File signature reference (magic numbers)
The hex bytes that identify 109 file formats. Sortable, searchable, one page per signature.
Every file format has a fingerprint: a short run of bytes near the start that identifies it no matter what the filename says. Developers call these magic numbers or file signatures. This table lists 109 of them with the byte offset where each appears. Click any format to open a full breakdown of that signature, or drop a file into the in-browser identifier to check one instantly.
| Hex signature | Used by | ||
|---|---|---|---|
| 3GP | 66 74 79 70 33 67 70 | 4 | .3gp |
| 7Z | 37 7A BC AF 27 1C | 0 | .7z, .cb7 |
| AAC (ADTS) | FF F1 | 0 | .aac |
| ACE | 2A 2A 41 43 45 2A 2A | 7 | .ace |
| AIFF | 46 4F 52 4D ?? ?? ?? ?? 41 49 46 46 | 0 | .aiff |
| AMR speech | 23 21 41 4D 52 | 0 | .amr |
| Apache Arrow / Feather | 41 52 52 4F 57 31 | 0 | .arrow |
| Apache Avro | 4F 62 6A 01 | 0 | .avro |
| Apache Parquet | 50 41 52 31 | 0 | .parquet |
| Apple Disk Image | 6B 6F 6C 79 | 0 | .dmg |
| ASF (WMV / WMA) | 30 26 B2 75 8E 66 CF 11 | 0 | .wmv, .wma, .asf |
| AutoCAD DWG | 41 43 31 30 | 0 | .dwg |
| AVI | 52 49 46 46 ?? ?? ?? ?? 41 56 49 20 | 0 | .avi |
| AVIF | 66 74 79 70 61 76 69 66 | 4 | .avif |
| Binary property list | 62 70 6C 69 73 74 30 30 | 0 | .plist |
| BitTorrent | 64 38 3A 61 6E 6E 6F 75 6E 63 65 | 0 | .torrent |
| Blender | 42 4C 45 4E 44 45 52 | 0 | .blend |
| BMP | 42 4D | 0 | .bmp |
| bzip2 | 42 5A 68 | 0 | .tar, BZ2, TBZ2 |
| Cabinet (CAB) | 4D 53 43 46 | 0 | .cab |
| Core Audio Format | 63 61 66 66 | 0 | .caf |
| DDS | 44 44 53 20 | 0 | .dds |
| Debian package | 21 3C 61 72 63 68 3E | 0 | .deb, AR, LIB |
| DjVu | 41 54 26 54 46 4F 52 4D | 0 | .djvu |
| Dolby Digital (AC-3) | 0B 77 | 0 | .ac3 |
| DSF (DSD audio) | 44 53 44 20 | 0 | .dsf |
| DTS surround | 7F FE 80 01 | 0 | .dts |
| ELF | 7F 45 4C 46 | 0 | SO, AXF, core |
| Enhanced Metafile | 20 45 4D 46 | 40 | .emf |
| FBX (binary) | 4B 61 79 64 61 72 61 20 46 42 58 20 42 69 6E 61 72 79 | 0 | .fbx |
| FITS (astronomy) | 53 49 4D 50 4C 45 | 0 | .fits |
| FLAC | 66 4C 61 43 | 0 | .flac |
| GGUF (local LLM) | 47 47 55 46 | 0 | .gguf |
| GIF | 47 49 46 38 | 0 | .gif |
| GIMP XCF | 67 69 6D 70 20 78 63 66 20 | 0 | .xcf |
| glTF (binary GLB) | 67 6C 54 46 | 0 | .gltf |
| gzip | 1F 8B | 0 | .tar, GZ, TGZ, SVGZ |
| HDF5 | 89 48 44 46 0D 0A 1A 0A | 0 | .hdf5 |
| HEIC | 66 74 79 70 68 65 69 63 | 4 | .heic, HEIF, HEIX |
| ICNS | 69 63 6E 73 | 0 | .icns |
| ICO | 00 00 01 00 | 0 | .ico |
| ISO 9660 | 43 44 30 30 31 | 32769 | .iso |
| Java class / Mach-O fat | CA FE BA BE | 0 | CLASS, Mach-O universal binary |
| JPEG | FF D8 FF | 0 | .jpg, .jfif |
| JPEG 2000 | 00 00 00 0C 6A 50 20 20 0D 0A 87 0A | 0 | .jp2 |
| JPEG XL | 00 00 00 0C 4A 58 4C 20 0D 0A 87 0A | 0 | .jxl |
| Mach-O | CF FA ED FE | 0 | dylib, bundle |
| MATLAB MAT-file | 4D 41 54 4C 41 42 20 35 2E 30 | 0 | .mat |
| Matroska / WebM | 1A 45 DF A3 | 0 | .mkv, .webm, .mka |
| MIDI | 4D 54 68 64 | 0 | .mid |
| Mobipocket | 42 4F 4F 4B 4D 4F 42 49 | 60 | .mobi, .azw |
| Monkey's Audio | 4D 41 43 20 | 0 | .ape |
| MOV | 66 74 79 70 71 74 20 20 | 4 | .mov |
| MP3 | 49 44 33 | 0 | .mp3 |
| MP4 | 66 74 79 70 | 4 | .mp4, .m4v, .m4b, .m4r, .f4v, M4A |
| MPEG-1/2 | 00 00 01 BA | 0 | .mpg, .vob |
| MXF | 06 0E 2B 34 02 05 01 01 0D 01 02 01 01 02 | 0 | .mxf |
| NetCDF (classic) | 43 44 46 01 | 0 | .nc |
| Netpbm (PPM/PGM/PBM) | 50 36 | 0 | .ppm |
| NumPy array | 93 4E 55 4D 50 59 | 0 | .npy |
| OGG | 4F 67 67 53 | 0 | .ogg, .opus, .ogv |
