Skip to content
Aback Tools Logo

Container Format Detector

Upload any file to identify its container format and inspect its internal structure using our free online Container Format Detector. The tool reads the file signature (magic bytes) to identify the format, then applies format-specific analysis: full content listing with sizes and compression ratios for ZIP-based files (ZIP, DOCX, XLSX, PPTX, JAR, APK, EPUB), metadata extraction and page counting for PDF files, and header analysis for other formats. No extraction occurs - all processing is done locally in your browser with no uploads or signup required.

Container Format Detector

Upload any file to identify its container format, inspect its internal structure, and list contents without extraction. Supports ZIP-based formats (including DOCX, XLSX, PPTX, JAR, APK, EPUB) with full content listing, plus PDF metadata extraction, and signature detection for RAR, 7z, GZIP, TAR, ISO, DMG, Ogg, Matroska, and more. All processing is done locally in your browser.

Drop a container file here or click to browse

ZIP, RAR, 7z, PDF, DOCX, XLSX, PPTX, JAR, APK, EPUB, ISO, DMG, and more - max 100 MB

How Container Detection Works

The Container Format Detector identifies file formats by reading the file signature (magic bytes) - the first bytes that uniquely identify each format. For ZIP-based formats (ZIP, DOCX, XLSX, PPTX, JAR, APK, EPUB), the tool uses JSZip to parse the archive structure and list all contents with sizes and compression ratios. For PDF files, pdf-lib extracts metadata and page count. For other formats (RAR, 7z, GZIP, TAR, ISO, DMG, Ogg, Matroska), the tool identifies the format by its signature and displays header analysis. All processing happens locally in your browser - no data is uploaded to any server.

Why Use Our Container Format Detector?

Multi-Format Container Detection

Automatically identifies 12+ container file formats by reading the file header (magic bytes): ZIP, RAR, 7z, GZIP, BZ2, XZ, TAR, PDF, OLE2 (old Office), RIFF (WAV/AVI/WebP), Matroska (MKV/WebM), Ogg, ISO, DMG, and more. Each detection includes the format name, MIME type, category, and technical description. No need to know the file type beforehand - just upload and let the tool figure it out.

In-Depth Content Listing Without Extraction

For ZIP-based files (ZIP, DOCX, XLSX, PPTX, JAR, APK, EPUB, ODT), the tool uses client-side JSZip to list all entries with file names, compressed and uncompressed sizes, compression ratios, and modification dates. For PDF files, it extracts page count, PDF version, and metadata. For all formats, the header bytes are analyzed and displayed in a hex viewer with annotated structure breakdown.

Smart Compound Format Differentiation

Many container formats share the same underlying structure (e.g., ZIP, DOCX, JAR, APK all start with PK). The tool intelligently distinguishes between these by checking for format-specific identifiers within the file - [Content_Types].xml for Office documents, META-INF/MANIFEST.MF for JAR files, AndroidManifest.xml for APK files, and mimetype for EPUB. Results are clearly labeled with the specific format name.

100% Private Browser-Based Processing

All file analysis happens entirely in your browser using the FileReader API and client-side libraries (JSZip for ZIP parsing, pdf-lib for PDF analysis). Files are read locally and never uploaded to any server. Your files and analysis results stay completely private on your device. No signup, no account, no data collection, no usage limits.

Common Use Cases for Container Format Detector

Security Analysis of Suspicious Files

Security analysts can quickly inspect the contents of suspicious archive files without extracting them to disk. Determine if a ZIP file contains executable files, scripts, or other potentially malicious content before opening it. The tool shows all entry names, sizes, and types - helping identify hidden payloads in otherwise innocent-looking archive files.

Software & Package Inspection

Developers and system administrators can inspect the internal structure of JAR files (Java applications), APK files (Android apps), and EPUB files (eBooks). Verify that package contents match expectations, check for unexpected files, and examine the manifest files that define the package structure - all without needing specialized tools.

Office Document Structure Analysis

Inspect the internal XML structure of Office Open XML documents (DOCX, XLSX, PPTX). See all the component files - document.xml, styles.xml, media files, and relationships - with their sizes. Useful for understanding how Office documents are structured, debugging document corruption issues, and verifying document content for forensic analysis.

Malware Payload Detection in Archives

Malware is often distributed inside archive files (ZIP, RAR, 7z) to bypass security scanners. Our tool helps identify suspicious patterns: archives containing executable files with double extensions, scripts (JS, VBS, PS1) disguised as documents, password-protected archives hiding content, and archives with unusually large numbers of files that may indicate a malware payload.

Forensic Disk Image & Archive Analysis

Digital forensics investigators can quickly identify the container format of evidence files and inspect their contents. ISO disk images, DMG macOS disk images, and VHD virtual hard disks can be identified by their signatures. The tool provides a fast triage step before more detailed forensic analysis, helping investigators decide which tools to use next.

