SVG File Signature: 3C 3F 78 6D 6C (Magic Number)

Q: What is the SVG file signature?

SVG has no binary magic number. Files usually start with the XML prolog <?xml (hex 3C 3F 78 6D 6C) or with the root element <svg (hex 3C 73 76 67), but neither is required by the format and the first of the two is shared with every other XML file.

Q: Do the bytes 3C 3F 78 6D 6C mean a file is an SVG?

No. They spell <?xml, the XML declaration, and any XML document can begin with them: RSS, GPX, KML, COLLADA, plist, Office parts and countless others. They tell you the file is XML text, not which XML format it is.

Q: How do I check that a file really is an SVG?

Read the first element rather than the first bytes. Skip a byte order mark and the prolog, then look for <svg with the namespace http://www.w3.org/2000/svg. On Linux or macOS, file example.svg reports "SVG Scalable Vector Graphics image" by doing exactly that, and head -c 200 example.svg lets you look yourself.

Q: Can an SVG file be dangerous?

It can, which is why the weak signature matters. SVG is XML that may contain , event handlers and references to external resources, so a file that passes a naive header check can still run code when a browser renders it inline. Serve untrusted SVGs from a separate origin, or sanitise them, rather than trusting the first bytes.

SVG is XML text, so a file usually starts with the XML prolog <?xml, or sometimes the root element <svg directly. It has no binary magic number; the opening angle-bracket text is the practical signal.

What this magic number means

A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes 3C 3F 78 6D 6C (the text <?xml), the file is an XML document, and nothing more specific than that. Those five bytes are the XML prolog, which every XML format opens with, so RSS feeds, GPX tracks, KML overlays and Android layouts match them just as well as SVG does. What makes it an SVG is the root element <svg> that follows, with the namespace http://www.w3.org/2000/svg.

Both directions of the test are unreliable, which is unusual. The prolog is optional in XML, so a perfectly valid SVG can begin straight with <svg and carry none of these bytes; and the prolog is shared by every other XML format, so a file that does carry them may be anything at all. Neither a match nor a miss settles the question.

The check that does work is a two-step one: skip an optional UTF-8 byte order mark (EF BB BF), skip an optional prolog and any comments or a DOCTYPE, then read the root element name. If it is svg, the file is SVG. That is what the file(1) magic database, browsers and image libraries do, and it is why SVG detection needs a small parser rather than a byte comparison.

This matters for uploads. An upload filter that accepts anything starting <?xml as an image will happily take an arbitrary XML document, and SVG is an active format (it can carry script and external references), so SVG uploads want real parsing and sanitising rather than a signature check.

What each byte of 3C 3F 78 6D means

Here is the signature byte by byte, the way a hex editor shows it: the position in the file, the value in hex and in decimal, and the character that value stands for in ASCII. Bytes with no printable character show a dot.

Byte offset	Hex	Decimal	ASCII
0	3C	60	<
1	3F	63	?
2	78	120	x
3	6D	109	m
4	6C	108	l

Signature variants

SVG appears with more than one byte pattern. These all identify the same family:

Hex signature	Offset	Note
3C 3F 78 6D 6C	0	with an XML prolog
3C 73 76 67	0	starting directly with <svg

Formats that use the 3C 3F 78 6D signature

These file types in our database carry this signature:

How to check a file's signature

You can read the bytes of any file yourself. They are shown in hex, the same way this page lists them.

Linux & macOS

xxd -l 16 example.svg
hexdump -C -n 16 example.svg
file example.svg

Windows (PowerShell)

Format-Hex -Path example.svg -Count 16

Python

open("example.svg","rb").read(5).hex()

In your browser

Drop the file into the WhatFileType identifier, which reads the signature without uploading it.

Frequently asked questions

What is the SVG file signature?

SVG has no binary magic number. Files usually start with the XML prolog <?xml (hex 3C 3F 78 6D 6C) or with the root element <svg (hex 3C 73 76 67), but neither is required by the format and the first of the two is shared with every other XML file.

Do the bytes 3C 3F 78 6D 6C mean a file is an SVG?

No. They spell <?xml, the XML declaration, and any XML document can begin with them: RSS, GPX, KML, COLLADA, plist, Office parts and countless others. They tell you the file is XML text, not which XML format it is.

How do I check that a file really is an SVG?

Read the first element rather than the first bytes. Skip a byte order mark and the prolog, then look for <svg with the namespace http://www.w3.org/2000/svg. On Linux or macOS, file example.svg reports "SVG Scalable Vector Graphics image" by doing exactly that, and head -c 200 example.svg lets you look yourself.

Can an SVG file be dangerous?

It can, which is why the weak signature matters. SVG is XML that may contain <script>, event handlers and references to external resources, so a file that passes a naive header check can still run code when a browser renders it inline. Serve untrusted SVGs from a separate origin, or sanitise them, rather than trusting the first bytes.

Related signatures

Sources

Reuse this signature

This entry is part of the WhatFileType file signature reference, published under a CC BY 4.0 licence with the full provenance for every entry, a copy-paste embed and a JSON export. Credit WhatFileType and the data is yours to republish.