| OLE2 Compound File | D0 CF 11 E0 A1 B1 1A E1 | 0 | .doc, .xls, .ppt, .msi, .msg, .pub |
| OneNote | E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 | 0 | .one |
| OpenEXR | 76 2F 31 01 | 0 | .exr |
| OpenType | 4F 54 54 4F | 0 | .otf |
| PCAP capture | D4 C3 B2 A1 | 0 | .pcap |
| PCX | 0A | 0 | .pcx |
| 25 50 44 46 2D | 0 | .pdf, .ai | |
| PE (EXE / DLL) | 4D 5A | 0 | .exe, .dll, SYS, SCR, OCX |
| PLY (Stanford) | 70 6C 79 0A | 0 | .ply |
| PNG | 89 50 4E 47 0D 0A 1A 0A | 0 | .png, .apng |
| PostScript / EPS | 25 21 50 53 | 0 | .eps, .ps |
| PSD | 38 42 50 53 | 0 | .psd |
| QCOW2 (QEMU disk) | 51 46 49 FB | 0 | .qcow2 |
| Radiance HDR | 23 3F 52 41 44 49 41 4E 43 45 | 0 | .hdr |
| RAR | 52 61 72 21 1A 07 00 | 0 | .rar, .cbr |
| RealMedia | 2E 52 4D 46 | 0 | .rm |
| RPM package | ED AB EE DB | 0 | .rpm |
| RTF | 7B 5C 72 74 66 31 | 0 | .rtf |
| Shapefile | 00 00 27 0A | 0 | .shp |
| SPSS data file | 24 46 4C 32 | 0 | .sav |
| SQLite | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 | 0 | .sqlite, .db, .mbtiles |
| StuffIt | 53 49 54 21 00 | 0 | .sit |
| Sun audio (.snd) | 2E 73 6E 64 | 0 | .au |
| SVG | 3C 3F 78 6D 6C | 0 | .svg |
| TAR (ustar) | 75 73 74 61 72 | 257 | .tar, .cbt, .ova |
| TIFF | 49 49 2A 00 | 0 | .tiff, .dng, CR2, NEF, ARW |
| TrueType | 00 01 00 00 | 0 | .ttf |
| TrueType Collection | 74 74 63 66 | 0 | .ttc |
| TTA (True Audio) | 54 54 41 31 | 0 | .tta |
| Unix compress (.Z) | 1F 9D | 0 | .z |
| VHD (virtual disk) | 63 6F 6E 65 63 74 69 78 | 0 | .vhd |
| VHDX (Hyper-V disk) | 76 68 64 78 66 69 6C 65 | 0 | .vhdx |
| VMDK (VMware disk) | 4B 44 4D 56 | 0 | .vmdk |
| VRML | 23 56 52 4D 4C | 0 | .wrl |
| WAV | 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 | 0 | .wav |
| WavPack | 77 76 70 6B | 0 | .wv |
| WebAssembly | 00 61 73 6D | 0 | WASM |
| WebP | 52 49 46 46 ?? ?? ?? ?? 57 45 42 50 | 0 | .webp |
| WebVTT | 57 45 42 56 54 54 | 0 | .vtt |
| WIM | 4D 53 57 49 4D 00 00 00 | 0 | .wim, .esd |
| Windows cursor | 00 00 02 00 | 0 | .cur |
| Windows Metafile | D7 CD C6 9A | 0 | .wmf |
| WOFF2 | 77 4F 46 32 | 0 | .woff2 |
| WordPerfect | FF 57 50 43 | 0 | .wpd |
| XML | 3C 3F 78 6D 6C 20 | 0 | .xml |
| xz | FD 37 7A 58 5A 00 | 0 | .xz, .tar, TXZ |
| ZIP | 50 4B 03 04 | 0 | .zip, .docx, .xlsx, .pptx, .apk, .epub |
| Zstandard | 28 B5 2F FD | 0 | .zst, TZST |
How to read this table
The hex signature is the sequence of bytes to look for. A pair of question marks (??) means any byte can appear in that position, which is common for RIFF formats like WebP and WAV that embed a size field early on. The offset is how many bytes from the start of the file the signature begins, so an offset of 0 means the very first byte. A few formats, like tar and ISO images, place their marker well into the file.
Many modern formats are actually ZIP archives underneath, including DOCX, XLSX, PPTX, EPUB, APK and JAR. They all share the ZIP signature 50 4B 03 04, so the extension and internal structure decide which one it is.
Frequently asked questions
What are magic numbers in a file?
A short, fixed sequence of bytes at a known position that identifies a file's format regardless of its name. Programs read them to know what a file really is.
Can a file's extension lie about its format?
Yes. The extension is just part of the name and can be changed freely. The magic bytes are the reliable signal, which is why security tools inspect them.
Use the data
Prefer JSON? The whole table is one download at /api/signatures, and every format record, signatures included, is in the free WhatFileType API under a CC BY licence.