Can renaming a file change its type?

No. The bytes inside the file do not change when you rename it. A .pdf filename does not turn an executable into a PDF. The magic-byte check reports the bytes as they actually are.

Why does a DOCX file start with PK ?

DOCX is a ZIP archive containing XML and media files. ZIP archives start with 50 4B 03 04 , which is PK in ASCII (the initials of Phil Katz, who designed PKZIP). The DOCX-specific marker lives inside the archive, not in the first bytes.

How many bytes do you actually need to read?

For most formats, 4 to 8 bytes are enough. Our checker reads up to 4096 bytes from the head of the file because some formats (like ISO 9660 with its sector-16 offset) hide the signature deeper in.

Do all files have a magic number?

No. Plain text files, source code, and CSV files have no fixed signature. They are detected by content classifiers (heuristics or, in our case, a small AI model) rather than by magic-byte lookup.

What does an AMBIGUOUS verdict mean?

Multiple known formats match the same prefix. Every Office document (DOCX, XLSX, PPTX) is a ZIP archive, so the magic bytes alone cannot distinguish them. The checker reports AMBIGUOUS and suggests inspecting the contents.

Is a magic-byte check the same as a malware scan?

No. A magic-byte check identifies format, not safety. A perfectly-formed PDF can still contain malicious JavaScript. For malware verdicts you need an antivirus or EDR product. See the honest scope page for the boundary.

What is a magic number?

A magic number is the short fixed byte sequence at the start of every file. It identifies the format before any extension is read. This page covers how they work, what the most common signatures look like, and why a magic-byte check beats a file-name check every time.

Open the File Type Checker See the signature table

Plain-English explainer
14 formats covered
Bytes never leave your browser

Key facts

What is it?
A magic number is a fixed byte sequence (usually 2 to 8 bytes) at the start of a file that identifies the format.
Where does it live?
Almost always at byte offset 0. ISO 9660 disc images are the well-known exception: their CD001 signature sits at offset 32769 (sector 16).
Extension or bytes?
The bytes win. Renaming report.exe to report.pdf changes the label, not the content. The magic bytes still read 4D 5A.
What you get back
Our File Type Checker reports one of four verdicts: MATCH, MISMATCH, AMBIGUOUS, or UNKNOWN. Each is a deterministic answer about format identity, not safety.
Privacy
The free single-file flow runs entirely in your browser. The bytes never leave your device.
Safety scope
A magic-byte check identifies format, not malware. Use it as a first signal, not a virus verdict.

A magic number (also called a magic-byte signature or file signature) is a short, fixed byte sequence written at the very start of a file that identifies its true format. The operating system uses it before any file extension. The extension is just a hint; the magic number is the truth.

Magic-byte signature reference

14 widely-used signatures sourced from the formats specifications. Hex bytes are uppercase, space-separated. ASCII previews substitute non-printable bytes with a dot.

Format	Magic bytes (hex)	ASCII	Extensions	MIME type	Offset
PDF	`25 50 44 46`	`%PDF`	.pdf	`application/pdf`	byte 0
PNG	`89 50 4E 47 0D 0A 1A 0A`	`.PNG....`	.png	`image/png`	byte 0
JPEG	`FF D8 FF`	`...`	.jpg, .jpeg	`image/jpeg`	byte 0
GIF	`47 49 46 38 39 61`	`GIF89a`	.gif	`image/gif`	byte 0
BMP	`42 4D`	`BM`	.bmp	`image/bmp`	byte 0
ZIP	`50 4B 03 04`	`PK..`	.zip	`application/zip`	byte 0
RAR (v5)	`52 61 72 21 1A 07 01 00`	`Rar!....`	.rar	`application/vnd.rar`	byte 0
7-Zip	`37 7A BC AF 27 1C`	`7z....`	.7z	`application/x-7z-compressed`	byte 0
DOCX (Office Open XML)	`50 4B 03 04`	`PK..`	.docx	`application/vnd.openxmlformats-officedocument.wordprocessingml.document`	byte 0
XLSX (Office Open XML)	`50 4B 03 04`	`PK..`	.xlsx	`application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`	byte 0
APK (Android package)	`50 4B 03 04`	`PK..`	.apk	`application/vnd.android.package-archive`	byte 0
MP4 (ISO BMFF)	`00 00 00 20 66 74 79 70`	`....ftyp`	.mp4, .m4v	`video/mp4`	byte 0
Windows PE / EXE	`4D 5A`	`MZ`	.exe, .dll, .sys	`application/vnd.microsoft.portable-executable`	byte 0
ISO 9660	`43 44 30 30 31`	`CD001`	.iso	`application/x-iso9660-image`	byte (sector 16)

