Files and data
What is File signature?
Also called magic number or magic bytes.
A file signature is a fixed pattern of bytes near the start of a file that identifies its real format, regardless of the filename.
How it works
Programs that write a file usually start it with a short, recognizable header. Programs that read it check that header before going further. These headers are called file signatures or magic numbers, and they are how a file can be identified even after it has been renamed.
The signature for JPEG is the bytes FF D8 FF. GIF files begin with GIF87a or GIF89a. ZIP archives begin with PK, the initials of the format’s creator. Operating systems mostly rely on extensions, but browsers, email scanners and file type checkers look at signatures because they are much harder to get wrong by accident.
Signature vs extension
The extension is a label on the outside that anyone can change. The signature is part of the contents. When a file won’t open, or opens as nonsense, a mismatch between the two is one of the first things to check.
A practical example
Every PDF begins with the characters %PDF-, and every PNG begins with the same eight bytes that include the letters PNG. A file named photo.jpg that starts with %PDF- is really a PDF.
What to watch out for
Signatures identify a format, not whether the file is safe or intact. A damaged file can have a correct signature, and plain-text formats such as CSV have no signature at all.
Tools you can use
- File Type Checker · What a file really is, whatever it is called
Go a little deeper
Common questions
How can I tell what type a file really is?
Read its signature. A file type checker compares the first bytes against known patterns and reports the actual format, even when the extension is missing or wrong.
Why is a DOCX file identified as ZIP?
DOCX, XLSX and many other modern formats are ZIP archives with a specific set of files inside, so they share the ZIP signature. A checker has to look inside to tell them apart.
Do text files have signatures?
Usually not. CSV, JSON and plain text are identified by their content and structure instead, which is less certain.