Digital Forensics & Cybersecurity Education

Students and educators can use our Container Format Detector to understand the structure of common container formats, learn how ZIP-based compound documents work, explore the PDF file format, and study how different formats store their content. A practical, hands-on tool for teaching file format analysis in cybersecurity and digital forensics courses.

Understanding Container File Formats

What Are Container File Formats?

Container file formats (or archive formats) are file formats that can hold multiple files, directories, and metadata within a single file. Think of them as a filing cabinet - the container is the cabinet itself, and the files inside are the documents stored in it. Common examples include ZIP archives (.zip), Office documents (.docx, .xlsx, .pptx), PDF files (.pdf), Java JAR files (.jar), Android APK packages (.apk), and eBook files (.epub). Container formats are essential for software distribution, document packaging, file compression, and data archival. Understanding their structure is crucial for security analysis, forensic investigation, and software development.

Common Container Format Categories

  • Compressed Archives (ZIP, RAR, 7z, GZIP, BZ2, XZ, TAR):Designed specifically for storing multiple files with compression. ZIP is the most widely supported, RAR offers advanced compression and recovery, 7z provides the best compression ratios, GZIP/BZ2/XZ typically compress single files, and TAR bundles files without compression (often combined with GZIP as .tar.gz).
  • Compound Documents (OLE2, Office Open XML, OpenDocument):Document formats that store content, styles, images, and metadata within a container. OLE2 (used by old .doc/.xls/.ppt files) is a proprietary Microsoft format. Modern Office Open XML (.docx, .xlsx, .pptx) and OpenDocument (.odt, .ods, .odp) are ZIP-based - meaning you can open them with any ZIP tool to see the XML files inside.
  • Multimedia Containers (RIFF, Matroska, Ogg, MP4, AVI):Designed to hold audio, video, subtitles, and metadata streams. RIFF is the container for WAV audio, AVI video, and WebP images. Matroska (MKV, WebM) is a flexible, open-standard container. Ogg is commonly used with Vorbis audio and Theora video codecs.
  • Application Packages (JAR, APK, APPX, DMG):Containers used for distributing software applications. JAR (Java ARchive) packages Java classes and resources. APK (Android Package) packages Android applications. DMG (Apple Disk Image) is used for distributing macOS software.
  • Disk Images (ISO, VHD, VMDK, DMG):Exact byte-for-byte copies of storage media. ISO images represent optical discs (CD/DVD/Blu-ray). VHD is Microsoft virtual hard disk format. VMDK is VMware virtual machine disk format. DMG is Apple disk image format.

How to Interpret Container Analysis Results

  1. Format Identification: The tool first identifies the container format by reading the file signature (magic bytes). This determines which analysis engine to use - ZIP-based files get content listing, PDF files get metadata extraction, and other formats get header analysis.
  2. Content Listing (ZIP-based): For ZIP, DOCX, XLSX, PPTX, JAR, APK, EPUB, and ODF formats, the tool lists every file stored inside the container. Each entry shows: file name and path, compressed size, uncompressed size, compression ratio, and modification date/time. The total number of files and overall compression ratio are summarized at the top.
  3. PDF Analysis: For PDF files, the tool reads the PDF header to determine the PDF version, extracts the catalog to count pages, and reads metadata embedded in the document information dictionary (title, author, subject, creator, producer, creation date, modification date).
  4. Header Analysis: For all formats, the tool displays the raw hex dump of the first 32 bytes alongside an ASCII interpretation and annotated structure breakdown that explains what each part of the header means.

Privacy, Limitations & Best Practices

Our Container Format Detector processes everything locally in your browser. Files are read using the FileReader API and analyzed client-side using JSZip (for ZIP-based content listing) and pdf-lib (for PDF metadata). No data is ever uploaded to any server. The tool is 100% free with no signup, no account, and no usage limits.

Important limitations: Content listing is only available for ZIP-based formats (ZIP, DOCX, XLSX, PPTX, JAR, APK, EPUB, ODT, ODS, ODP) and PDF files. For other container formats (RAR, 7z, GZIP, BZ2, XZ, TAR, ISO, DMG, VHD, VMDK), the tool can identify the format by magic bytes and show header details, but cannot list internal contents without third-party libraries. Password-protected ZIP archives cannot be listed without the password. Very large archives (over 100MB) may take several seconds to process.

Best practices: Use this tool for quick inspection of unfamiliar files, verifying archive contents, and security triage. For comprehensive analysis of password-protected or encrypted archives, use dedicated forensic tools with decryption capabilities.

Related Tools

Steganography Detector

Upload an image to detect potential hidden data using LSB (Least Significant Bit) steganography analysis. Analyzes pixel-level modifications, shows a heatmap of altered pixels, detects statistical anomalies, and extracts hidden text messages if found. Compatible with standard LSB encoding and the STEG magic header format. All processing happens locally in your browser - free online steganography detector, no signup required.

