File Forensics

Upload an image to detect potential hidden data using LSB (Least Significant Bit) steganography analysis. Analyzes pixel-level modifications, shows a heatmap of altered pixels, detects statistical anomalies, and extracts hidden text messages if found. Compatible with standard LSB encoding and the STEG magic header format. All processing happens locally in your browser - free online steganography detector, no signup required.

Upload any image to see a detailed binary-level breakdown of what contributes to its file size - pixel data, compression overhead, metadata (EXIF/IPTC/XMP), color profiles (ICC), and structural headers. Get prioritized optimization tips with estimated savings for web performance, mobile app optimization, and storage reduction. Supports JPEG, PNG, GIF, WebP, BMP, TIFF, AVIF, and HEIC - all processing runs locally in your browser, no server upload required. Free online image file size analyzer.

Upload any file to instantly detect its true file type by reading the magic bytes (file signature / header). The tool bypasses incorrect file extensions and reveals the real format. Shows hex dump with matching signature bytes highlighted, ASCII interpretation, MIME type, file category, and extension match analysis. Supports over 120 file signatures across 16 categories: images, audio, video, documents, archives, executables, fonts, certificates, disk images, and more. All processing runs locally in your browser - free online File Magic Byte Detector, no signup required.

Detect copy-move forgeries in images using pixel-block matching. Upload any image to find cloned/copied regions, view heatmap overlays showing the location and intensity of detected clones, and get confidence scores with region details. Three sensitivity presets for different detection needs. 100% private browser-based processing - free online Image Clone Detector.

Extract copyright and metadata information from images. Upload any image to read embedded EXIF copyright tags (Artist, Copyright, ImageDescription), IPTC fields (CopyrightNotice, ByLine, Credit, Source, UsageTerms, Contact), and PNG text chunks. Get a copyright completeness score, rights status classification, and a detailed report of all detected fields - free online Image Copyright Checker.

Detect the color depth of any image - 1-bit, 8-bit, 24-bit, 32-bit, 48-bit, and beyond. Upload any image to analyze pixel data, detect bits per channel, identify color space, check for embedded ICC profiles, and get a detailed technical report. All processing happens locally in your browser - free online image color depth checker, no signup required.

Analyze noise patterns in images to detect if they were shot at high ISO, heavily processed, or AI-generated. Upload any image to view per-channel noise levels (Red, Green, Blue), luminance vs chrominance noise breakdown, noise distribution histograms, and a false-color noise heatmap overlay. Automatic classification with confidence scores - all processing is local in your browser. Free online Image Noise Analyzer - no signup required.

Upload any image to check its dimensions against requirements for web, print, social media platforms (Instagram, Twitter/X, Facebook, LinkedIn, YouTube, TikTok), and app stores (Apple App Store, Google Play). View exact pixel dimensions, aspect ratio, DPI/PPI, and file size alongside platform-specific pass/fail indicators with recommendations. All processing happens locally in your browser - free online image dimensions validator, no signup required.

Scan any file for embedded content - images, documents, archives, audio, video, executables, and fonts hidden inside. Upload any file and instantly detect 40+ file formats using binary signature (magic byte) analysis. Get results organized by category with exact byte offsets, size estimates, confidence indicators, and hexadecimal positions. All processing runs locally in your browser - free online Embedded File Detector, no signup required.

Extract and analyze embedded timestamps from photos - Date Taken, Date Digitized, and Date Modified. Upload any image to read EXIF timestamp metadata, detect chronological anomalies (future dates, out-of-order timestamps, identical dates), and identify software editing traces. All processing is local in your browser. Free online Photo Timestamp Analyzer - no signup required.

Check if a file extension matches its actual content type using magic bytes (file signature) detection. Upload any file to read the first bytes, match against 60+ known file signatures, and instantly determine if the file is what it claims to be. Detects disguised files commonly used in phishing attacks - all processing happens locally in your browser. Free online File Extension Validator - no signup required.

Generate MD5 and SHA256 SSH key fingerprints from SSH public keys. Paste your SSH public key in OpenSSH or PEM format to instantly get its MD5 (colon-separated hex) and SHA256 (Base64) fingerprints. Supports RSA, ECDSA, Ed25519, and DSA key types with automatic key type and key length detection. Handles multi-key authorized_keys files - free online Fingerprint Hash Generator, no signup required.

