Drop in any file to find out what it actually is. The leading bytes are matched against a signature table and compared with the extension the file arrived under, data hiding past the format's end marker is flagged, entropy tells you whether the payload is packed, and the full hex dump is right there with an ASCII gutter. Nothing is uploaded.
{{ error }}
Any format, up to {{ maxSizeLabel }}. Executables, archives, images, databases, fonts and unrecognised blobs are all read the same way — as bytes.
Paste any of these into a malware database or compare against a vendor's published checksum. MD5 and SHA-1 are here because release pages still publish them, not because they are safe to rely on — both are broken for collision resistance and neither proves a file was not tampered with.
{{ report.entropy.label }} {{ report.entropy.detail }}
Byte values 0x00 (left) to 0xFF (right), log-scaled. A flat wall means compressed or encrypted; a cluster in the printable range means text; spikes at 0x00 mean padding or fixed-width records.
No printable runs of {{ minLength }} characters or more{{ stringFilter ? ' match that filter' : '' }}.
Printable runs pulled straight out of the bytes — paths, URLs, build stamps, embedded copy, library names. UTF-16LE is scanned alongside ASCII because that is where Windows binaries keep theirs. Offsets are clickable and move the hex dump.
A file extension is a hint, not a fact — it is part of the name, and anyone can change it. What a file is lives in its first few bytes. Almost every binary format opens with a fixed signature, often called magic bytes: %PDF- for PDF, \x89PNG\r\n\x1a\n for PNG, PK\x03\x04 for ZIP, MZ for a Windows executable, \x7fELF for a Linux one. This page matches those against a table and tells you when the answer disagrees with the name.
Some formats need a second look before the answer is useful. A .docx, .xlsx, .epub, .apk and .jar are all ZIP archives at byte zero, so a bare "ZIP archive" is technically right and practically useless — the entry names inside the archive are what separate them, and this page reads them. RIFF is a container shared by WebP, WAV and AVI, identified by the form type four bytes later. The ISO base media box (ftyp) covers MP4, MOV, HEIC and AVIF, told apart by their brand. And CA FE BA BE is claimed by both a Java class file and a Mach-O universal binary; the version field decides which.
Entropy measures how unpredictable the bytes are, on a scale of 0 to 8 bits per byte. Plain English text sits near 4.5. Compressed and encrypted data both crowd against 8, because both aim for output with no exploitable pattern left — which is why entropy tells you that something is packed but never which of the two it is. The useful signal is entropy that does not fit the format: a near-8 reading on a file claiming to be a document usually means the real payload is wrapped in something else.
Trailing data is the other thing worth knowing. Most formats declare where they end — PNG with an IEND chunk, JPEG with FF D9, ZIP with an end-of-central-directory record. Bytes after that point are invisible to the program that opens the file and are how polyglots work: one file that is simultaneously a valid image and a valid archive. Plenty of legitimate software appends data too, so this is a flag to investigate, not a verdict.
Related tools on this site pick up where this one stops: the Universal Decoder runs every decoder at once over a blob you cannot place, the Hash Generator covers more digests and HMAC, EXIF Inspector reads the metadata inside a photo, and GZip & Brotli Tool unpacks what a high-entropy stream is hiding.
Privacy: the file is read into memory in this tab and analysed there. There is no upload, no server call and no logging — the checksums, strings and hex you see were all computed on your machine, which is exactly why this works on files you would never send to a web service.
