file signature checker
Drop in a file and see what its first bytes say it is, next to what its name claims. It also checks the structure for the problems that get past an extension check: a truncated PDF, a ZIP whose entries escape the extraction folder, a GIF that is also a web page, a name that hides its real extension. The file is read in your browser and never uploaded.
Runs in your browser: nothing is uploadedWhy the extension is not enough
An extension is part of the name, and anyone can rename a file. Most formats start with a fixed
sequence of bytes, a signature or magic number: every PNG begins
89 50 4E 47, every PDF begins %PDF-. Reading those bytes tells you what a file is.
The type your browser reports comes from the name, so an upload form that trusts it is trusting the attacker.
What it checks beyond the signature
A matching signature only proves the first few bytes. The inspector also reads the end of the file
and the structures in between: whether a PDF ends in %%EOF and its cross-reference offset is real,
whether PNG chunks pass their CRC, whether a WAV or SQLite header promises more data than exists, whether a ZIP's
entries climb out with ../ or expand a thousand-fold, whether an EPUB's container points at a file
that is missing, and whether an image also carries HTML or script. For the file name it flags double extensions
like report.pdf.exe and invisible right-to-left characters that reverse how a name displays.
What it cannot tell you
Text formats such as CSV, JSON and YAML have no signature, so it can only judge them by their content. A file can be well-formed and still malicious, and a clean result is not a virus scan. Use it to check that a file is what it claims before your code decides how to handle it.
Questions
Is my file uploaded?
No. The page reads the first and last 64 KB with the browser's File API and inspects them in the page. Nothing is sent to a server.
What is a file signature?
A fixed sequence of bytes at a known position, usually the start, that identifies the format. PNG files begin 89 50 4E 47 0D 0A 1A 0A, ZIP files begin 50 4B 03 04, PDFs begin %PDF-. Unlike the extension, it does not change when the file is renamed.
Why does a DOCX show up as a ZIP?
Because it is one. DOCX, XLSX, PPTX, EPUB, ODT and JAR are all ZIP archives with particular files inside. The inspector reads the entry names to tell them apart, and flags an Office file that is missing its [Content_Types].xml.
Can it detect malware?
No. It detects disguises and structural damage: an executable named .jpg, a polyglot image, a zip slip archive. A file can pass every check and still be malicious. Scan uploads with an antivirus engine as well.
Which formats does it recognise?
Over 90 by signature or content, including images, audio, video, archives, Office and OpenDocument files, PDFs, fonts, databases, executables and the common text formats.