File Validator

In Windows and many desktop environments, a file's format is typically determined by its extension (e.g., document.pdf). The OS sees .pdf and assumes it should open Adobe Acrobat.

However, an extension is literally just part of the file's name string. It provides zero cryptographic or structural guarantee about the actual binary contents of the file.

To definitively determine what a file actually is, secure systems ignore the filename entirely and look at the very first few bytes of the raw binary data. These are called "Magic Bytes" or "File Signatures."

• A real PDF file will always start with 25 50 44 46 (which translates to %PDF in ASCII).
• A real JPEG image will always start with FF D8 FF E0.
• A real ZIP archive will always start with 50 4B 03 04.

A common and highly effective tactic for malware distributors is to write a malicious Windows Executable (which always starts with the magic bytes 4D 5A) and simply rename the file to invoice.pdf.exe or hide the extension.

This tool reads the raw binary data of the file you upload, checks the first few bytes, and verifies that the Magic Signature actually matches the claimed file extension, helping you spot disguised files before execution.