Published 2026-09-26 · Updated 2026-11-05

File Signatures & Magic Bytes Guide

When you double-click a file, your operating system usually looks at the letters after the final dot—such as .pdf, .jpg or .docx—to decide which app should open it. That extension is only part of the filename. The actual format is recorded inside the file’s bytes.

Many formats begin with a fixed sequence of bytes called a file signature or magic bytes. Inspecting those bytes is the fastest way to find out what an unfamiliar or mislabelled file really is.

You can inspect a file’s signature and first 64 bytes locally in your browser with the free File Sniff file type checker.

How file signatures work

A file signature is a short marker placed at a predictable position near the beginning of a file so software can recognise the format immediately:

• Fixed start-of-file signatures appear at byte offset 0. For example, every standard PNG image starts with the eight bytes 89 50 4E 47 0D 0A 1A 0A, where 50 4E 47 spells PNG in ASCII.
• Offset signatures appear after a length field or outer header. ISO Base Media files (such as MP4 videos, QuickTime .mov movies, M4A audio, HEIC photos and AVIF images) begin with a 4-byte box size followed by 66 74 79 70 (ftyp) at byte offset 4, and then a brand code such as isom, qt , heic or avif.
• RIFF containers start with 52 49 46 46 (RIFF), a 4-byte file size, and then a 4-byte format tag at byte offset 8: WEBP for WebP images, WAVE for WAV audio, or AVI for AVI video.

Common file signatures at a glance

When the signature only shows a container

Some magic bytes identify an outer packaging format rather than the specific document type inside:

1. ZIP-based document formats: Microsoft Word (.docx), Excel (.xlsx), PowerPoint (.pptx), EPUB books (.epub), Android packages (.apk) and OpenDocument files all start with 50 4B 03 04 (PK\x03\x04). To tell a Word document apart from an ordinary ZIP archive without decompressing the file, a checker inspects the ZIP central directory at the end of the file for entries such as [Content_Types].xml and word/document.xml, xl/workbook.xml or ppt/presentation.xml.
2. OLE Compound Documents: Older Office files (.doc, .xls, .ppt) and Outlook .msg emails share the same eight-byte OLE header (D0 CF 11 E0 A1 B1 1A E1). Distinguishing them requires reading the internal OLE directory streams.
3. Plain text formats: Files such as .txt, .csv, .json, .md or scripts do not have a mandatory binary header. A careful checker validates UTF-8 text and syntax (such as complete JSON or a #! shebang) rather than guessing from a filename.

What magic bytes cannot prove

File signatures are designed for format recognition, not security verification:

• A valid header does not prove the rest of the file is intact. A truncated download can still have a valid header at the start while missing its final bytes.
• Signatures can be forged or combined. Because some parsers scan from the start of a file and others scan from the end (like ZIP), a crafted file can contain more than one marker.
• Identification is not a malware scan. Knowing that an attachment is a Windows executable (MZ / PE\0\0) or a mismatched video helps you avoid opening the wrong thing, but a matching extension never proves a file is safe.

Try inspecting a file with the free file type checker, learn how to identify an unknown file, or read what a file extension mismatch means.