Many formats begin with characteristic bytes. This tool decodes pasted hex or base64 and compares bytes at offset zero with a small, explicit signature table.
A signature is only a hint. Matching a PNG or ZIP header does not prove the remaining structures are complete, the extension is honest, or opening the file is safe.
Detection stays in the browser. tryb does not upload, open, decompress, or execute the bytes, and reports container signatures without inventing claims about embedded content.
Edge cases worth knowing
- Wildcard fields
- WebP and MP4 headers contain variable fields. Only documented variable positions are treated as wildcards.
- Short prefixes
- A header-only sample can suggest a type but cannot establish that the rest of the file exists or is valid.
- Hex versus base64
- Both encodings are accepted when unambiguous; an explicit 0x prefix is removed before matching.
Common mistakes
- Treating a signature match as complete file validation.
- Trusting a filename extension at a security boundary.
- Assuming a container signature identifies every embedded codec or entry.
- Opening an untrusted file merely because its header looks normal.