Identify container file formats (ZIP, RAR, 7z, ISO, OLE, Ogg, MKV, PDF) and list their contents without extracting. Upload any file to detect its container format by magic bytes, list internal file names and sizes for ZIP-based formats (including DOCX, XLSX, PPTX, JAR, APK, EPUB), extract PDF metadata and page count, and view header analysis. All processing is local in your browser. Free online Container Format Detector - no signup required.

Upload multiple files to detect their true file types by reading magic bytes (file signatures). Supports 65+ formats including images, documents, archives, audio, video, fonts, and executables. Highlights extension mismatches for security audits and forensic analysis - all processing is local in your browser, no signup required.

Upload any binary file and search for specific byte patterns using hex notation (FF D8 FF, with ?? wildcards), text strings, or regular expressions. Scans every byte to find all occurrences with exact offset, hex/ASCII representation, and surrounding context. Configurable context size, case sensitivity, and max results. Supports files up to 256 MB - all processing runs locally in your browser, no signup required. Free online Binary Pattern Finder.

Upload any file to read and interpret its footer/trailer bytes - the closing signatures that mark the end of a file format. Complementary to magic bytes (headers), trailers are essential for understanding file structure boundaries, detecting truncated files, verifying file completeness, and forensic analysis. Supports 50+ trailer signatures across images (PNG IEND, JPEG EOI, GIF trailer), audio (MP3 padding, WAV data end), video, documents (PDF %%EOF), archives (ZIP EOCD), and more. Shows the tail hex dump, trailer interpretation, file structure insights, and truncation warnings - all processed locally in your browser. Free online File Trailer Analyzer, no signup required.

Upload any file to check if it has been truncated (cut short) - detects incomplete downloads, failed exports, and corrupted transfers by analyzing file headers and comparing expected end-of-file markers with actual file size. Supports JPEG (EOI FF D9 marker), PNG (IEND chunk with dimension-based estimation), GIF (0x3B trailer), BMP (header size comparison), PDF (%%EOF), ZIP (End of Central Directory), GZIP (footer CRC32/ISIZE), RAR, ELF, and WebP. Shows hex dumps of magic bytes and tail bytes, status badge with confidence rating, estimated missing data, and end-of-file marker detection. All processing runs locally in your browser - free online Truncated File Detector, no signup required.

Upload Office documents (DOCX, XLSX, PPTX) to detect hidden content including hidden worksheets, hidden slides, hidden text, tracked changes, comments, VBA macros, and hidden rows or columns. Each finding is categorized with risk levels - all processing is local in your browser. Free online hidden content detector, no signup required.

Analyze chunk-based file formats (PNG, RIFF/WAV/AVI/WebP, JPEG, GIF) and list all chunks with type, size, offset, CRC-32 checksums, and parsed field-level data. All processing is local in your browser - free online File Chunk Analyzer, no signup required.

Upload any file to view and interpret its binary header bytes. Shows hex dump, ASCII interpretation, and a field-by-field breakdown with plain-English explanations for PNG, JPEG, PDF, ZIP, GIF, BMP, ELF, and other formats. Displays offset, length, hex value, and interpreted values for each header field. All processing runs locally in your browser - free online File Header Analyzer, no signup required.

Upload any archive file (ZIP, RAR, 7z, TAR, GZ, BZ2, XZ) for detailed structural analysis. Shows compression methods, encryption type (AES-256, PKWARE), file count, total compressed/uncompressed sizes, compression ratio, file type distribution, and per-file details for ZIP archives. All processing runs locally in your browser - free online Archive Analyzer, no signup required.

Upload any file to detect and analyze padding bytes - extra bytes added for alignment, header filling, or sector padding. Finds runs of identical bytes, classifies by type (null, space, 0xFF, debug values), shows distribution map, and calculates padding percentage. All processing runs locally in your browser - free online Padding Detector, no signup required.

Upload any file to check if it is password-protected or encrypted. Instantly detects encryption on PDFs (/Encrypt flag, AES-256 vs RC4), Office documents (DOCX/XLSX/PPTX with EncryptionInfo), ZIP archives (PKWARE encryption flags), and RAR archives (encryption headers). Shows the encryption type, algorithm strength, key length, and a security rating - all processed locally in your browser with no uploads. Free online Password Protected File Detector, no signup required.

