Characters for Information Technology
About Magic Bytes
Magic Bytes, also known as "file signatures" or "magic numbers," refer to specific byte sequences at the beginning of a file. These sequences act as unique identifiers to determine the file type, allowing software to recognize and handle different formats correctly, even if the file extension is incorrect or missing.
The following is an organized compilation of Magic Bytes (hexadecimal representation) for common file formats and their corresponding file types, categorized by file category:
I. Image Files
| File Type | Magic Bytes (Hexadecimal) | Description |
|---|---|---|
| JPEG | FF D8 FF |
Start Of Image (SOI), a common starting marker |
| PNG | 89 50 4E 47 0D 0A 1A 0A |
PNG signature (including file header) |
| GIF | 47 49 46 38 37 61 or 47 49 46 38 39 61 |
GIF87a or GIF89a version identifier |
| BMP | 42 4D |
"BM" identifier (Bitmap File Header) |
| ICO/PNG | 00 00 01 00 |
ICO file header (icon file) |
| WEBP | 52 49 46 46 [File Size] 57 45 42 50 |
RIFF header + "WEBP" identifier |
| PSD | 38 42 50 53 |
Adobe Photoshop Document identifier |
| SVG | 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D |
XML declaration start, SVG is based on XML format |
| TIFF | 49 49 2A 00 or 4D 4D 00 2A |
Little-endian (II) or big-endian (MM) identifier |
II. Document and Office Files
| File Type | Magic Bytes (Hexadecimal) | Description |
|---|---|---|
25 50 44 46 |
%PDF" identifier | |
| Microsoft Word (DOC/DOCX) | D0 CF 11 E0 A1 B1 1A E1 (DOC)50 4B 03 04 |
OLE compound document header (legacy DOC) ZIP header (DOCX/PPTX/XLSX are compressed formats) |
| Excel (XLS/XLSX) | D0 CF 11 E0 A1 B1 1A E1 (XLS)50 4B 03 04 |
OLE compound document header (legacy XLS) ZIP header (XLSX is a compressed format) |
| PowerPoint (PPT/PPTX) | D0 CF 11 E0 A1 B1 1A E1 (PPT)50 4B 03 04 |
OLE compound document header (legacy PPT) ZIP header (PPTX is a compressed format) |
| TXT (UTF-8) | EF BB BF |
UTF-8 Byte Order Mark (BOM) |
| TXT (UTF-16) | FF FE or FE FF |
UTF-16 Byte Order Mark (BOM) |
| Markdown (MD) | 23 or 2A 20 or - 20 |
May start with a heading #, list *, or - |
| EPUB | 50 4B 03 04 |
ZIP header, EPUB is based on ZIP compression format |
| CHM | 49 54 53 46 |
"ITSF" identifier, Compiled HTML Help |
III. Audio and Video Files
| File Type | Magic Bytes (Hexadecimal) | Description |
|---|---|---|
| MP3 | 49 44 33 |
ID3v2 metadata header (commonly at the start) |
| MP4 | 00 00 00 18 66 74 79 70 6D 70 34 32 |
"ftypmp42" identifier (ISO Base Media File Format) |
| AVI | 52 49 46 46 [File Size] 41 56 49 20 |
"RIFF AVI " identifier |
| WAV | 52 49 46 46 [File Size] 57 41 56 45 |
"RIFF WAVE" identifier |
| FLAC | 66 4C 61 43 |
"fLaC" identifier |
| OGG | 4F 67 67 53 |
"OggS" identifier |
| MOV | 66 74 79 70 6D 70 34 32 |
"ftypmp42", QuickTime file format |
| MKV | 1A 45 DF A3 |
Matroska multimedia container identifier |
| AAC | 41 44 49 46 |
"ADIF" or "ADTS" audio data header |
| M4A | 4D 34 41 20 |
MPEG - 4 audio file identifier |
IV. Compressed and Archive Files
| File Type | Magic Bytes (Hexadecimal) | Description |
|---|---|---|
| ZIP | 50 4B 03 04 |
ZIP file header (global file header) |
| RAR | 52 61 72 21 1A 07 00 |
RAR v5+ identifier |
| GZIP | 1F 8B 08 |
GZIP header (compression signature) |
| TAR | 75 73 74 61 72 |
"ustar" identifier (POSIX TAR) |
| 7 - Zip | 37 7A BC AF 27 1C |
7z file header |
| BZ2 | 42 5A 68 |
Bzip2 compressed file identifier |
| XZ | FD 37 7A 58 5A 00 |
XZ compressed file identifier |
| ISO | 43 44 30 30 31 |
"CD001", optical disc image file identifier |
V. Executable and System Files
| File Type | Magic Bytes (Hexadecimal) | Description |
|---|---|---|
| Windows EXE | 4D 5A |
"MZ" identifier (MS - DOS header) |
| Linux ELF | 7F 45 4C 46 |
ELF header (Linux executable) |
| Mach - O (macOS) | CF FA ED FE or FE ED FA CF |
64 - bit Mach - O header (big - endian/little - endian) |
| Python Script | 23 21 55 73 72 2F 62 69 6E 2F 70 79 74 68 6F 6E |
Shebang line (#!/usr/bin/python) |
| Java Class | CA FE BA BE |
Java class file identifier |
| Windows DLL | 4D 5A |
Similar to EXE, Dynamic Link Library file |
| Android APK | 50 4B 03 04 |
ZIP header, APK is based on ZIP compression format |
VI. Other Common Formats
| File Type | Magic Bytes (Hexadecimal) | Description |
|---|---|---|
| SQLite DB | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 |
"SQLite format 3" identifier |
| HTML/XML | 3C 21 44 4F 43 54 59 50 45 |
<!DOCTYPE declaration (common starting) |
| JSON | 7B or 5B |
"{" (object) or "[" (array) starting |
| CSV | 43 4F 4D 4D 41 2C (comma - separated) |
Example: starting with "COMMA," |
| YAML | 23 21 2F 75 73 72 2F 62 69 6E 2F 79 61 6D 6C or 2D 20 |
Shebang line or list - starting |
| XML | 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E |
XML declaration start |
| PLIST (Mac) | 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E |
Apple property list file based on XML |
| RTF | 7B 5C 72 74 66 |
"{\rtf", Rich Text Format identifier |