The filename extension is only a hint — anyone can rename invoice.pdf to invoice.jpg. The real identity of a file lives in its first few bytes, the magic number that nearly every binary format stamps at the start. This tool reads those bytes in your browser and tells you what a file truly is, then warns you if its extension is lying.
How it works
Most file formats begin with a fixed byte signature at a known offset. The detector reads the first 512 bytes of your file and compares them against a library of signatures, each defined as a hex pattern plus the offset where it must appear:
89 50 4E 47 0D 0A 1A 0Aat offset 0 is a PNG image.FF D8 FFis a JPEG,25 50 44 46 2D(%PDF-) is a PDF, and50 4B 03 04(PK..) is a ZIP container.7F 45 4C 46is an ELF executable,4D 5A(MZ) is a Windows PE, and66 74 79 70at offset 4 marks the MP4/ISO-BMFF family.
A signature can include wildcard bytes and can sit at a non-zero offset — TAR’s ustar marker, for instance, lives at offset 257. When the leading bytes match, the format, its MIME type and its typical extensions are reported.
Why extension checks matter
Because some signatures are shared — a DOCX is really a ZIP, an APK is really a ZIP — a single magic number can map to several formats, and the tool lists them all. More importantly, it compares the detected type against the file’s actual extension. If you upload report.png and the bytes say it is a PDF, you get an explicit mismatch warning. That is useful for spotting renamed downloads, broken uploads, content-type spoofing in security work, and forensic triage. Only the first 512 bytes are read, entirely in your browser, so nothing is uploaded.