File signature reference (magic numbers)

How to read this table

The hex signature is the sequence of bytes to look for. A pair of question marks (??) means any byte can appear in that position, which is common for RIFF formats like WebP and WAV that embed a size field early on. The offset is how many bytes from the start of the file the signature begins, so an offset of 0 means the very first byte. A few formats, like tar and ISO images, place their marker well into the file.

The ASCII column shows what those same bytes look like as text, which is what you see in the right-hand pane of a hex editor. Many signatures are deliberately readable: 50 4B is PK for Phil Katz of PKZIP, 25 50 44 46 2D is %PDF-, and 66 74 79 70 is ftyp in every MP4-family file. A dot stands for a byte that has no printable character, and a question mark for a wildcard.

Many modern formats are actually ZIP archives underneath, including DOCX, XLSX, PPTX, EPUB, APK and JAR. They all share the ZIP signature 50 4B 03 04, so the extension and internal structure decide which one it is.

Reuse this dataset

The table, the JSON export and the per-signature breakdowns are published under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. You may copy it, adapt it and republish it, including commercially, provided you credit WhatFileType, https://whatfiletype.com and link back to this page. No permission request, no key, no fee.

There are three ways to take it, depending on what you are building.

• Embed the live table. One iframe, self-contained, with its own filter box and the attribution built in. It stays current as signatures are added.
• Download the JSON. /api/signatures returns every signature with its hex, offset, ASCII rendering, trailer where one exists, the formats that share it and a link to its page, plus the licence and attribution string in the payload itself.
• Copy the table. Republishing the rows in your own layout is fine under the same licence, as long as the credit and the link are there.

Copy the embed code

<iframe
  src="https://whatfiletype.com/widget/signatures"
  title="File signatures (magic numbers) reference by WhatFileType"
  width="100%"
  height="560"
  style="border:0;"
  loading="lazy"
></iframe>
<p><a href="https://whatfiletype.com/magic-numbers">File signature reference</a> by WhatFileType, CC BY 4.0</p>

The credit line under the frame is the part that matters. The frame itself carries a visible link too, but a link outside the iframe is what a reader can follow and what a crawler can see. More embed options are on the embed page.

Where the data comes from

Each of the 111 signatures was checked against a published source before it went in, and every signature page lists the sources for that entry. Across the corpus that comes to 33 distinct sources: format specifications where the format has one, and the cross-format signature lists for the many older and abandoned formats that never had a public specification, or whose specification is no longer reachable. Most of the corpus rests on the latter, so check the source line on the individual page before you quote a figure. 11 of the signatures sit at a non-zero offset and 3 carry a fixed marker at the end of the file, both taken from the same sources rather than assumed. Of those 3, only 1 has no header magic at all and is genuinely identified by its trailer: the Apple disk image. PDF and Parquet open with a header and close with an end marker as well, which is a different thing, and this reference says so on each page rather than calling all three trailer formats.

Formats with no reliable fixed signature are deliberately absent. Plain-text formats and headerless binaries whose meaning depends entirely on the producing program are logged as having no signature instead of being given a plausible-looking one, which is the main thing that separates this list from the copies of copies that circulate online. Here is that log in full, 63 extensions this reference will not give you a magic number for, because there is not an honest one to give.

Three kinds of thing end up here. Plain text is the largest: a .json, .csv, .md or .sh file is just characters, so there is nothing fixed to match beyond an optional byte order mark. Then come headerless binaries and catch-all names such as .dat, .bin and .tmp, where the bytes mean whatever the program that wrote them decided. Last are closed formats such as .fig and .afdesign, which certainly have a fixed header but no published one we were willing to cite. If you have seen a citable specification for any of these, the table should carry it.

• Wikipedia: List of file signatures (94 signatures)
• GCK file signature table (Gary Kessler, hosted by SEARCH) (5 signatures)
• 7z archive format notes (py7zr, a third-party Python implementation) (1 signature)
• Apache Arrow IPC format (1 signature)
• Apache Avro specification (1 signature)
• Apache Parquet file format (1 signature)
• Apple property list format (1 signature)
• DSF File Format Specification (Sony Corporation, PDF rehosted by dsd-guide.com) (1 signature)
• Esri Shapefile Technical Description (1 signature)
• FBX binary file format, reverse-engineered notes (code.blender.org developer blog, 2013) (1 signature)
• FITS standard (NASA) (1 signature)
• GGUF specification (ggml) (1 signature)
• HDF5 File Format Specification Version 3.0 (The HDF Group) (1 signature)
• Hydrogenaudio Knowledgebase (community wiki): TTA (1 signature)
• ISO 32000-1:2008, PDF 1.7 (Adobe published copy) (1 signature)
• JPEG XL (jpeg.org) (1 signature)
• Library of Congress: WordPerfect document (1 signature)
• MAT-file versions (MathWorks) (1 signature)
• Microsoft [MS-ONESTORE]: OneNote file format, file-type GUID (1 signature)
• NetCDF file format (1 signature)
• NumPy .npy format (1 signature)
• PCX format (Encyclopedia of Graphics File Formats) (1 signature)
• PKWARE .ZIP APPNOTE (format spec) (1 signature)
• PNG Specification (W3C), file signature (1 signature)
• RFC 1952: GZIP file format specification 4.3 (1 signature)
• SQLite database file format (1 signature)
• True Audio codec project (SourceForge) (1 signature)
• Unicode FAQ: UTF-8, UTF-16, UTF-32 and BOM (1 signature)
• W3C: Extensible Markup Language (XML) 1.0, prolog (1 signature)
• W3C: Scalable Vector Graphics (SVG) 2, conforming documents (1 signature)
• Wikipedia: Shapefile (1 signature)
• Wikipedia: StuffIt (1 signature)
• xar project (archive format) (1 signature)

Frequently asked questions