Upload any file to scan for suspicious patterns commonly used in malware: double extension masquerading (document.pdf.exe), Unicode bidirectional override characters (U+202E RTL override that disguise file types), zero-width invisible characters, high-entropy encrypted/packed payloads, and hidden data appended after end-of-file markers (IEND, %%EOF, end-of-central-directory). Each finding includes severity classification (info/warning/critical), detailed explanation, and an overall file risk assessment - all processed locally in your browser with zero server uploads. Free online Suspicious File Pattern Detector, no signup required.

Upload two binary files and compare them byte-by-byte with color-coded differences. Shows offset positions, hex values, and ASCII representation with match percentage. All processing is local in your browser - free online Binary File Comparator, no signup required.

Extract all embedded images from Office documents and PDFs. Upload Word (.docx), Excel (.xlsx), PowerPoint (.pptx), or PDF files to extract images stored in media folders and PDF object streams. View a gallery with preview thumbnails, dimensions, formats, and sizes. Download individual images or all images as a ZIP archive - all processing is local in your browser. Free online Image Extractor from Documents - no signup required.

Upload a .docx, .xlsx, or .pptx file to extract all embedded metadata - author, created/modified dates, company, revision history, comments, hidden text, custom properties, font lists, and more. Parses the Open XML structure to read core properties (dc, dcterms), document statistics, application settings, and worksheet/slide metadata. Also runs a privacy risk scan highlighting what personal or organizational information is exposed. All processing runs locally in your browser - free online Document Metadata Extractor, no signup required.

Upload two Office documents (DOCX, XLSX, PPTX) to compare their metadata side by side. Extracts and compares all embedded metadata - author information, creation and modification dates, revision history, document statistics, company details, application version, and custom properties. Each field is categorized as identical, different, only in File A, or only in File B with color-coded badges. All processing runs locally in your browser with zero uploads - free online Metadata Comparison Tool, no signup required.

Upload any PDF to extract all embedded metadata - author, title, subject, keywords, creator, producer, creation/modification dates, and PDF version. Extracts both the Document Info Dictionary and XMP metadata (Dublin Core, Adobe XMP). Fields organized by source group with per-field descriptions, tab-based filtering, and text export. All processing runs locally in your browser - 100% private, no uploads, no signup required.

Upload any Office document (DOCX, XLSX, PPTX) to analyze VBA macros for suspicious security patterns. Scans VBA source code for shell execution, network access, file system manipulation, code injection, auto-execute triggers, obfuscation, and credential access. Each finding is rated by severity (Critical, High, Medium, Low) with an overall risk score (0-100). All processing is local in your browser - free online Macro Security Checker, no signup required.

Upload any file to simulate file carving - recovery of embedded files by scanning for known headers (magic bytes) and footers (trailer signatures). Detects 13 file formats including JPEG, PNG, GIF, BMP, PDF, ZIP, RAR, GZIP, ELF, MP3, RIFF, OLE2, and SQLite. Shows each carved fragment with exact byte offset, estimated size, confidence score, hex preview, and a visual file layout map. Educational tool for understanding digital forensics and data recovery - all processing runs locally in your browser, no signup required.

Upload any file to check if its size is unusual compared to typical files of the same type. Detects suspiciously small or large files that may indicate corruption, tampering, hidden embedded content, or padding added by malware. Uses magic bytes to detect the true file format even if the extension has been changed, and compares against a database of 80+ file formats across 15 categories. Provides a clear severity assessment (Safe/Low/Medium/High), visual size range comparison on a logarithmic scale, and actionable recommendations. All processing runs locally in your browser - 100% private, no uploads, no signup required. Free online File Size Anomaly Detector.

Upload a damaged file to detect its file type from remaining data and suggest a correct header to prepend for recovery. Analyzes magic bytes at various offsets, entropy patterns, and byte frequency distributions to identify the original format even when the header is corrupted or missing. Supports JPEG, PNG, GIF, BMP, PDF, ZIP, GZIP, ELF, MP3, RIFF/WAV, and more. Generates a downloadable correct header file with hex preview and recovery instructions - all processed locally in your browser, no signup required.

