Test files › Images
Sample Images test files
Free images test files for QA and developers: bmp-24bit.bmp, fake-jpeg-is-executable.jpg, favicon.ico, gif-animated.gif, gif-static.gif, jpeg-baseline.jpg and more. Each with a published SHA-256 and a note on what it catches.
| File | Format | Size | What it catches |
bmp-24bit.bmp | BMP | 48.1 KB | 128x128 uncompressed 24-bit BMP with bottom-up row order. |
fake-jpeg-is-executable.jpg | JPEG (spoofed) | 2.1 KB | A file named .jpg whose magic bytes are the DOS/PE "MZ" signature. Contains no executable code - just the header and filler. |
favicon.ico | ICO | 145 bytes | A 32x32 Windows ICO wrapping a PNG image (the modern ICO form). |
gif-animated.gif | GIF | 2.4 KB | A looping animated GIF: four frames, 200 ms each, with a NETSCAPE2.0 loop block. |
gif-static.gif | GIF | 774 bytes | 128x128 static GIF with a 4-colour palette and real LZW compression. |
jpeg-baseline.jpg | JPEG | 2.8 KB | 256x256 baseline JPEG, 4:2:0 chroma subsampling, quality ~85, encoded from source. |
jpeg-tiny-16px.jpg | JPEG | 774 bytes | 16x16 baseline JPEG - exactly one minimum coded unit. |
no-extension | PNG (no extension) | 183 bytes | A genuinely valid PNG with no file extension at all. |
png-1x1.png | PNG | 70 bytes | Single opaque pixel. The smallest valid PNG this corpus produces. |
png-8000x8000.png | PNG | 259 KB | 8000x8000 PNG of flat colour. Compresses to a few hundred KB but expands to roughly 256 MB in memory. |
png-alpha-gradient.png | PNG | 2.2 KB | 256x256 PNG with a horizontal alpha ramp from fully transparent to fully opaque. |
png-bad-crc.png | PNG | 1.3 KB | Structurally complete PNG with a single corrupted byte inside the IDAT chunk CRC. |
png-interlaced.png | PNG | 426 bytes | PNG with the Adam7 interlace flag set in IHDR. Note: pixel data is stored non-interlaced, so strict decoders will reject it - that is intentional. |
png-truncated.png | PNG | 719 bytes | Valid PNG header and partial IDAT, cut off before IEND. |
png-valid-256.png | PNG | 1.3 KB | 256x256 RGBA checkerboard, non-interlaced, 8-bit. |
svg-external-entity.svg | SVG | 273 bytes | SVG with a DOCTYPE declaring an external entity pointing at a local file path. |
svg-plain.svg | SVG | 303 bytes | Clean SVG with shapes and text, no scripts or external references. |
svg-with-script.svg | SVG | 457 bytes | SVG containing an inline <script> block and an onload attribute. The payload only calls console.log and sets document.title - it is inert and does not exfiltrate anything. |