File Header / Magic Bytes
The first few bytes of a file that identify its format — used by applications to verify file type independent of the file extension.
Last updated
What Are Magic Bytes?
Magic bytes (or file signature) are a fixed sequence of bytes at the beginning of a file that identify its format. Applications use these to verify a file's type independently of its name or extension.
Why They Matter
File extensions can be wrong — accidentally or intentionally renamed, corrupted, or missing. Magic bytes cannot be faked without corrupting the file. Applications that verify magic bytes are more reliable and more resistant to certain classes of security vulnerabilities.
Common Magic Bytes
| Format | Extension | Magic Bytes (hex) | ASCII |
|---|---|---|---|
25 50 44 46 | %PDF | ||
| JPEG | .jpg | FF D8 FF | ÿØÿ |
| PNG | .png | 89 50 4E 47 0D 0A 1A 0A | `‰PNG |
| ` | |||
| GIF | .gif | 47 49 46 38 | GIF8 |
| ZIP | .zip | 50 4B 03 04 | PK |
| DOCX/XLSX | .docx | 50 4B 03 04 | PK (same as ZIP) |
| MP4 | .mp4 | 66 74 79 70 at offset 4 | ftyp |
| MP3 | .mp3 | FF FB or 49 44 33 | ID3 |
How to Inspect Magic Bytes
Open a file in a hex editor (HxD on Windows, Hex Fiend on macOS, or any online hex viewer). The first bytes should match the expected signature for the file's claimed format.
Relevance to File Corruption
If a file's magic bytes are corrupted or missing, most applications will refuse to open it with an error like "not a valid PDF" or "unknown file format" — even if only the first few bytes are damaged and the rest of the file is intact. This is one case where a repair tool can reconstruct the header and restore accessibility.