File Type

What it's for

Find out what a file really is from the bytes inside it, as the file command does, rather than trusting its name. Each file gets a type in words, its MIME type (the label web servers and email use, such as image/png), the extension it usually has, and whether its own extension matches.

When you’re…

• given a file with no extension, or the wrong one, and need to know what opens it;
• checking uploads or attachments for a file renamed to look like something else, such as a program called .pdf;
• setting the Content-Type a server should send for a file.

How to use it

Choose one or more files, or drop them on the page (a picture can also be pasted). Each one gets a row in the table.

The type comes from the file’s signature (the “magic number” in its first few bytes) for binary formats such as pictures, audio, video, fonts, archives and programs. Text files are recognised from how they start: scripts by their #! line, XML by its first element (so SVG, RSS, property lists and GPX are told apart), and JSON by parsing it. ZIP files are opened to look at their list of contents, which tells Word, Excel and PowerPoint documents, OpenDocument files, EPUB books, Java archives, Android and iOS apps, iWork documents and SCORM packages apart from plain ZIPs.

Under each type is the reason for it: the signature bytes found and where, the line or element a text file starts with, or the file inside a ZIP that gave it away. A two-byte signature is marked as one that can turn up by chance, so you can weigh a doubtful result.

Type from the name is the type your browser gives the file from its extension alone, for comparison. Name matches is No when the extension isn’t one that type usually has, and blank when the file has no extension or the type has no usual one.

Example

Copy any PNG picture and rename the copy notes.txt, then choose it here.

The row shows PNG image, found from the bytes 89 50 4E 47 at the start, then image/png and .png, while the type from the name is text/plain, and Name matches says No.

Good to know

Plain text has no signature, so text that isn’t one of the recognised formats is shown as text, and CSV, Markdown and source code without a #! line all look the same. Some formats share a signature: a Mach-O universal binary and a Java class file both start CAFEBABE, and old Office files (.doc, .xls, .ppt, .msg) share one too. ZIPs over 512 MB, and ZIP64 archives, are shown as plain ZIPs. A file that matches its extension can still be harmful: this checks what a file is, not whether it’s safe.