File Type Spoofing Detector
Inspect the actual first 32 bytes of each selected file and compare recognized families with filename and declared MIME claims.
Up to 20 files, 1 GB/file. Only the first 32 bytes are read. PNG uses eight bytes; JPEG FF D8 FF; GIF87a/GIF89a; PDF %PDF- plus version; ZIP local, empty and spanning markers.
Prefix evidence is not complete file validation, malware scanning or a security verdict. Unknown signatures and missing or unrecognized extensions are inconclusive. ZIP also covers containers such as DOCX, XLSX, PPTX and JAR; subtype is not identified.
All reading stays in this browser. Files are never uploaded or executed. The report retains names, sizes, claimed MIME, extensions, exact prefix length/hex and comparisons for every selected file.
Choose 1–20 local files.
Machine-readable JSON keys retain their stable English schema; values and explanations follow this page language.
A QUICK WALKTHROUGH
How to use this tool
- Select local files of any extension.
- Inspect and review recognized, conflicting and inconclusive evidence.
- Copy or download the complete frozen report. Selection changes clear previous results.
Complete report
Up to 20 files, 1 GB/file. Only the first 32 bytes are read. PNG uses eight bytes; JPEG FF D8 FF; GIF87a/GIF89a; PDF %PDF- plus version; ZIP local, empty and spanning markers.
Result
Prefix evidence is not complete file validation, malware scanning or a security verdict. Unknown signatures and missing or unrecognized extensions are inconclusive. ZIP also covers containers such as DOCX, XLSX, PPTX and JAR; subtype is not identified.
Local files
All reading stays in this browser. Files are never uploaded or executed. The report retains names, sizes, claimed MIME, extensions, exact prefix length/hex and comparisons for every selected file.
GOOD TO KNOW
Common questions
Does a mismatch prove malicious content?
No. It is only a disagreement between a claim and a limited prefix; no security verdict is made.
Does a recognized prefix prove the file is valid?
No. Full content, archive members, format validity and malware are not checked. Unknown formats remain inconclusive.
Why can a DOCX be recognized as ZIP?
DOCX uses a ZIP container. The prefix identifies only that family and cannot establish its member structure or subtype.