Asking a file what it is, instead of asking its name
What appears on each card and how to read it, which endings are treated as the same format and why, how archive based documents are told apart, four files checked together as a worked run, and the questions this page cannot answer for you.
The moment you stop trusting the name
Something arrives and will not open. A picture your phone insists is broken. A file on an old drive called backup with nothing after the word. The name has told you one story and the program that tried to open it has told you another.
The name is not part of the file. It is a label anyone can change in two seconds, and programs that go by it alone are easy to mislead. What is inside the file, right at the front, is a short run of bytes fixed by whoever designed the format. That is the honest answer.
- An attachment you were not expecting, before you double click it.
- A photo that no viewer will open, to find out what it really became.
- Files with no ending at all, rescued from a backup or pulled off a server.
Feeding it files
The dashed box takes as many files as you can select, or drag on together, and it deals with fifty in one go. Send more than that and a short message tells you the first fifty are being handled, so a folder of two hundred takes four passes rather than failing.
Only the beginning of each file is looked at. That is all a signature needs, and it means a two gigabyte video is checked as quickly as a text note. Once the first batch is in, the drop box shrinks to leave more room for results, and it keeps taking files, adding a fresh set of cards each time.
Reading a card
Each file gets a panel of its own. The name is at the top left with a coloured badge beside it, and that badge is the verdict you probably came for.
Below it comes a short row of facts. Really is names the format that the opening bytes point to. Size is the file's length. Usual extension gives the ending that format normally carries, which is the thing to compare against what you have. Under that sits one plain sentence about what such a file is for.
The last line is the evidence itself: the first sixteen bytes written as pairs of hexadecimal digits, shown in lowercase. Nothing is hidden behind the verdict. If you want to check the working, it is printed right there.
The three badges
A mismatch is usually innocent. A program saved one format and named it another, or somebody renamed a file to get past a fussy upload form. But the same mismatch is also the oldest way of getting a person to run something they should not, since a person checks the ending and nothing else. Treat an unexpected one as a reason to slow down, especially when the contents turn out to be a program.
- Extension matches. The ending on the name and the contents agree. Nothing to think about.
- Extension does not match. The contents are one thing and the name says another. A red paragraph appears under the facts spelling out what was expected and what was found.
- No extension. The name has no ending at all, so there is nothing to compare. This is not a warning, and the identification is just as good.
Why .jpeg and .jpg are both correct
A strict comparison of endings would cry wolf all day. So a list of families is applied first, and any ending in the same family as the contents counts as a match.
Pictures are the obvious case: jpg, jpeg and jpe are one format, as are tif and tiff. Web pages cover htm and html. The files mp4, m4a, m4v and mov all sit in one family. Programs group exe, dll and sys, since all three are the same kind of Windows file.
Plain text is the widest family of all. A file of code or data is text as far as its bytes are concerned, so md, csv, log, yml, yaml, js, css, ts, py and sh are all accepted against a verdict of plain text. That is not the page being vague. There is genuinely nothing in the opening bytes of a script that separates it from a shopping list, and a page that claimed otherwise would be guessing.
The documents that are archives underneath
A modern Word file is a zip full of small parts. So is a spreadsheet, a presentation, an ebook, an Android app and a Java package. All of them begin with the same two letters, so stopping at the first bytes would report every one of them as an archive and leave you no wiser.
So the check goes further in. The names of the items packed inside are read out, and those give the game away: a folder called word inside means a Word document, one called xl means a spreadsheet, one called ppt a presentation. Ebooks and the office formats used by free software declare themselves in a small entry at the very front. An app for a phone is spotted by the manifest it must carry.
If none of those markers turn up, the verdict stays as a plain archive, which is the truthful answer for an ordinary zip.
What it knows, and what comes back as unknown
Around thirty signatures are checked directly: pictures, page documents, archives of several kinds, sound and video, fonts, databases, and programs for both Windows and Linux. A few formats keep their marker slightly further in rather than at the very start, and those positions are handled too.
If nothing matches, the file is tested for being readable text at all. A single byte of value zero rules it out immediately, since that never appears in writing and always appears in pictures and programs. Text that passes is then looked at for an opening angle bracket or brace, which sorts out page markup and structured data from ordinary prose.
Anything left over is reported as unknown, with a note saying the opening bytes match nothing known here. That is an honest result, not a failure. Plenty of formats are private to one program, and a name nobody can guess is better than a confident wrong answer.
Four files checked together
Four files go in at once: holiday.jpg, invoice.pdf, a file called simply notes, and quarterly.xlsx.
The first card says holiday.jpg with an amber badge. It really is a PNG image, and the byte line opens 89 50 4e 47. Harmless: an editing program saved it as one format and typed the wrong ending. Most viewers will open it anyway, and renaming it to holiday.png tidies it up.
The second card is the one that matters. invoice.pdf carries the same amber badge, but it really is a Windows program, and its byte line opens 4d 5a. A genuine document would have started 25 50 44 46, which spells out the letters of the format. This one is not an invoice. It is something that wants to be run.
The third card, notes, has a grey badge reading no extension and is identified as plain text, so it can be opened safely in any editor. The fourth, quarterly.xlsx, comes back green: really an Excel workbook, because a folder named xl was found inside it.
Keeping the answer
A small bar sits with the results offering three ways to keep them: a text file, an image, and a copy to the clipboard. The saved file is named for the report and the day it was made, so a folder of them stays in order.
The report opens with the number of files checked and either a line saying every ending matched or a count of how many did not. Then come two tables. The first lists each file, what it really is, its size and a plain verdict, with a mismatch written out in capitals so nobody skims past it. The second lists the opening bytes for every file, which is what makes the report worth sending on: the person receiving it can check your conclusion instead of taking your word for it.
The questions it cannot answer
- Whether a file is safe. This is not a scanner. It tells you what a thing is, which is a different and earlier question.
- Whether a matching file is harmless. A document with the right ending can still carry something unwanted inside it.
- Whether a file is complete. Only the front is read, so a truncated download can still show a perfect signature.
- Which program made it, or which version. Two files from very different tools share one signature.
- What is inside a locked archive. The wrapper is named; the contents behind a password are not read.
- What language a text file is in, or whether it is code. Text is text at the level of bytes.
Where to go next
- To see far more than sixteen bytes: Hex Viewer lays out the whole file.
- To open the archive you just identified: Zip & Unzip, or the TAR and GZ Extractor for the bundles Linux uses.
- To read a document once you know what it is: the Word Document Viewer and the EPUB Reader open theirs directly.
- To prove a file arrived unchanged: Checksum Verifier compares fingerprints of the whole file.
Nothing is uploaded to find out
The reading and the matching both happen in your browser. The list of signatures came down with the page, so comparing your file against it needs no server and no connection. Turn the network off after the page has loaded and every card still appears exactly as before.
That is the right arrangement here, because of when people reach for this. The files you most want identified are the ones you trust least: an unexpected attachment, a download from a link somebody sent, the contents of a drive that is not yours. Reading their first bytes on your own machine beats sending them to a website to ask.