Inspect a file's bytes with a hex dump
Is it really a PNG? Where does the text change encoding? A hex dump answers questions the file's name cannot.
Tools used in this guide
The job
File types lie by extension all the time. A 'log' that is secretly UTF-16, a 'jpg' that starts with PK (it is a ZIP), a config that fails because of a stray byte at offset 0 — the BOM. The hex viewer shows what is actually there.
Read the dump
Drop the file in. Each row shows the offset, 16 bytes in hex, and the ASCII column where printable bytes appear as characters. Search by hex bytes (like '50 4b') or ASCII to jump to a signature or a magic string.
- PK at offset 0 → ZIP-family formats (docx, xlsx, jar too).
- FF D8 FF → JPEG. 89 50 4E 47 → PNG. EF BB BF → UTF-8 BOM.
- Every second byte zero → UTF-16 text, not broken ASCII.
Worked example
A 'broken' .docx will not open. The first two bytes read 50 4B — PK — so it is ZIP-family, fine. But searching 'mimetype' shows nothing at offset 30, and the dump ends early at 14 KB. The file was truncated in transit; no repair tool can invent the missing tail.
Limits
Read-only and local — nothing is modified or uploaded. Files up to 16 MiB, 16 bytes per row. The ASCII column shows printable bytes; multibyte characters appear as dots between them.