What is this file?

A file with no extension, the wrong extension, or a name like data.bin. Or a block of text from a log that’s clearly something encoded. These tools work out what you’ve got from what’s inside it, not from its name. Files are read in your browser and never uploaded.

1. Find its type

Drop the file on File Type. It reads the signature in the first few bytes, as the file command does, and gives the type, its MIME type and the extension it usually has, with the reason: the bytes it found and where. ZIPs are opened to tell Word, Excel and PowerPoint documents, EPUB books, apps and SCORM packages from plain archives. Name matches: No means the extension is wrong, or the file is pretending.

If it says ZIP, or an archive such as a Word document or an app, open it in the ZIP Viewer & Maker to list what’s inside, with sizes and dates, and to View a text file or picture or Save just one, without unpacking the rest. An unfamiliar .livp file is an iPhone Live Photo as iCloud for Windows downloads it, which is a ZIP holding a picture and a short video: LIVP Live Photo Opener saves the two as ordinary files. The picture is usually HEIC, which most browsers can’t show, though the file saves normally.

2. Look inside

If File Type says Unknown binary data, or only text, open the file in the Hex Viewer. Analyse the whole file gives three useful things:

• Entropy: near 8 bits per byte means compressed or encrypted. Lower means text or a structured format.
• Strings: every run of readable text with its offset, as the strings command gives. Names, paths and messages often show what made the file.
• Files inside it: other files’ signatures part-way through, such as a ZIP added after a picture.

Type an offset it reports into Go to offset to look at that place.

3. Check it’s the file you were meant to get

If the file came from a download page that publishes a checksum, choose it in Hash / Checksum and paste the published value into Expected hash. The tool says which algorithm matches, or that none does. A mismatch means the download is damaged or isn’t the file it claims to be.

4. Unpack it

High entropy and a start of 1F 8B (gzip) or 78 (zlib) means compressed data. Drop the file on Compress / Decompress, or paste the data as Base64 or hex, and it’s unpacked; anything else is tried as raw deflate.

Two kinds of data file need a reader of their own. If File Type says Parquet data (it starts and ends with PAR1), open it in the Parquet Viewer to see its columns and rows and save them as CSV. A small file with no signature, a .pb, .cbor or .msgpack name, or bytes that look like field numbers and short text in the Hex Viewer may be Protobuf, CBOR or MessagePack: choose it in the Binary Data Decoder.

5. If it’s text, not a file

For a string of letters and digits from a log, a URL or a config file, paste it into Identify. It recognises Base64, hex, URL-encoding, JWTs, hashes, UUIDs, timestamps and many ciphers, shows what each guess decodes to, and links to the tool that handles it.