File Extension Validator

Magic bytes (also called file signatures or magic numbers) are the first few bytes of a file that uniquely identify its format. These bytes are defined by file format specifications and are written by the software that creates the file. For example, every valid JPEG image starts with the bytes FF D8 FF, every PDF starts with 25 50 44 46 (which decodes to ASCII "%PDF"), and every PNG starts with an 8-byte signature 89 50 4E 47 0D 0A 1A 0A. Operating systems and applications use these signatures to determine how to open and process a file, regardless of its file extension.

• Accidental Mislabeling: Files may have incorrect extensions due to user error, incorrect save operations, or file conversion tools that don't update the extension. For example, saving a PNG image with a .jpg extension or a CSV file with a .txt extension. These are usually harmless but can cause confusion when opening files.
• Deliberate Disguise (Malware): Attackers frequently rename executable files (.exe, .scr, .bat, .js, .vbs) with innocent-looking extensions (.pdf, .doc, .jpg, .png) to trick users into opening them. When opened, the operating system sees the magic bytes and executes the file as its true type, potentially installing malware. This is one of the most common attack vectors in phishing campaigns.
• Ambiguous Formats: Some file formats share the same magic bytes. For instance, ZIP files (.zip), Office Open XML documents (.docx, .xlsx, .pptx), Java JAR files (.jar), and Android APK files (.apk) all start with the PK ZIP signature. These formats require additional analysis beyond the first few bytes to distinguish between them.
• Text-Based Formats: Text-based formats like HTML, XML, SVG, JSON, and JavaScript don't have fixed binary signatures - they start with text characters like <, {, or ". Detecting these formats requires content analysis beyond simple byte matching.

1. Extension Extraction: The tool parses the filename to extract the declared extension (the part after the last dot). Extensions are normalized to lowercase for comparison.
2. Signature Reading: The first 16-32 bytes of the file are read using the FileReader API with an ArrayBuffer. These bytes are converted to a hex string for pattern matching.
3. Database Matching: The hex signature is compared against our comprehensive database of 60+ known file signatures. Signatures are matched from most specific to least specific, including signatures with variable bytes (e.g., JPEG markers, RIFF format subtypes, ZIP-based compound formats).
4. Smart Format Detection: For ZIP-based formats (Office documents, JAR, APK), the tool checks for additional identifiers within the first few kilobytes to distinguish between different formats that share the ZIP header.
5. Comparison & Reporting: The detected format is compared against the declared extension. Results are presented with color-coded badges (match, mismatch, ambiguous, or unknown) along with security recommendations.

Our File Extension Validator processes everything locally in your browser. Files are read using the FileReader API - only the first few bytes are examined, and no data is ever sent to any server. The tool is 100% free with no signup, no account, and no usage limits.

Important limitations: Magic byte detection is not foolproof. Some file formats share signatures (ZIP-based formats), some have no fixed signature (plain text, HTML, XML), and files with corrupted or missing headers may not be detectable. Additionally, sophisticated attackers can prepend valid magic bytes to a malicious payload (polyglot files), though this technique is less common. For critical security applications, combine magic byte validation with other techniques including content inspection, MIME type checking, and antivirus scanning.

Best practices: Always validate file uploads on the server side using magic byte checking, not just file extension or MIME type verification. Combine with file size limits, content scanning, and allowlist-based extension filtering for comprehensive upload security.