Image File Size Analyzer

Upload any image to see a detailed binary-level breakdown of what contributes to its file size - pixel data, compression overhead, metadata (EXIF/IPTC/XMP), color profiles (ICC), and structural headers. Get prioritized optimization tips with estimated savings for web performance, mobile app optimization, and storage reduction. Supports JPEG, PNG, GIF, WebP, BMP, TIFF, AVIF, and HEIC - all processing runs locally in your browser, no server upload required. Free online image file size analyzer.

File Magic Byte Detector

Upload any file to instantly detect its true file type by reading the magic bytes (file signature / header). The tool bypasses incorrect file extensions and reveals the real format. Shows hex dump with matching signature bytes highlighted, ASCII interpretation, MIME type, file category, and extension match analysis. Supports over 120 file signatures across 16 categories: images, audio, video, documents, archives, executables, fonts, certificates, disk images, and more. All processing runs locally in your browser - free online File Magic Byte Detector, no signup required.

Image Clone Detector

Detect copy-move forgeries in images using pixel-block matching. Upload any image to find cloned/copied regions, view heatmap overlays showing the location and intensity of detected clones, and get confidence scores with region details. Three sensitivity presets for different detection needs. 100% private browser-based processing - free online Image Clone Detector.

Frequently Asked Questions About Container Format Detector

A container file format (or archive format) is a file format that can hold multiple files, directories, and metadata within a single file. Examples include ZIP archives, Office documents (DOCX, XLSX, PPTX), PDF files, JAR files, APK packages, and EPUB eBooks. Container formats are essential for software distribution, document packaging, file compression, and data archival. They use different internal structures - some are compressed archives, some are compound documents with XML content, and some are multimedia containers with audio/video streams.

Our tool can fully list the internal contents of all ZIP-based formats: regular ZIP archives (.zip), Office Open XML documents (.docx, .xlsx, .pptx), Java JAR files (.jar), Android APK packages (.apk), EPUB eBooks (.epub), OpenDocument files (.odt, .ods, .odp), and Visio drawings (.vsdx). For PDF files (.pdf), the tool extracts page count, PDF version, and metadata (title, author, subject). For other formats (RAR, 7z, GZIP, BZ2, XZ, TAR, ISO, DMG), we identify the format by magic bytes and show header analysis.

All ZIP-based formats share the same PK ZIP file header, so the tool uses additional checks to determine the specific format: Office documents (.docx, .xlsx, .pptx) contain a [Content_Types].xml file at the root. JAR files contain META-INF/MANIFEST.MF. APK files contain AndroidManifest.xml. EPUB files contain a mimetype file with "application/epub+zip". Regular ZIP archives lack these special files. The tool checks the file extension first, then verifies by looking for these format-specific identifiers within the archive listing.

No. The Container Format Detector is designed for inspection only - it lists the contents, sizes, and metadata of files inside a container but does not extract or decompress them. This is a security feature: you can inspect the contents of a suspicious archive without actually extracting potentially malicious files to your device. The tool reads file names and metadata only, not the actual file content. For safe extraction, use a dedicated archive utility with proper security precautions.

For PDF files, the tool extracts and displays: the PDF version (e.g., 1.4, 1.7, 2.0), the number of pages, the document information dictionary (title, author, subject, keywords, creator, producer, creation date, modification date), file size, and whether the PDF is linearized (optimized for fast web viewing). The PDF header bytes are also shown in hex format with structure annotations. All PDF parsing is done locally using pdf-lib.

RAR and 7z use proprietary compression algorithms and file structures that cannot be parsed by standard browser APIs or the libraries currently available in this project (JSZip, pdf-lib). While these formats can be detected by their magic bytes, listing their internal contents requires format-specific decompression libraries. For these formats, the tool shows the format identification, file signature, and any detectable header metadata. For full content listing, use dedicated archive utilities like 7-Zip, WinRAR, or Unix tar.

Absolutely. All file analysis happens entirely within your browser using the FileReader API. Files are read locally - for ZIP-based content listing, the file is processed entirely in memory using JSZip. For PDF analysis, pdf-lib reads the file locally. No data is ever uploaded to any server. Your files and analysis results stay completely private on your device. No signup, no account, no data collection.

Key limitations include: (1) Full content listing is only available for ZIP-based formats and PDF files. (2) Password-protected or encrypted ZIP archives cannot be analyzed without the password. (3) Very large files (over 100MB) may take significant time to process due to browser memory limitations. (4) Some compound formats (OLE2, old .doc/.xls) can be detected by their header but not fully listed. (5) The tool identifies the container format but does not scan the contents for malware - use a dedicated antivirus tool for security scanning. (6) Files with corrupted headers or truncated containers may not be analyzable.