PDF
Magic bytes (hex):
25 50 44 46
ASCII:
%PDF
Extensions:
.pdf
MIME type:
application/pdf
Offset:
byte 0
PNG
Magic bytes (hex):
89 50 4E 47 0D 0A 1A 0A
ASCII:
.PNG....
Extensions:
.png
MIME type:
image/png
Offset:
byte 0
JPEG
Magic bytes (hex):
FF D8 FF
ASCII:
...
Extensions:
.jpg, .jpeg
MIME type:
image/jpeg
Offset:
byte 0
GIF
Magic bytes (hex):
47 49 46 38 39 61
ASCII:
GIF89a
Extensions:
.gif
MIME type:
image/gif
Offset:
byte 0
BMP
Magic bytes (hex):
42 4D
ASCII:
BM
Extensions:
.bmp
MIME type:
image/bmp
Offset:
byte 0
ZIP
Magic bytes (hex):
50 4B 03 04
ASCII:
PK..
Extensions:
.zip
MIME type:
application/zip
Offset:
byte 0
RAR (v5)
Magic bytes (hex):
52 61 72 21 1A 07 01 00
ASCII:
Rar!....
Extensions:
.rar
MIME type:
application/vnd.rar
Offset:
byte 0
7-Zip
Magic bytes (hex):
37 7A BC AF 27 1C
ASCII:
7z....
Extensions:
.7z
MIME type:
application/x-7z-compressed
Offset:
byte 0
DOCX (Office Open XML)
Magic bytes (hex):
50 4B 03 04
ASCII:
PK..
Extensions:
.docx
MIME type:
application/vnd.openxmlformats-officedocument.wordprocessingml.document
Offset:
byte 0
XLSX (Office Open XML)
Magic bytes (hex):
50 4B 03 04
ASCII:
PK..
Extensions:
.xlsx
MIME type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Offset:
byte 0
APK (Android package)
Magic bytes (hex):
50 4B 03 04
ASCII:
PK..
Extensions:
.apk
MIME type:
application/vnd.android.package-archive
Offset:
byte 0
MP4 (ISO BMFF)
Magic bytes (hex):
00 00 00 20 66 74 79 70
ASCII:
....ftyp
Extensions:
.mp4, .m4v
MIME type:
video/mp4
Offset:
byte 0
Windows PE / EXE
Magic bytes (hex):
4D 5A
ASCII:
MZ
Extensions:
.exe, .dll, .sys
MIME type:
application/vnd.microsoft.portable-executable
Offset:
byte 0
ISO 9660
Magic bytes (hex):
43 44 30 30 31
ASCII:
CD001
Extensions:
.iso
MIME type:
application/x-iso9660-image
Offset:
byte (sector 16)

PDF
The four bytes spell %PDF. PDF version follows immediately, e.g. %PDF-1.7.
PNG
Eight bytes including the PNG end-of-line markers (0D 0A 1A 0A) so transmission errors are detectable.
JPEG
Start of Image marker. The fourth byte distinguishes JFIF (E0) from EXIF (E1).
GIF
GIF89a is the modern variant. GIF87a (47 49 46 38 37 61) is the legacy spelling and is also valid.
BMP
Two bytes. Easy to spoof; pair with the file size header at offset 2 to disambiguate.
ZIP
Local file header. Empty archives use 50 4B 05 06 (end-of-central-directory) instead.
RAR (v5)
RAR 5 signature. Older RAR 1.5 to 4.x files use a 7-byte signature ending in 00.
7-Zip
Six bytes spelling 7z followed by three magic bytes.
DOCX (Office Open XML)
DOCX is a ZIP container. The signature alone cannot distinguish a Word doc from a generic ZIP. Look at the inner [Content_Types].xml.
XLSX (Office Open XML)
Same caveat as DOCX. Inspect the OOXML manifest to confirm the spreadsheet variant.
APK (Android package)
APK is a ZIP container with an Android manifest inside. ZIP signature alone is not sufficient proof.
MP4 (ISO BMFF)
The ftyp box at offset 4 carries the brand identifier. Common brands: isom, mp42, iso5.
Windows PE / EXE
Two bytes (Mark Zbikowski). The PE header offset is read from byte 0x3C; the actual PE\0\0 magic sits there.
ISO 9660
ISO 9660 places the volume descriptor at sector 16, so the signature lives at byte 32769 (16 * 2048 + 1).

How a magic-byte check works

1
Read the first bytes
Open the file as a binary stream and read the first 8 to 16 bytes. That is enough to recognise every signature in the table above.
2
Compare against known signatures
Match the bytes against a database of known formats. Multiple formats can share a prefix (every Office document is a ZIP), so the check returns the most specific match.
3
Cross-check with the file extension
If the detected format does not match what the extension claims, the verdict is MISMATCH. If multiple formats fit, AMBIGUOUS. If nothing fits, UNKNOWN.

Why does this matter?

Renaming a file from invoice.exe to invoice.pdf does not change its bytes. The first two bytes still read 4D 5A. The magic-number check catches that immediately. Useful when an attachment looks legitimate but the extension was changed before sending.

Magic-byte checks also catch the reverse: a file with no extension at all but valid PNG bytes is still a PNG and your image viewer can open it. Format identity lives in the bytes, not in the file name.

Glossary

Per-format deep dives

Each spoke is a focused page on a single format: how to recognise it, common mismatch patterns, and a one-click check. Drop your file once on any of these and the verdict is the same.

Frequently asked questions

Try it on your own file

Drop any file. The check runs locally and reports a verdict in under a second. The bytes never leave your browser.

Open the File Type Checker

What is a magic number?

Key facts

Magic-byte signature reference

PDF

PNG

JPEG

GIF

BMP

ZIP

RAR (v5)

7-Zip

DOCX (Office Open XML)

XLSX (Office Open XML)

APK (Android package)

MP4 (ISO BMFF)

Windows PE / EXE

ISO 9660