How to identify an unknown file type

A file with an unfamiliar name does not have to stay a mystery. Its contents often contain a signature that identifies the format, even if the extension is missing.

Start with the contents, not the name

Extensions such as .pdf and .jpg help your operating system choose an app. They are labels, not proof. Anyone can rename a video to holiday.pdf without turning it into a PDF document.

Use the free File Sniff file type checker to inspect the file locally in your browser. Choose the file or drop it into the checker. It will show a detected format, MIME type and the first 64 bytes, with an extension comparison where it has enough information.

Read the signature

PNG images begin with the bytes 89 50 4E 47 0D 0A 1A 0A. PDF documents commonly begin with %PDF-. These recognisable markers are called file signatures or magic bytes.

Some signatures identify a container rather than a specific document. Word .docx, Excel .xlsx and PowerPoint .pptx files use ZIP containers. The checker looks for their characteristic directory entries so it can distinguish supported Office documents from ordinary ZIP files.

If the result says “Unknown”

Unknown does not mean dangerous or broken. The format may be unsupported, the sample may not contain a recognised signature, or the file may be incomplete. Very short files can be impossible to identify reliably.

Check the original source of the file. If it came from a failed download, get a fresh copy. If a colleague sent it, ask which application created it. Keep the original file while investigating.

Choose an application that supports the result

Once you know the likely format, use a suitable application from a source you trust. A file type checker is not a malware scanner: a familiar format and a matching extension do not establish that a file is safe to open.

For folder scanning, broader detection and more detailed inspection, explore File Sniff for Mac, iPhone and iPad. If the contents and filename disagree, read what a file extension mismatch means.