Magic Number Lookup Online: Identify Any File by Its Magic Bytes (Free Tool)

CodexFuse Team · 2026-11-01T12:33:51.305Z · 10 min read min read

Identify any file by its magic bytes, not its extension. Free lookup tool, worked example, and honest limits.

A magic number lookup identifies a file by reading the first few bytes of its contents — its "magic bytes" — instead of trusting the filename extension. A file called report.pdf might really be a ZIP archive, a renamed image, or a disguised executable, and only its signature bytes tell the truth.

Extensions lie because they are just labels: anybody can rename photo.exe to photo.jpg in seconds, while the bytes inside never change. That is why analysts check signatures rather than names, and why a free magic number lookup tool puts the same check in anyone's reach without installing software or uploading a sensitive file.

What exactly is a magic number?

A magic number is a short sequence of bytes at the very start of a file that identifies its format. Most formats define a fixed signature: PNG images begin with 89 50 4E 47 0D 0A 1A 0A, JPEG images with FF D8 FF, PDF documents with 25 50 44 46 (the characters "%PDF"), and ZIP archives with 50 4B 03 04 ("PK"). A lookup tool compares the bytes you supply against a database of known signatures — the CodexFuse tool covers 45+ file signatures — and reports the matching format.

Why does the file extension get it wrong so often?

File extensions go wrong for three ordinary reasons, none of which requires malice. First, people rename files by hand and make mistakes, especially when downloading on a phone where the extension is hidden. Second, backup and recovery tools restore content without restoring the original names, leaving folders full of file001, file002, and so on. Third, some programs save in a format different from the one the user selected, or append the wrong extension automatically.

Then there is the malicious case, which is the one that costs businesses real money. A phishing attachment named invoice.pdf that is actually an executable is a classic delivery method for malware. Email filters catch many of these, but not all, and a signature check on the receiving side is a cheap second line of defence. If the bytes say "executable" while the name says "document", that file goes nowhere near a double-click.

How do you check a file's magic bytes?

Checking a file's magic bytes takes three steps: get the first bytes, compare them against known signatures, and act on the match. On the CodexFuse tool the flow is deliberately short — paste hex bytes or choose a file, click Lookup, and read the matched file type. Only the first 32 bytes are read, and they are read locally in your browser, so the file itself never leaves your device.

If you prefer a manual check, open the file in a hex editor, or run the file command on Linux or macOS. The online tool's advantage is that it works on any device, including a locked-down office computer, and explains the match in plain language.

Worked example: the "PDF" that was not a PDF

Here is a scenario that plays out in small offices every week. Sara runs operations for a 14-person logistics firm in Lahore. A new supplier emails her an attachment named delivery-note.pdf, 212 KB, with a short message: "Please confirm receipt." The email address looks close to the real supplier's domain but the spelling is off by one letter, so Sara pauses before opening it.

Instead of double-clicking, she opens the magic number lookup tool, chooses the file, and clicks Lookup. The tool reads the first 32 bytes and reports a ZIP archive signature (50 4B 03 04), not a PDF signature (25 50 44 46). Inside that archive, she later learns from her IT provider, was a script file disguised as a document.

The outcome is concrete: one 20-second, zero-cost check kept an executable off a machine holding customer delivery data, invoicing records, and email credentials. The alternative — a compromised workstation, team-wide password resets, and a day of lost dispatch work — would have cost far more. Sara's rule since: every unexpected attachment gets a signature check before opening, no exceptions.

When should a business check file signatures?

Signature checks belong in four routine situations: email triage (any unexpected attachment gets checked before opening); data recovery (files from a failed drive usually arrive without reliable names, and signatures sort images from documents from databases); upload validation (checking signatures server-side stops renamed executables landing in your storage); and small-scale forensics (working out what an old archive contains before migrating it).

For a business, the pattern to build is a habit, not a project: one person learns the check, shows the team, and it becomes part of how attachments are handled.

What does a magic number lookup not tell you?

A signature check has honest limits, and knowing them keeps you safe. It identifies the container format, not the contents: a genuine PDF can still carry a malicious link, and a genuine ZIP can still hold malware inside. It cannot judge intent, and it cannot repair a damaged file — it only names what the file claims to be. Some formats also share opening bytes, so a match can occasionally be ambiguous, and very new or rare formats may simply not be in the tool's 45+ signature database yet.

The right response is layering: pair the check with antivirus scanning, keep software patched, and treat "identified as a document" as permission to scan, not to trust blindly. A misnamed, unexpected file is still safest deleted.

How does this fit a managed IT setup?

File checks like this one are a small piece of a larger discipline: keeping a business's files, email, and hosting in one place where someone competent is watching. On CodexFuse the workflow is concrete. Sign up and buy credits once — there is no monthly subscription to manage — then move the pieces that currently live in five different places: point your domain to managed hosting, migrate business email onto the platform, and switch on backups and security monitoring from the same dashboard. When a suspicious attachment lands, the check above takes seconds, and if something does go wrong, the team that hosts your site and email is the same team that helps you recover, rather than three vendors pointing at each other.

The decision rule is straightforward: if your business juggles separate hosting, email, backup, and security bills and nobody wants to babysit servers, a managed all-in-one platform on credits fits. If you already have a dedicated IT team running its own infrastructure, it does not.

Frequently Asked Questions

What are magic numbers in simple terms?

Magic numbers are the first bytes of a file that identify its true format, like a fingerprint. For example, PNG files start with 89 50 4E 47 and PDFs with %PDF. A lookup tool reads those bytes and tells you what the file really is, regardless of its name or extension.

Can I identify a file without uploading it?

Yes. The CodexFuse magic number lookup reads only the first 32 bytes locally in your browser, so the file never leaves your device. You can also paste hex bytes directly instead of choosing a file, which is useful when you only have a hex dump from another tool.

Why does my file show a different type than its extension?

Because extensions are just labels that anyone can change, while magic bytes are part of the content. Renames, recovery tools, and misconfigured programs all produce mismatches. When they disagree, trust the bytes — then verify the file in its real application before relying on it.

Is a matching signature proof a file is safe?

No. A signature only identifies the format, not the contents. A real PDF can still contain a malicious link and a real archive can hold malware. Use the lookup as a first check alongside antivirus scanning, and delete unexpected files that are misnamed even if they identify as a familiar format.

How many file types does the tool recognise?

The tool covers 45+ file signatures, including common images, documents, archives, audio, and video formats. Very new or rare formats may not be included yet; if a lookup returns no match, try a hex editor or the file command on Linux or macOS for a second opinion.

What should I do with a file that turns out to be an executable?

Do not open it. Delete it, or pass it to your IT provider for analysis if it arrived in a business context. Then check whether anyone else on the team received the same attachment, change any credentials that may have been exposed, and add a signature check to your attachment-handling routine.

Make the 20-second check a team habit

Start today: the next unexpected attachment that lands in your inbox gets a magic number lookup before it gets opened. Bookmark the magic number lookup tool, show the check to your team in one five-minute demo, and write it into your onboarding notes for new hires. Then move the infrastructure around that habit onto solid ground — migrate your hosting, business email, and backups to CodexFuse, where everything is fully managed on pay-as-you-go credits with no subscriptions and no server babysitting. One small check plus one managed platform, and the renamed-file trick stops working on your business for good.