME: application/zstd
Notes: Zstandard frame (RFC 8878).

Format: LZ4 frame
Offset: 0
Signature: 04 22 4d 18
Extensions: .lz4
Notes: LZ4 frame format.

Format: 7-Zip
Offset: 0
Signature: 37 7a bc af 27 1c
Extensions: .7z
MIME: application/x-7z-compressed
Notes: 7-Zip archive.

Format: RAR (1.5–4.x)
Offset: 0
Signature: 52 61 72 21 1a 07 00
Extensions: .rar
MIME: application/vnd.rar
Notes: RAR archive, versions 1.5 to 4.x.

Format: RAR (5.0+)
Offset: 0
Signature: 52 61 72 21 1a 07 01 00
Extensions: .rar
MIME: application/vnd.rar
Notes: RAR archive, version 5.0 and later.

Format: tar (ustar)
Offset: 257
Signature: 75 73 74 61 72
Extensions: .tar
MIME: application/x-tar
Notes: POSIX ustar tar archive: "ustar" at offset 257 of the first 512-byte header block. GNU tar writes "ustar" followed by two spaces.
Caution: Old pre-POSIX (v7) tar archives have no magic, so their absence proves nothing.

Format: Zlib stream
Offset: 0
Signature: 78 9c
Extensions: —
Notes: zlib deflate stream with default compression; other levels start with 78 01, 78 5E or 78 DA.
Caution: This signature is short, so unrelated data can start with the same bytes by chance.

Format: ELF
Offset: 0
Signature: 7f 45 4c 46
Extensions: .elf, .so, .o
Notes: ELF executable, shared library or object file ("\x7fELF"). See the ELF Header Summary for the details.

Format: PE / MS-DOS executable
Offset: 0
Signature: 4d 5a
Extensions: .exe, .dll, .sys
Notes: "MZ" MS-DOS header. A Windows PE file (exe, dll, sys) also has "PE\0\0" at the offset stored at 0x3C. See the PE Header Summary.
Caution: This signature is short, so unrelated data can start with the same bytes by chance.

Format: Mach-O (64-bit, LE)
Offset: 0
Signature: cf fa ed fe
Extensions: —
Notes: Mach-O 64-bit object, little-endian (macOS and iOS executables and libraries).

Format: Mach-O (32-bit, LE)
Offset: 0
Signature: ce fa ed fe
Extensions: —
Notes: Mach-O 32-bit object, little-endian.

Format: Mach-O universal (fat)
Offset: 0
Signature: ca fe ba be
Extensions: —
Notes: Mach-O universal ("fat") binary holding code for several architectures.
Caution: Java class files and Mach-O universal binaries share the same first 4 bytes, CA FE BA BE. The values in the next 4 bytes are a clue to which one it is, and tools such as file(1) read those later fields too. This tool does not, so it lists both as candidates.

Format: Java class
Offset: 0
Signature: ca fe ba be
Extensions: .class
Notes: Java class file (bytecode); the class file version is at byte offsets 4–7 (the 5th–8th bytes).
Caution: Java class files and Mach-O universal binaries share the same first 4 bytes, CA FE BA BE. The values in the next 4 bytes are a clue to which one it is, and tools such as file(1) read those later fields too. This tool does not, so it lists both as candidates.

Format: WebAssembly
Offset: 0
Signature: 00 61 73 6d
Extensions: .wasm
MIME: application/wasm
Notes: WebAssembly binary module ("\0asm").

Format: SQLite 3
Offset: 0
Signature: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00
Extensions: .sqlite, .db
Notes: SQLite 3 database ("SQLite format 3\0").

Format: Windows shortcut
Offset: 0
Signature: 4c 00 00 00
Extensions: .lnk
Notes: Windows Shell Link (.lnk) header; its size field (0x4C) comes first.
Caution: The 16-byte link class ID that follows is the stronger clue to a shortcut, and this tool checks only these four bytes, which are common.

Format: Compound File Binary (legacy Office / MSI)
Offset: 0
Signature: d0 cf 11 e0 a1 b1 1a e1
Extensions: .doc, .xls, .ppt, .msi
Notes: OLE2 Compound File Binary container used by pre-2007 Office files (doc, xls, ppt) and MSI installers.
Caution: It is a container: which application made the file is only visible from the streams inside.

Format: UTF-8 BOM
Offset: 0
Signature: ef bb bf
Extensions: —
Notes: UTF-8 byte order mark: the text that follows is UTF-8.
Caution: A BOM names a text encoding, not a file format; any text file, such as CSV or source code, can start with it.

Format: UTF-16 BOM (LE)
Offset: 0
Signature: ff fe
Extensions: —
Notes: UTF-16 little-endian byte order mark.
Caution: The UTF-32 little-endian BOM (FF FE 00 00) starts with the same bytes, so FF FE alone does not settle UTF-16 LE. A BOM names a text encoding, not a file format.

Format: UTF-16 BOM (BE)
Offset: 0
Signature: fe ff
Extensions: —
Notes: UTF-16 big-endian byte order mark.
Caution: A BOM names a text encoding, not a file format.

A signature match is a hint about the format, not proof. It does not show that the file is complete, safe to open, or what its extension claims.

How it works

Paste the first few bytes of a file as hex to see which format signatures match, or type a format name or extension to browse the table. Signatures come from the format specifications and the file(1) magic database (checked 2026-09-01). A match is a strong hint, not proof: ZIP backs docx/xlsx/jar/apk/epub, RIFF backs WAV/WebP/AVI, and CAFEBABE is both a Java class and a Mach-O fat binary. Bytes starting FF FE may be a UTF-16 LE or a UTF-32 LE BOM (FF FE 00 00), and the result says so. When several signatures match, the result says so instead of choosing one, and each entry has a short English and Japanese explanation plus a caution where the leading bytes cannot settle the format (containers, short signatures, byte order marks). A match never shows that a file is complete, safe to open, or what its extension claims, and no match does not mean the file is damaged. Names are searched by format, extension, MIME type, or words of the explanations in either language. Only the first 512 bytes (one tar header block, enough to reach the ustar magic at offset 257) are examined and nothing is transmitted. Use the ELF and PE header tools for a structural breakdown of executables.

Result

Related tools

ELF Header Summary

MIME Type Helper

PE Header Summary