How it works
Most file formats start with a fixed run of bytes, called a magic number or file signature. A PDF starts with %PDF, a PNG with 89 50 4E 47, a Windows program with MZ. This page reads the first 40 KB of each file and compares it with about 120 signatures. It then looks inside containers to tell a Word document from an APK, since both are ZIP files.
It compares what it finds with the file’s extension. A mismatch is worth a closer look, and a program disguised as a document is a classic malware trick. It also shows the first bytes in hex, the entropy (randomness) of the start of the file, and its SHA-256 hash.
Why would an extension lie?
- Malware.
invoice.pdf.exeshows asinvoice.pdfwhen Windows hides known extensions. - Evidence handling. Photos saved as
.jpgare often really HEIC or WebP, which changes which tools can read their metadata. - Hiding. Renaming an archive or database to
.dllor.tmpkeeps it out of casual view. - Honest mistakes. Downloads lose their extension, and some apps save in a different format from the one they name.
What it cannot tell you
A matching signature says what format a file claims to be, not that it is safe or intact. Plain-text formats such as CSV, logs and source code have no signature, so they are recognised by their content and can be confused. For a suspicious program, check its hash with VirusTotal using the link on each result, or open it in our APK and extension inspector.
Frequently asked questions
Are my files uploaded?
No. Each file is read inside your browser tab. The hash links only open VirusTotal or MalwareBazaar if you click them, and then only the hash is sent.
What is a file signature or magic number?
A fixed run of bytes near the start of a file that marks its format. For example, every PDF starts with %PDF and every ZIP archive with PK.
Why does it say my .docx is a ZIP file?
Modern Office files, APKs, JARs and EPUBs are ZIP archives inside. The tool looks for the files each format stores inside the archive to tell them apart, and shows the specific type when it can.
What does high entropy mean?
Entropy measures how random the bytes are, from 0 to 8 bits per byte. Above about 7.5 the data is almost certainly compressed or encrypted. That is normal for ZIP, JPEG and MP4, but odd for a text file.
Can it detect malware?
No. It shows what a file really is and flags programs disguised as documents. Check a suspicious file's hash with a malware service before opening it.