A file announces its own format

Every binary format starts with a fixed sequence of bytes that says what it is: the PNG signature, the JPEG start-of-image marker, the ZIP local file header. That sequence is called a magic number, and it is why a file can be identified without trusting its name. Renaming invoice.pdf to invoice.jpg changes nothing inside the bytes, and the extension only tells you what someone hoped you would believe.

The inspector reads those first bytes, matches them against the formats it knows, and then goes deeper for the ones it recognises: the chunk table of a PNG, the frame markers of a JPEG, the central directory of a ZIP, the marker scan of a PDF. A file it does not recognise is still shown, with its hex dump, because the first bytes are often the most telling part of an unknown file.

What it reads in each format

  • PNG — dimensions, colour type and bit depth, interlacing, and every chunk with its size: the image data itself, the palette, and any text, EXIF or thumbnail chunks. Each chunk is checked against its own CRC.
  • JPEG — dimensions, component count, progressive or baseline, the quantisation and Huffman tables, the JFIF header, and whether EXIF metadata is present.
  • GIF — canvas size, frame count, the delay on each frame, the disposal method, transparency, and the loop count from the NETSCAPE extension.
  • WebP — canvas size, VP8 or VP8L encoding, animation frames, alpha channel, embedded EXIF and ICC profile.
  • ICO — each icon in the file, with its size, and whether it is stored as PNG or as a bitmap.
  • ZIP — the entries in the central directory, how many are deflated, the compressed and uncompressed sizes and the overall ratio.
  • PDF — the version, the page count, the number of objects and streams, and a scan for the markers worth knowing: encryption, embedded files, JavaScript actions, an automatic open action, and a missing end-of-file marker.
  • MP4 — the box structure, the brand in ftyp, the timescale and duration from the movie header, and the number of tracks.
  • WOFF, WOFF2, TrueType and OpenType — the header, the number of tables and the outline format behind them.

Entropy and hashing

Two numbers in the summary deserve their own explanation. Entropy measures how unpredictable the bytes are, from 0 to 8 bits per byte. Text and structured formats sit low because the same few characters keep repeating; image data, archives and compressed video sit close to 8 because the bytes are close to random. A PNG that scores near 8 has almost no metadata left in it, and one that scores near 5 is carrying something extra.

SHA-256 identifies the exact file. It is the same digest a build pipeline, a virus scanner or an upload form would compute, so you can compare the file in your hand with the one recorded somewhere else. The value is calculated with the browser's own crypto API; on a page opened straight from disk rather than over https or localhost, that API is not available and the tool says so instead of showing a wrong answer.

How to use it

  1. Drop the file onto the panel. Nothing is uploaded — the file is read with the browser's file API and decoded in the page.
  2. Read the summary: the format it identified, the file size, the number of parts it found and the entropy.
  3. Read the Structure table for the parts themselves, with their byte offsets. Any offset can be looked up directly in a hex editor.
  4. Read the Notes for anything worth acting on: a stray EXIF block, an embedded file inside a PDF, a PNG that carries a thumbnail.
  5. Look at the First bytes when the format is unknown. The hex view shows the first 512 bytes with their offsets and their ASCII column.
  6. Copy the SHA-256 into whatever log or ticket records the file you are looking at.

Good to know

  • Files up to 64 MB are read. A larger one is refused rather than half-parsed.
  • The PDF check is a fast scan for markers, not a full document parser. It will tell you that a document carries JavaScript actions; it will not tell you what those actions do.
  • The hex view covers the first 512 bytes. That is where headers live, so it is enough to identify a file and to see that a header looks wrong.
  • Knowing the format does not make the file safe. An image can carry metadata and a PDF can carry an embedded file, which is exactly what the Notes panel is for.
  • Once you know what you are holding, the Image Compressor shrinks a picture that turned out to be an oversized image, and the Images to PDF converter collects a set of them into one document.