File Magic Bytes Reference

Magic bytes, also called a file signature or magic number, are the first few bytes stored at a fixed position inside a file that identify its format. Long before any application reads the rest of the data, it can look at those leading bytes and know whether it is holding a PNG image, a ZIP archive, a PDF document, or an executable. This is the mechanism behind commands like the Unix file utility, which sniffs the content rather than trusting the filename.

This reference collects around 140 well-known signatures across twelve categories: Archive, Image, Audio, Video, Document, System, Mobile, Web, Font, Data, 3D and CAD. Each entry lists an extension, the hexadecimal magic bytes, and the byte offset where the signature begins. Most formats place their signature at offset 0, but several important ones do not, which is why the offset column matters.

Some signatures live much later in the file. The TAR archive format stores its ustar marker at byte 257, the ISO 9660 optical-disc format places CD001 at offsets such as 32769 and 32771, the EPUB container puts its mimetype entry at byte 30, NTFS volumes carry NTFS at byte 3, and the ext family of Linux filesystems stores its magic at offset 0x438, which is decimal 1080. RIFF-based formats such as WAV, AVI and WebP share a RIFF header followed by a four-byte size and then a format tag, so the tool represents the variable size bytes with ?? wildcards.

The entire reference is client-side. You can search by extension, description, or hex bytes, and filter by category to narrow the list. Nothing is uploaded and no data leaves your browser. Keep in mind that magic bytes are strong evidence of a format but not absolute proof: a determined attacker can craft a file whose signature and contents disagree, so never treat a matching signature as a guarantee of safety.

Key Concepts

• File signature — the leading bytes that identify a format regardless of the filename extension.
• Offset — the byte position where the signature begins; most are at 0 but several are far into the file.
• Hex notation — signatures are shown as hexadecimal byte pairs like 89 50 4E 47.
• Wildcards — ?? marks a variable byte, as used in RIFF-based formats.
• Categories — signatures are grouped into Archive, Image, Audio, Video, Document, System, Mobile, Web, Font, Data, 3D and CAD.
• Heuristic — a matching signature is strong evidence, not a security guarantee, of a file's true type.

1. Browse the table — All known magic bytes signatures are displayed in a searchable table.
2. Search — Type an extension (.pdf, .zip), hex bytes (50 4B 03 04), or a description to filter results.
3. Filter by category — Use the dropdown to narrow results to a specific category such as Image, Archive or Video.
4. Read the offset — Check the byte position column so you know exactly where the signature is expected to appear.
5. Verify against a hex dump — Compare the listed bytes with a hex editor or xxd output to confirm the format.

Knowing a file's signature is useful in many everyday and technical situations. These are the scenarios where this reference saves the most time.

1. Recovering unknown files — identify the real type of a file that has lost or been given a wrong extension.
2. Digital forensics — confirm what a file actually is during an investigation instead of trusting metadata.
3. Verifying downloads — check that a downloaded file's leading bytes match the format you expected.
4. Malware triage — spot executables and scripts disguised with innocent-looking extensions.
5. Data recovery — carve files out of disk images by scanning for known signatures.
6. Format research — learn how different formats identify themselves through their on-disk headers when building parsers and tools.