sourcecodestack Team
Tools, guides & how-tos
Every file on your computer carries more information than its name suggests. The three-letter extension at the end of a filename — .jpg, .pdf, .docx — is nothing more than a hint to the operating system about which program should open the file. It is not a guarantee of what the file actually contains. Understanding what a file truly is, how big it really is, what encoding it uses, and what hidden metadata it carries is a skill that developers, security professionals, and power users reach for constantly. This guide walks you through every layer of file analysis, explains the underlying concepts, and shows you how a browser-based File Analyzer lets you do all of this privately — without uploading your data anywhere.
File extensions exist for convenience, not correctness. Any user can rename malware.exe to invoice.pdf and the file system will happily comply. Email attachments and downloaded files are common vectors for this kind of mislabeling, whether accidental or intentional.
Consider a few realistic scenarios:
.txt config dump to .json and wonders why their parser crashes.logo.png that is actually a WebP image their old editor cannot open..docx extension that is actually a ZIP archive containing executable payloads..dat extension.In every case, relying on the extension alone leads to confusion or risk. Proper file analysis looks inside the file, not at the label on the outside.
The most reliable way to detect a file’s true format is to read its magic bytes — the first few bytes of the file’s binary content that identify its format. These are also called file signatures or magic numbers.
Every major file format reserves specific byte sequences at known offsets (almost always the very beginning of the file) to declare its type. Here are some well-known examples:
| Format | Magic Bytes (hex) | Human-readable |
|---|---|---|
| JPEG image | FF D8 FF |
ÿØÿ |
| PNG image | 89 50 4E 47 0D 0A 1A 0A |
‰PNG.... |
| PDF document | 25 50 44 46 |
%PDF |
| ZIP archive | 50 4B 03 04 |
PK.. |
| GIF image | 47 49 46 38 |
GIF8 |
| WebP image | bytes 8–11 are 57 45 42 50 |
WEBP (inside a RIFF container) |
| MP4 video | bytes 4–7 are 66 74 79 70 |
ftyp |
| ELF executable (Linux) | 7F 45 4C 46 |
.ELF |
| Windows PE executable | 4D 5A |
MZ |
| SQLite database | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 |
SQLite format 3 |
A file analysis tool reads these bytes directly from the file’s binary content and compares them against a database of known signatures. This process is entirely independent of what the filename says. If the first two bytes are MZ, the file is a Windows executable regardless of whether it is named document.docx.
The ZIP signature (PK) is particularly important because many modern document formats — .docx, .xlsx, .pptx, .epub, .jar, .apk — are actually ZIP archives containing XML files and assets. A file analyzer that detects PK at the start will correctly report the container format; deeper analysis can then inspect the contents to determine whether it is a Word document, an Android app, or something else entirely.
On the web, file types are communicated through MIME types (Multipurpose Internet Mail Extensions). Originally designed for email attachments, MIME types became the universal language for describing content types in HTTP responses, form uploads, and APIs.
A MIME type has the form type/subtype, optionally followed by parameters:
image/jpeg
text/html; charset=utf-8
application/json
application/vnd.openxmlformats-officedocument.wordprocessingml.document
audio/mpeg
video/mp4The top-level type groups broad categories: text, image, audio, video, application, font, multipart. The subtype identifies the specific format.
When a browser uploads a file through a form or the File API, it reports a MIME type. However, browsers derive this MIME type primarily from the file extension — not from the file’s actual content. This means the MIME type reported by the browser during an upload can be wrong or spoofed just as easily as an extension.
Server-side validation must never trust the client-supplied MIME type. The correct approach is to inspect the file’s magic bytes on the server after upload. Many security vulnerabilities arise from developers checking Content-Type headers or extension lists without verifying actual file content.
A good file analyzer reports both: the MIME type that would be inferred from the extension, and the MIME type detected from the file’s actual binary signature. When these two differ, you have found a mismatch worth investigating.
Beyond the file format itself, files carry embedded metadata — structured data that describes the content rather than being the content itself.
JPEG, TIFF, and many other image formats support EXIF (Exchangeable Image File Format) metadata. This is a block of structured data embedded inside the image file that can contain:
EXIF GPS data is the most privacy-sensitive piece. A photo taken on a smartphone and shared online may contain the precise GPS coordinates of your home, office, or any other location. Many social networks strip EXIF data on upload for exactly this reason, but files shared through messaging apps, email, or direct file transfer often preserve it entirely.
For developers, EXIF orientation is a common source of bugs. A photo taken in portrait mode on an iPhone may have its pixels stored in landscape orientation with an EXIF orientation tag of 6 (rotate 90° clockwise). CSS and the <img> tag handle this automatically in modern browsers, but canvas operations and server-side image processing often ignore it, resulting in rotated images.
Office documents (Word, Excel, PowerPoint) and PDFs embed document properties that can reveal:
Legal and journalism contexts pay close attention to document properties. A document submitted as evidence that claims to have been written on one date but shows an EXIF or document creation timestamp from a different date is a red flag for fabrication. Consulting firms and journalists routinely scrub document metadata before sharing drafts externally.
