HomeGuides › File inspector

How to find out what a file really is

The extension is a label anybody can change. The bytes at the start of the file are the actual answer.

A file's extension is a naming convention, not a property of its contents. Renaming a .exe to .jpg changes nothing about what it is — and renaming a genuine .png to .txt does not make it text.

Step-by-step

  1. Add the file. It is read locally.
  2. Read what it actually is, identified from its contents.
  3. See what it carries — size, structure, and any metadata found.

How identification works

Most formats begin with a distinctive signature, often called a magic number. A PNG starts with a specific eight-byte sequence; a PDF begins %PDF-; a ZIP begins PK. Reading those is how the true type is established, and it is what your operating system does when the extension is missing.

Because .docx, .xlsx and .epub are all ZIP archives underneath, they identify as ZIP at the outermost level — the inspector looks inside to tell them apart.

When this is useful

A mismatch between extension and content is not automatically sinister — files get renamed for innocent reasons constantly. But an attachment claiming to be a document and containing something executable is a well-worn attack, and worth treating with suspicion.

Frequently asked questions

Is the file uploaded?

No. It is read in your browser and nothing is transmitted.

Why does my Word document show as a ZIP?

Because it is one. The .docx, .xlsx and .epub formats are all ZIP archives containing XML, so they share the same outer signature.

Does a mismatched extension mean the file is dangerous?

Not by itself; renaming happens innocently all the time. It is worth investigating when the content type is executable and the name suggests a document.

Open the privacy tools →