Upload any binary file (executables, firmware, disk images, ROMs) to extract all embedded printable strings - URLs, file paths, identifiers, code snippets, and readable text. Configurable minimum length from 2-20 characters, ASCII and Unicode support, smart categorization (URLs, Paths, IDs, Code, Data, Text), category filtering, inline search within results, hex context display, and text export. All processing runs locally in your browser - 100% private, no uploads, no signup required.

Upload any file fragment (a piece of a file without its header) to identify its likely file type using statistical byte pattern analysis. Computes a comprehensive byte profile including Shannon entropy, byte frequency distribution, printable ASCII percentage, zero-byte density, and internal marker detection. Matches against 20+ file type profiles across images, audio, video, documents, archives, executables, fonts, and text formats. All processing runs locally in your browser - free online File Fragment Type Guesser, no signup required.

Upload Office documents (DOCX, XLSX, PPTX) or PDF files to extract all embedded URLs. Parses the internal document structure to find every external link - hyperlinks, href attributes, and bare URLs in text. Shows each URL with its location within the document, a context snippet, protocol (HTTPS/HTTP), and extracted hostname. Filter by protocol, search by keyword, and copy URLs to clipboard or export as JSON. All processing runs locally in your browser - free online Embedded URL Extractor, no signup required.

Upload Office documents (DOCX, XLSX, PPTX) or PDF files to scan for embedded URLs. Extracts all external links and checks them against a comprehensive local database of 40+ phishing indicators - suspicious TLDs, lookalike domains, credential harvesting keywords, URL obfuscation, protocol anomalies, IP address URLs, and shortened URL services. Each URL receives a suspicion score from 0-100 with severity classification. Also detects auto-execute VBA macros (Auto_Open, Document_Open, Workbook_Open) and extracts document metadata. All processing runs locally in your browser - free online Phishing Link Detector in Documents, no signup required.

Upload any compressed or archived file to instantly identify which compression algorithm was used - DEFLATE (zlib/gzip), LZMA/XZ, BZIP2, Zstandard (ZSTD), Brotli, LZ4, Snappy, LZW, RLE, Huffman Coding, and more. Reads binary header bytes and matches against a database of 30+ compression-specific signatures. Shows algorithm properties including speed rating, compression ratio, streaming support, dictionary type, year introduced, and common use cases. Also detects archive wrappers like ZIP, RAR, 7z, and TAR. All processing runs locally in your browser - no uploads, no signup, completely free.

Check if a signed file's digital certificate is valid. Paste PEM-encoded certificates, PKCS7 signed data, or upload a signed file (.cer, .crt, .p7b, .exe, .dll) to extract full X.509 certificate details - subject and issuer, validity dates, serial number, SHA-1/SHA-256 thumbprints, key usage, extended key usage, and certificate chain analysis. Uses pkijs for browser-based PKCS7/CMS parsing. All processing runs locally in your browser - no uploads, no signup, completely free.

Upload any file to calculate a comprehensive security risk score (0-100) based on file type, embedded content, macros, scripts, URL links, entropy, metadata anomalies, and extension mismatches. Each risk factor is analyzed independently and weighted to produce a final severity rating (Safe / Low / Medium / High / Critical). Get a detailed breakdown showing exactly what contributes to the score with actionable recommendations. All processing runs locally in your browser - free online File Risk Score Calculator, no signup required.

Upload any file to scan for personally identifiable information (PII) that could reveal file origin - detects email addresses, phone numbers, GPS coordinates, IP addresses, computer names, file paths (Windows/Unix), usernames, SSNs, URLs with credentials, and document metadata (author, company). Each finding classified by severity with context. All processing runs locally in your browser - free online File Origin Anonymity Checker, no signup required.

Upload any file to validate its internal structure - checks headers, markers, chunks, CRC checksums, and structural integrity for JPEG, PNG, PDF, ZIP, MP3, and MP4 formats. Each format-specific check reports field-level issues with exact byte offset, severity rating, and actionable recovery recommendations. Gets an integrity score (0-100) with pass/fail/warning counts. Also detects security-relevant PDF elements (JavaScript, Launch actions, embedded files). All processing runs locally in your browser - free online File Structure Validator, no signup required.

