File Type Detector (Magic Bytes)

Drop a file and the first 512 bytes are read in the browser and matched against a table of about thirty-five signatures — PNG, JPEG, GIF, WebP, TIFF, PDF, ZIP, GZIP, XZ, 7z, RAR, TAR, MP3, FLAC, WAV, OGG, MP4, MKV, WOFF2, ELF, PE, SQLite and others. The detected type is then compared against the MIME type the browser reported, which the operating system almost always derived from the extension, and any disagreement is flagged. A declared type built on the detected container — a DOCX against ZIP, WebM against Matroska, MOV or M4A against MP4 — counts as a match rather than a mismatch.

Signatures are not always at the start, and the table accounts for that. A TAR archive has nothing identifiable in its first bytes at all — its ustar marker sits at offset 257, inside the first file's header block. RIFF containers put four bytes of length between the magic and the form type, so WAV and WebP both read as RIFF????WAVE and RIFF????WEBP with wildcards in the middle. PNG's eight-byte signature is worth a look for its own sake: the leading 0x89 fails immediately if something stripped the high bit, the \r\n and the trailing \n detect line-ending translation by a transfer in text mode, and the 0x1A in the middle is a DOS end-of-file so that printing the file to a terminal stops rather than scrolling forever. Every byte in it is a specific test.

The honest limit is containers. DOCX, XLSX, PPTX, ODT, EPUB, JAR and APK are all ZIP archives, so they all begin PK\x03\x04 and magic bytes alone cannot tell them apart — you have to open the archive and look at what is inside. Plain-text formats have no signature to find: CSV, JSON, HTML, SVG and source code are all just text, and a detector that reports nothing for them is correct rather than broken.

Knowing the real type is not the same as knowing a file is safe. A file can be a genuine, valid PNG and still be crafted to exploit a bug in whatever decodes it, and polyglot files — valid as two formats at once — have been used to slip past exactly this kind of check. Use the result to catch a mislabelled download or a renamed extension, and keep whatever validation the consuming code already does. Nothing is uploaded; the read happens on your machine.