File Size Anomaly Detector

A file size anomaly occurs when a file is significantly smaller or larger than typical files of the same type. This matters because anomalies often indicate underlying issues: an unusually small file may be corrupted, truncated during transfer, or a malicious placeholder; an unusually large file may contain hidden embedded data, steganographic content, or padding added by malware to evade detection. Detecting these anomalies early can prevent data loss and security incidents.

The tool uses a comprehensive database of 80+ file formats with typical size ranges derived from industry standards and common usage patterns. Each format entry includes a minimum expected size, maximum expected size, and average size. For example, JPEG photos typically range from 5 KB to 20 MB, while PDF documents range from 5 KB to 500 MB. The database covers images, audio, video, documents, spreadsheets, presentations, archives, executables, fonts, certificates, email files, databases, and source code.

Safe (green): File size is within the normal expected range. Low (yellow): File size is slightly outside the typical range - may still be legitimate but worth a quick check. Medium (orange): File size is notably anomalous - investigate further if the file is from an untrusted source. High (red): File size is extremely anomalous (more than 200% above max or 90% below min) - this strongly suggests corruption, tampering, or hidden content.

If a file has no extension, the tool relies entirely on magic bytes (the first bytes of the file content) to detect its true format. The tool reads the first 32 bytes and matches them against 45+ known file signatures. If a match is found, it uses the detected format for size comparison. If no signature matches, the tool reports that the file type could not be identified and notes that size analysis is unavailable.

Yes. Some legitimate files may fall outside the typical range for good reasons. A PDF with hundreds of embedded high-resolution images can be much larger than average. A text log file with millions of entries can be gigabytes. A minimalist icon file can be extremely small. The tool flags these as anomalies, but the final determination depends on context. The recommendations help you decide whether to investigate further.

Every file format begins with a unique byte sequence called a magic number or signature. The tool reads the first 32 bytes of the uploaded file and compares them against a database of 45+ known signatures. For example, JPEG files start with FF D8 FF, PDFs start with 25 50 44 46, ZIP archives start with 50 4B 03 04, and PNG images start with 89 50 4E 47. If the extension and magic bytes disagree, the tool highlights the mismatch.

If a file is flagged as suspicious: (1) Verify the file source - was it downloaded from an official website or received from a trusted sender? (2) Try opening the file with the appropriate application to check if it is functional. (3) Scan the file with antivirus software. (4) Re-download or re-request the file from the original source. (5) If the file is from an unknown source and flagged as highly anomalous, do not open it - delete it and run a security scan.

Absolutely not. Only the file name, size, and the first 32 bytes (magic bytes) are read for analysis - and all processing happens entirely within your browser. No data is transmitted, stored, or logged. Your full file content is never accessed beyond the 32-byte header. When you close or refresh the page, all data is discarded. This means you can safely analyze even the most sensitive files.

The visualization uses a logarithmic scale to display file sizes ranging from bytes to gigabytes. The bar shows three reference points: minimum typical size, average typical size, and maximum typical size for the detected file type. Your file position is plotted on this scale. A file within the green zone is normal. A file extending into the orange or red zone is anomalously large. A file not reaching the minimum marker is anomalously small.

The tool supports 80+ file formats across 15 categories: images (JPEG, PNG, GIF, WebP, BMP, TIFF, SVG, ICO, AVIF, HEIC, RAW, PSD, EPS), audio (MP3, WAV, FLAC, AAC, OGG, WMA, M4A), video (MP4, AVI, MKV, MOV, WMV, FLV, WebM), documents (PDF, DOC, DOCX, RTF, TXT, MD), spreadsheets (XLS, XLSX, CSV), presentations (PPT, PPTX), archives (ZIP, RAR, 7z, TAR, GZ, BZ2, XZ), executables (EXE, DLL, MSI, APK), disk images (DMG, ISO, IMG), email (EML, MSG, PST), fonts (TTF, OTF, WOFF, WOFF2), certificates (CER, CRT, PEM, P12), databases (SQLite, DB, MDB), and source code/config files (HTML, CSS, JS, TS, JSON, XML, YAML, INI, TOML).