Loading page
About this tool
Compare a local file's leading magic bytes with its extension and browser-reported MIME type without uploading the file.
The File Signature Verifier reads the first 64 bytes of a file you pick on your own machine and compares that leading magic-byte signature against the file's extension and the MIME type the browser reports for it, then tells you whether the three agree. It recognises 22 common signature families — PNG (89 50 4E 47 0D 0A 1A 0A), JPEG (FF D8 FF), %PDF-, the PK ZIP headers behind DOCX/XLSX/APK/EPUB, gzip, 7z, RAR, OLE compound files, ELF, MZ executables, Mach-O, SQLite, WebAssembly, FLAC, Ogg, WAV, MP3, Matroska/WebM and ISO base media (ftyp). The verdict is consistent, mismatch, detected or unrecognised, plus the leading bytes in hex.
Open File Signature Verifier on AltFTool — it loads instantly in your browser.
Press Choose file under Local file and pick any file on your machine; the complete file is never uploaded or opened.
Press Run local inspection — only the leading 64 bytes are read and matched against the signature table.
Read the verdict with the Extension check, MIME check and Bytes read rows plus the Leading signature bytes in hex, then press Download report to save file-signature-review.json.
Signature, filename extension and browser MIME are compared pairwise, so it can flag a known extension whose expected header is missing, not just a header it recognises.
Only the leading 64 bytes are examined, so a multi-gigabyte file is inspected as fast as a small one and the body is never opened.
You get the first 16 bytes printed as uppercase hex alongside the verdict, so you can confirm the call yourself or paste it into a ticket.
The first 64 bytes, and no more. Every signature in the table lives inside that window — the longest offset used is the ftyp marker at byte 4 of an ISO base media container — so a bounded read is enough to identify the type without touching the rest of the file.
No. A matching header only tells you the leading bytes are what the extension implies; it says nothing about whether the rest of the file is valid, unmodified or free of malware. This is an informational triage check, not an antivirus scan — run a proper security tool before opening anything you did not expect.
Because it is one. DOCX, XLSX, PPTX, JAR, APK and EPUB are all ZIP archives and all begin with the same PK signature (50 4B 03 04), so the tool groups them under one entry and treats any of those extensions as a match. To tell them apart you have to read the archive's internal directory, which this bounded check does not do.
It means the MIME string the browser attached to the file belongs to a different signature family than the bytes suggest. Browser MIME is derived largely from the extension and is often absent or wrong, so treat it as a weaker signal than the magic bytes; generic values such as application/octet-stream are ignored rather than counted as a conflict.