The first 64 bytes of a file. Each row is 16 bytes: the offset of the row on the left, each byte as two hex digits in the middle, and the same bytes read as ASCII on the right. A dot stands for a byte that is not a printable character. The bytes in green are the file's signature, also called its magic number.
Try the samples, then your own files. A photo, a PDF, a Word document, a zip, a program. Only the first 64 bytes are read, and nothing leaves your browser.
To the operating system a file is a name and a run of bytes. The bytes carry no type. A program that opens the file has to work out how to read them, so most formats begin with a fixed pattern that says what follows. That pattern is the magic number. The name comes from early Unix, where every program file began with the number 0407 in octal, and the loader checked for it before running anything.
A good signature is chosen so that damage shows up at once. PNG's eight bytes are the best example:
| Bytes | Why they are there |
|---|---|
89 | Has its top bit set. A channel that keeps only 7 bits strips it, and the file is caught at byte one. |
50 4E 47 | The letters PNG, so a person looking at the bytes can read the name. |
0D 0A | A Windows line ending. A tool that converts line endings changes it. |
1A | Stops the old DOS type command from printing the rest as text. |
0A | A Unix line ending, for the same reason as the pair above. |
| First bytes | As text | File type |
|---|---|---|
89 50 4E 47 0D 0A 1A 0A | .PNG.... | PNG image |
FF D8 FF | JPEG image | |
47 49 46 38 39 61 | GIF89a | GIF image |
25 50 44 46 | %PDF | PDF document |
50 4B 03 04 | PK.. | ZIP archive, also docx, xlsx, pptx, jar and apk |
1F 8B | gzip compressed data | |
4D 5A | MZ | Windows program (exe, dll) |
7F 45 4C 46 | .ELF | Linux program |
CF FA ED FE | macOS program | |
CA FE BA BE | Java class file | |
52 49 46 46 .. .. .. .. 57 41 56 45 | RIFF....WAVE | WAV sound |
.. .. .. .. 66 74 79 70 | ....ftyp | MP4 video, at offset 4 |
53 51 4C 69 74 65 | SQLite | SQLite database |
PK is the initials of Phil Katz, who wrote the ZIP format. MZ is Mark Zbikowski,
who designed the DOS program format. CA FE BA BE is a joke that happens to be valid hex.
The extension at the end of a file name is a label for people and for the desktop. It is not stored in
the bytes. Rename cat.png to cat.txt and every byte stays the same. The sample
called cat.txt above is exactly that. The bytes still say PNG, and an image viewer will
still open it.
This is why tools that have to be sure look at the bytes. The Unix file command names a
file's type from its signature and ignores the name. Browsers do the same with downloads. A website that
accepts uploads and only checks that the name ends in .jpg can be given a program with
that name.
A plain text file, a CSV, a source file, an HTML page: these start with whatever the first character is.
There is no signature. A tool can only guess from the content, for example that every byte is a printable
character. The sample readme.txt shows this. Some formats put the signature a few bytes in,
like MP4 at offset 4, and some put a marker at the end of the file as well.
1. A file begins 25 50 44 46 2D 31 2E 37. What type is it?
2. A file named song.mp3 begins 89 50 4E 47. What is it really?
3. A Windows program begins 4D 5A. Write those two bytes as ASCII.