Check what a file really is

The extension says .png, but is it? The first bytes of a file declare its real format — read them locally and compare against the name.

Tools used in this guide

The job

Downloads, email attachments, files from a shared drive — the extension is whatever the sender typed. Magic bytes at the start of the file are much harder to fake casually.

How to do it

Choose the file. The tool reads the leading bytes, matches them against a table of common signatures — PNG, JPEG, PDF, ZIP, ELF, SQLite, executables and more — and tells you whether the extension agrees.

A match verdict means the signature and extension agree; mismatch means they do not; unknown means the signature is not in the table.
A hex dump of the first bytes is shown so you can look yourself.

Worked example

report.pdf that starts with PK\x03\x04 is actually a ZIP container (common for Office documents), while invoice.exe starting with %PDF- is a PDF wearing an executable's name.

Limits

It reads the first 512 bytes only — enough for signatures, not for judging content. A matching signature does not prove the file is safe, and an unknown signature does not mean it is dangerous. It is not a malware scanner.