MP3 files carry ID3 tags containing track title, artist, album, year, genre, cover art, and lyrics. Video files carry container-level metadata in MP4, MKV, or AVI structures. Both can include encoding software details, recording device information, and creation timestamps.
File size analysis serves several practical purposes:
Detecting truncation. If you download a file that was supposed to be 45 MB but arrives as 12 MB, the download was interrupted. Comparing the actual byte count against an expected size (from a manifest, a Content-Length header, or a checksum file) catches truncated transfers.
Identifying padding and bloat. Some files grow over time due to accumulated undo history, embedded thumbnails, or fragmented internal structures. A PDF that should be a few kilobytes but is several megabytes may contain embedded fonts, redundant objects, or hidden layers.
Capacity planning. Developers building upload features need to understand size distributions of the files their users actually upload. Checking file sizes across a sample set is basic due diligence before setting upload limits.
Detecting stuffed files. A file that reports a small size via metadata but has a much larger actual byte count may have data appended after the nominal end-of-file marker. Some steganographic techniques and malware delivery methods exploit this.
Text files add another dimension: character encoding. A .txt or .csv file does not inherently declare its encoding. The same byte sequence 0xE9 means é in Latin-1 (ISO-8859-1) but is part of a multi-byte sequence in UTF-8, and means something entirely different in Windows-1252.
Mismatched encoding is one of the most common causes of garbled text (the infamous “mojibake” of question marks, boxes, or scrambled characters). File analysis tools use heuristics — statistical analysis of byte patterns — to guess the encoding. Common encodings to detect include:
FF FE or FE FFEF BB BF at the start; common in files generated by Windows toolsDetecting encoding is probabilistic, not deterministic, unless a BOM is present. The standard approach is to attempt UTF-8 decoding and check for invalid byte sequences; if they appear, fall back through a priority list of encodings while tracking statistical likelihood.
Before opening a file received from an unknown source, running it through a file analyzer gives you a quick sanity check. Does the magic byte match the extension? A file named resume.pdf whose first bytes are MZ (Windows executable) is almost certainly malicious. A .jpg file whose magic bytes indicate a ZIP archive might be concealing a polyglot file — one that is simultaneously valid as both formats.
Polyglot files are a known attack vector. A carefully crafted file can be interpreted differently by different parsers. A JPEG/ZIP polyglot looks like an image to one parser and a ZIP archive to another. By inspecting magic bytes and cross-referencing with the declared extension and MIME type, you catch these mismatches before they cause harm.
When building file upload features, things go wrong in predictable ways:
.pdf extension.A file analyzer lets you inspect each of these properties before you touch the server side, narrowing the search space for debugging.
Digital forensics relies heavily on file signature analysis. Disk recovery tools scan raw binary data looking for known file signatures to reconstruct files even when the file system metadata is lost. Incident responders examine magic bytes to find hidden executables masquerading as media files.
Journalists and researchers verifying document authenticity check creation timestamps, author metadata, and software fields. A document claimed to have been written in 1995 but whose properties list Microsoft Word 2019 as the creating application has a credibility problem.
APIs that accept file uploads need to determine how to process them. Rather than trusting the Content-Type header, robust APIs read magic bytes and validate that the file is what the client claims. A file analyzer tool can help developers understand exactly what their files look like from the binary perspective before writing server-side validation logic.
Most online file analysis services work by uploading your file to their servers. This creates real problems:
A browser-based File Analyzer does all analysis locally using the JavaScript File API and FileReader API. The file bytes are read directly into memory in your browser tab. Nothing is transmitted over the network. The analysis — magic byte inspection, MIME type detection, EXIF parsing, encoding detection, size calculation — all runs in your browser’s JavaScript engine. When you close the tab, the data is gone.
This local-first approach means you can safely analyze sensitive files — a contract PDF, a medical image, a confidential spreadsheet — without any risk of exposure.
A comprehensive file analysis report covers:
The combination of all these fields gives you a complete picture of a file’s identity, provenance, and content — far richer than any filename ever could.
Files are not what their names say they are. Extensions are user-friendly labels, not technical guarantees. The true identity of a file lies in its binary content — specifically in its magic bytes, its embedded metadata, its encoding, and its size. Understanding how to read these properties is fundamental for developers debugging upload pipelines, security professionals evaluating suspicious files, and anyone who needs to verify document authenticity.
The best way to perform this analysis is locally, in your browser, with no data leaving your machine. A privacy-first File Analyzer gives you all the information you need — magic bytes, MIME types, EXIF data, document properties, encoding, and hash values — instantly and safely. Give it a try the next time a file does not behave the way its extension suggests.
sourcecodestack Team
We build free, privacy-first browser tools and write practical guides on how to use them. Everything runs on your device — no uploads, no sign-ups.
A site will not load. Before you clear your cache, reboot the router, or file an angry support ticket, answer …
You have two JSON payloads — maybe a staging API response and a production one, or a config file before and af…
API Client Guide: Test APIs Online Without Postman Testing an API should be fast and frictionless. You have an…