Upload multiple files at once to check which ones are zero bytes (empty files with 0 size). Detects completely empty files, files containing only whitespace or null bytes (effectively empty), and provides batch statistics. Shows a clean results table with file name, size, type icon, detection status, and individual results. Scan unlimited files in a single batch - all processing is local in your browser, no uploads, no signup required. Free online Zero Byte File Checker.

Upload any file to detect embedded JavaScript code across PDFs, Office documents (DOCX, XLSX, PPTX), HTML, SVG, XML, and any file format. Detects PDF /JavaScript references and /OpenAction auto-execute triggers, Office VBA macros and script elements in XML, HTML/SVG inline scripts and event handlers (onload, onclick, onerror), javascript: URLs, and generic JS patterns (eval(), fromCharCode(), ActiveXObject, innerHTML). Results classified by severity (Critical/High/Medium/Low) with auto-execute scripts flagged as critical risk - all processing is local in your browser, no signup required.

Upload two directory listings (as text or from archives) to compare their file structure side by side. Parses directory listings and archive contents to detect files added, removed, changed, and unchanged between the two input sets. Results are organized into clearly categorized tables with file sizes, status badges, and summary statistics including total files compared, changed files count, and change percentage. Supports text-based directory listings and ZIP archives. All processing runs locally in your browser - free online Directory Structure Comparator, no signup required.

Upload any file to estimate whether deleted data might still be recoverable. Analyzes file slack space, overwrite patterns, byte frequency distributions (vs known pristine patterns), embedded remnant detection (old strings, paths, residues), and sector-level analysis. Provides an overall recovery potential score (0-100) with category breakdowns, risk classification, and actionable recommendations for secure erasure. All processing runs locally in your browser - free online Data Remanence Estimator, no signup required.

Upload multiple files to compare their sizes with a visual bar chart. Instantly identify the largest and smallest files in a set. Shows total size, average size, median size, and size distribution. Sort by name or size. All processing runs locally in your browser - free online File Size Comparator, no signup required.

Upload a before/after set of files to detect all changes: added files, removed files, modified files, and unchanged files. Compares filenames and SHA-256 content hashes for accurate modification detection. Results include a visual summary dashboard with counts, size totals, bar chart overview, and detailed per-file breakdowns. Perfect for deployment verification, security auditing, backup integrity checks, and data migration validation. All processing runs locally in your browser - 100% private, no uploads, no signup required. Free online Batch File Change Detector.

Find files that are similar but not identical using fuzzy hashing (ssdeep-like algorithm). Upload multiple files to compare them with content-based chunking and rolling hash analysis. Get similarity scores from 0% to 100% organized by category - Identical, Near-Duplicate, Similar, Somewhat Similar, and Different. All processing runs locally in your browser - free online Near-Duplicate File Finder, no signup required.

Upload multiple files to see a breakdown of file types in the set. Interactive pie chart visualization of categories, MIME types, and extensions with magic byte detection. Identifies 80+ file formats across images, documents, archives, audio, video, executables, fonts, and certificates. Per-file details with confidence scoring, search and filter, JSON export. All processing runs locally in your browser - free online File Type Distribution Analyzer, no signup required.

Compare two versions of the same file to see what changed - file name, size, extension, last modified date, and SHA-256 content hash. Upload any two files for instant side-by-side comparison with clear match/difference indicators for each attribute. The tool computes a cryptographic hash using the Web Crypto API for definitive content comparison. All processing runs locally in your browser - no uploads, no signup, completely free.

Upload multiple files to detect naming patterns including sequential numbering, date patterns, common prefixes, suffixes, consistent separators, and file extension distributions. Each pattern is scored with a confidence rating (0-100%). View detected patterns, file groups by common naming elements, and suggested naming formats for standardizing file organization. All processing runs locally in your browser - free online File Rename Pattern Detector, no signup required.

Upload any file to view all its file system attributes - file name, size, MIME type, timestamps, permissions, magic bytes, content classification, character encoding, and Shannon entropy. Displays basic attributes (name, size, type, extension), temporal data (last modified timestamp), format detection via magic bytes (PNG, JPEG, PDF, ZIP, GIF, BMP, TIFF, and 20+ more), content analysis (text vs binary with char/word/line counts), and entropy analysis for compression and encryption detection. All processing runs locally in your browser - free online File Attribute Viewer, no signup required.