Why does it say the type is not recognised?

Because the leading bytes do not match any signature the tool knows. Plain text, CSV, JSON, source code and many other formats have no signature at all — they are just characters, with nothing at the start to identify them. An unrecognised result is common and usually means exactly that.

It is a fingerprint. Two files with the same SHA-256 are, for every practical purpose, the same file; a single changed byte produces a completely different value. It is what you compare against a published checksum to confirm a download arrived intact, and how you check whether two copies have diverged.

Can it tell me if a file is dangerous?

No, and you should not treat it as if it could. It reports what a file appears to be, which is useful context — an attachment named invoice.pdf that is really a Windows executable is a strong signal something is wrong. But a correctly named file can still be malicious, and this tool does not scan for that.

Document · What the file knows

File Metadata Viewer

Size, type, timestamps and signatures

Inspect any file: its real type from the magic bytes, its timestamps, its SHA-256, and whether the extension is telling the truth.

Magic bytesSHA-256TimestampsAny type

Signatures

40+

Max file

2 GB

Uploaded

0 B

01 — How to use File Metadata Viewer

1 Drop any file There is no type restriction, because inspecting unfamiliar files is the point. Nothing is uploaded — the file is read from your own disk by the browser.

2 Read the detected type The type is worked out from the file's leading bytes, not its name. The first sixteen bytes are shown in hex underneath as the evidence for that conclusion.

3 Watch for a mismatch If the extension disagrees with the contents, that is called out first and in plain words. A .jpg that is really a PDF is worth knowing about.

4 Copy the hash or export JSON SHA-256 is computed over the whole file, which is what you need to verify a download or prove two files are identical. Turn it off for very large files.

02 — Getting good results

The extension is a claim; the bytes are the fact A file extension is simply the end of a name. Anyone can rename anything, and some systems do it automatically and incorrectly — attachments downloaded through certain mail gateways, images exported by some phones, files copied from systems that use different conventions. Software, meanwhile, generally decides what to do with a file by looking at its first few bytes. When the two disagree, the bytes are what actually determines the behaviour you will see.

A ZIP signature does not mean it is a ZIP archive Word, Excel and PowerPoint files from the last fifteen years are ZIP archives containing XML, as are OpenDocument files, EPUB books, Android APKs and Java JARs. All of them begin with the same two bytes, PK. The tool reports the container honestly rather than guessing which of those it is, because from the first four bytes alone there is genuinely no way to tell.

SHA-256 reads the whole file, so it costs time on large ones Detecting the type only needs the first few dozen bytes and is instantaneous regardless of size. Hashing has to read every byte, which on a multi-gigabyte file takes real time and memory. That is why it is a switch rather than automatic. Turn it off when you only want to know what something is.

A modification date of nothing is normal Browsers report a file's last-modified time as zero when the underlying system did not supply one, which happens with files from certain archives, downloads and cloud sources. That is shown as "not recorded" rather than as 1 January 1970, which is what the raw value literally means and what many tools display.

03 — Questions

No. The browser reads it from your disk into memory in this tab. Detection reads the first thirty-two bytes; hashing reads the whole file locally with the browser's own crypto implementation. Nothing is transmitted.

04 — More about File Metadata Viewer

Magic numbers and how type detection works

Most binary formats begin with a fixed byte sequence that identifies them, known as a magic number. A PDF starts with the ASCII characters %PDF. A PNG begins with a byte of 0x89 followed by the letters PNG and a carefully chosen sequence of line-ending bytes, designed so that a file corrupted by a text-mode transfer becomes detectably invalid. A JPEG starts 0xFF 0xD8 0xFF. These markers exist precisely because filenames are unreliable: the same file arrives with different names on different systems, and the format needs to be identifiable from its contents alone. Reading them is how operating systems, web servers and command-line tools decide what a file really is.

Containers, and why one signature can mean several things

Some signatures identify a container rather than a format. The ZIP signature is the clearest case: a ZIP archive is a general-purpose bundle, and a great deal of modern software stores its documents as one. A .docx, .xlsx, .pptx, .odt, .epub, .jar and .apk are all ZIP archives that differ only in what they contain and how the contents are named. Distinguishing them requires unpacking the archive and looking inside, which is a substantially different operation from reading a header. The same applies to the ISO base media format, where AVIF images, HEIC photographs and MP4 videos share an identical outer structure and differ in a four-character brand code a few bytes in. This tool checks those brands specifically, which is why a HEIC photograph is not reported as a video.

Why a mismatch matters

A file whose name and contents disagree is not automatically sinister — renaming happens accidentally all the time, and some systems strip or replace extensions as a matter of course. But it is always worth knowing about. In the benign case it explains why something will not open: an application asked to handle a .jpg that contains PDF data will simply fail, often with an unhelpful message, and the cause is invisible without looking at the bytes. In the less benign case, a deliberately misleading extension is a long-standing technique for getting a user to open something they would not have opened knowingly. Either way, the disagreement itself is the useful signal, which is why it is reported first rather than buried among the other fields.

61 more tools
where this came from.

Same shell, same shortcuts, same promise: nothing leaves your browser.

Browse all 62

File Metadata Viewer