What Are Magic Bytes? How Computers Identify Real File Formats

A magic byte sequence (also known as a file signature or magic number) is a fixed constant byte pattern placed at the very start of a file (offset 0x00) by the file format specification. While file extensions like `.jpg` or `.pdf` are easily renamed by users or malicious actors, magic bytes represent the true internal identity of the binary payload.

Essential hexadecimal signatures used across the digital ecosystem:

• PDF Document: `25 50 44 46` (ASCII `%PDF`)
• PNG Image: `89 50 4E 47 0D 0A 1A 0A` (ASCII `.PNG....`)
• JPEG Image: `FF D8 FF E0` or `FF D8 FF E1` (SOI + APP0/APP1 Marker)
• GIF Animation: `47 49 46 38 37 61` or `47 49 46 38 39 61` (ASCII `GIF87a` / `GIF89a`)
• ZIP Archive / DOCX / XLSX / APK: `50 4B 03 04` (ASCII `PK..` Phil Katz signature)
• Windows Executable (EXE/DLL): `4D 5A` (ASCII `MZ` Mark Zbikowski signature)
• MP4 / QuickTime: Offset 4 `66 74 79 70` (ASCII `ftyp`)
• WEBP Image: `52 49 46 46` ... `57 45 42 50` (ASCII `RIFF....WEBP`)

Relying solely on file extensions creates severe security vulnerabilities known as extension spoofing. For example, an attacker can rename `malware.exe` to `invoice.pdf` or `photo.jpg`. When uploaded to a web server, an intelligent backend inspects magic bytes to detect that the file begins with `4D 5A` (Windows PE executable) rather than `%PDF`, rejecting the upload immediately.

• Prevents Executable Masquerading: Disallows binary payloads hidden behind benign media extensions.
• MIME Content-Type Validation: Guarantees HTTP headers accurately reflect binary streams.
• Discovers Accidental Extension Renames: Enables recovery when users accidentally mislabel file types.