Magic Bytes Reference

About Magic Bytes Reference

This reference lists magic bytes (file signatures) used to identify file types when extensions are missing, unreliable, or potentially spoofed. Security software, file managers, and forensic tools use magic bytes for accurate file type detection.

Each signature shows the hexadecimal values of the first bytes of a file, along with associated extensions and format description.

How to Read File Headers

Hex Format:
  FF D8 FF E0 00 10 4A 46 49 46 00 01
  │  │  │  │  │  │  │  │  │  │  │  │
  │  │  │  │  │  │  │  │  │  │  │  └─ Null terminator
  │  │  │  │  │  │  │  │  │  │  └──── ASCII 'F'
  │  │  │  │  │  │  │  │  │  └─────── ASCII 'I'
  │  │  │  │  │  │  │  │  └────────── ASCII 'F'
  │  │  │  │  │  │  │  └───────────── ASCII 'J'
  │  │  │  │  │  │  └──────────────── Length marker
  │  │  │  │  │  └─────────────────── APP0 marker
  │  │  │  │  └────────────────────── Start of Image
  │  │  │  └───────────────────────── JPEG marker
  │  │  └──────────────────────────── JPEG marker
  │  └─────────────────────────────── JPEG marker
  └────────────────────────────────── JPEG SOI marker

This is a JPEG file with JFIF header.

Reading Magic Bytes in Code

// Node.js - Read file header
const fs = require('fs');

function getFileType(filePath) {
  const buffer = fs.readFileSync(filePath, { encoding: 'hex', start: 0, end: 16 });
  const hex = buffer.toUpperCase().match(/.{2}/g).join(' ');

  if (hex.startsWith('89 50 4E 47')) return 'PNG image';
  if (hex.startsWith('FF D8 FF')) return 'JPEG image';
  if (hex.startsWith('47 49 46')) return 'GIF image';
  if (hex.startsWith('25 50 44 46')) return 'PDF document';
  if (hex.startsWith('50 4B 03 04')) return 'ZIP archive';
  if (hex.startsWith('7F 45 4C 46')) return 'ELF executable';

  return 'Unknown';
}

// Python - Read file header
def get_file_type(path):
    with open(path, 'rb') as f:
        header = f.read(8).hex().upper()

    if header.startswith('89504E47'):
        return 'PNG image'
    if header.startswith('FFD8FF'):
        return 'JPEG image'
    if header.startswith('474946'):
        return 'GIF image'
    if header.startswith('25504446'):
        return 'PDF document'
    if header.startswith('504B0304'):
        return 'ZIP archive'

    return 'Unknown'

// Bash - Using file command
$ file image.png
image.png: PNG image data, 1920 x 1080, 8-bit/color RGB

// Bash - Using xxd to view hex
$ xxd -l 16 image.png
00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452  .PNG........IHDR

Magic Bytes by Category

Image Formats

Document Formats

Archive/Compressed Formats

Executable Formats

Audio/Video Formats

Font Formats

Database/Cache Formats

Encoding Signatures (BOM)