Most file formats begin with a few fixed bytes, a file signature or magic number, that identify the format regardless of the file's name. Operating systems and programs use the extension as a hint, but the signature is what the file actually is. This is the foundation of file type detection, upload validation, data recovery and forensic carving. Inspect any file's bytes with Binary & Archive Forensics.
Common signatures
| Format | Signature (hex) | As text | Offset |
|---|---|---|---|
| PNG image | 89 50 4E 47 0D 0A 1A 0A |
.PNG.... |
0 |
| JPEG image | FF D8 FF |
... |
0 |
| GIF image | 47 49 46 38 |
GIF8 |
0 |
| WebP image | 52 49 46 46 .. .. .. .. 57 45 42 50 |
RIFF....WEBP |
0 |
| BMP image | 42 4D |
BM |
0 |
| TIFF image | 49 49 2A 00 (or 4D 4D 00 2A) |
II*. |
0 |
| PDF document | 25 50 44 46 2D |
%PDF- |
0 |
| ZIP archive (also DOCX, XLSX, JAR, APK) | 50 4B 03 04 |
PK.. |
0 |
| Gzip file | 1F 8B |
.. |
0 |
| TAR archive | 75 73 74 61 72 |
ustar |
257 |
| SQLite database | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 |
SQLite format 3. |
0 |
| ELF executable (Linux) | 7F 45 4C 46 |
.ELF |
0 |
| Windows executable (EXE, DLL) | 4D 5A |
MZ |
0 |
| 7-Zip archive | 37 7A BC AF 27 1C |
7z.... |
0 |
| RAR archive | 52 61 72 21 1A 07 |
Rar!.. |
0 |
| Old Office files (DOC, XLS) and MSI | D0 CF 11 E0 A1 B1 1A E1 |
........ |
0 |
| MP3 audio with ID3 tag | 49 44 33 |
ID3 |
0 |
| MP4 / MOV video | .. .. .. .. 66 74 79 70 |
....ftyp |
0 |
The first twelve rows were checked by creating real files and reading their first bytes, and the common ones were confirmed by the system's file tool. A few formats carry the marker deeper in the file: TAR's ustar is at byte 257, and MP4 has ftyp at byte 4.
Why extensions are not enough
The extension is just part of the name, so anyone can change it. A program renamed holiday.jpg is still a program, and a PNG renamed .jpg is still a PNG: most image viewers detect that from the signature and open it anyway.
Where signatures matter
- Upload checks. Validating the extension or the
Content-Typethe browser sent is not enough, because both are attacker-controlled. Compare the first bytes with the expected signature, and re-encode images when you can. See MIME Types Cheat Sheet. - Data recovery and carving. Tools scan raw disk space for known signatures to rebuild deleted files, even when the file system no longer lists them.
- Forensics. A mismatch between extension and signature is a classic red flag; the Document Forensics and Image Forensics tools look at the real structure, not just the label.
- Antivirus and email gateways use signatures to decide how to unpack and scan attachments.
Containers hide what is inside
A DOCX, XLSX, PPTX, JAR and APK are all ZIP files with a particular layout, so they begin with 50 4B 03 04 just like any archive. Likewise old DOC and XLS files share one OLE container signature. The signature tells you the container; you must look inside to learn the real type.
Limits
- Signatures are short, so a file can start with a valid one and contain something else. A polyglot file is deliberately valid as two formats at once.
- Some formats have no signature (plain text, CSV, raw audio) and have to be recognised by their content.
- Trailing data after the end of a valid file is common in tampered or concatenated files, and a signature check at the start will not see it.
Related: Magic bytes, Hexadecimal and How Number Bases Work: Binary, Octal and Hex.