What file is this?

A file name is a label, not proof

The extension, that .jpg or .pdf at the end of the name, is only a piece of the name: anyone can change it, and plenty of programs lose it along the way. WhatsApp saves some documents with no extension, Outlook sends attachments called ATT00001, a transfer app renames iPhone photos to .jpg while leaving them HEIC, a business program exports a CSV and calls it .xls. The system then picks the wrong program, or none, and the file «will not open».

The content, on the other hand, does not lie, because nearly every format starts with a signature: a few bytes that are always the same, put there on purpose by whoever invented it. A PDF starts with the letters %PDF, a PNG image with eight fixed bytes, a ZIP archive with the letters PK, the initials of Phil Katz, who invented it in 1989. This page reads those bytes and tells you what the file is, what the right extension is and, if there is one, which tool on the site opens it.

Renaming does not convert. If the photo is a HEIC, calling it .jpg does not turn it into a JPEG: only the label changes, and that is exactly how so many files that will not open are born. When the extension is wrong the page offers you a copy with the right name, with the very same bytes; when you need another format instead, you need a converter, like Convert HEIC to JPG.

How it reads a four-gigabyte file without uploading it

It does not upload it anywhere, and it does not even read all of it. It looks at the first and last few dozen kilobytes, which are enough for nearly every format, and then fetches only the pieces it needs: of a four-gigabyte file it usually reads less than two hundred kilobytes, and every card says how many bytes it really read. That is why the answer comes at once even for a whole film, and on a phone too.

Many formats are boxes inside other boxes, and there the signature at the start is not enough. A Word document, an Excel workbook, a presentation, an ebook, an Android app and a Java program are all ZIP archives: they are told apart by the names of the parts they contain, and OpenDocument and EPUB by a small file called mimetype that has to come first. The old .doc, .xls and .ppt, Outlook .msg emails, .msi installers and password-protected Office files are instead OLE containers, the same container for all of them, and the name of the internal streams tells them apart.

Modern videos and photos follow another rule. MP4, MOV, HEIC, AVIF and M4A share the same box structure, and the real type is given by the brand written in the first box: that is why an iPhone video called .mp4 is recognised as MOV. For a signed file, a p7m, the page also tells you what is inside the envelope, for example an e-invoice or a PDF.

The disguised program

It is the most serious reason to use this page. A Windows program starts with the letters MZ, whatever its name: if an attachment is called invoice.pdf but there is a program inside, here you see it in red. The icon on the desktop does not help, because a program can show any icon it likes, even a PDF one.

Three tricks of the name are flagged on their own. The double extension, like document.pdf.exe: out of the box Windows hides the extensions it knows, and the screen is left with document.pdf. The program name given to a text: an invoice.pdf.js or an invoice.pdf.vbs holds only letters, but a double click makes Windows run it, and it is the most common shape of scam attachments. And the invisible character that flips the direction of the text, the code U+202E: a file called invoice, U+202E, fdp.exe reads invoiceexe.pdf on screen. In the card that character is shown for what it is, instead of being left to do its work.

If it happens to you: do not open it, delete it, and if it seems to come from someone you know, ask them by phone, not by replying to the same message. The page also flags documents with macros and files that contain a private key: they are not disguised programs, but they deserve the same caution.

Text has no signature, and the page says so

A text file is made only of letters, and letters have no signature. CSV, JSON, XML, subtitles and web pages are all text, and they can only be recognised from the shape of the content. Next to every result you find where it comes from: the signature at the start, the internal structure or only some clues, and in the third case the result is very likely, but not certain.

For text, though, the page tells you the thing that is needed most often: the encoding. UTF-8, UTF-8 with BOM, UTF-16, or an old 8-bit Windows encoding, which is why accented letters turn into odd symbols when a file moves from one program to another. If the text is already broken, with the classic «Ã¨» instead of «è», it can be fixed with Fix broken characters (mojibake).

There are also the line breaks, which Windows writes one way and Linux and Mac another, and for a CSV the separator: the semicolon of European versions of Excel or the comma of the English one. A CSV exported by a business program with the name .xls is recognised for what it is, and with the right name the Excel warning saying that format and extension do not match goes away.

How many formats it recognises, and how that is tested

It recognises 131 formats across images, documents, archives, audio, video, programs, databases, certificates, calendars and fonts. Of these, 117 are tested with real files, written by other people's programs and not by this page: images by Pillow, audio and video by ffmpeg, documents by the libraries that write them, the old Office files straight by Word, Excel, PowerPoint and Outlook (the Apache POI test collection), programs by compilers. Only four headers are written by hand, because no free program writes them: the PSD, the winmail.dat, the .lnk shortcut and the .torrent.

Every answer is then compared with the one from the command file, the recogniser that Linux and macOS have used for decades, and where that one cannot answer with openssl, olefile and ffmpeg. The others are recognised by their documented signature, and the card says so instead of presenting them as certain. If a file looks like nothing, the page does not make things up: it says it does not recognise it and shows you the first bytes.

What it does not do

It does not open or convert the file. It tells you what it is and what opens it: for an archive there is Open a ZIP file, for a photo Convert image, for a video What your video really is.

It is not an antivirus. A correct signature tells you what type a file is, not whether it is harmless: a PDF or a Word document can hold malicious code even with the right name. The disguised-program check catches the most common trick, not all of them.

It does not verify digital signatures and it does not guess passwords: for a signed file it says that it is signed and what it contains, but whether the signature is valid can only be told by checking the certificate. And to know whether a downloaded file is identical to the original, compare its fingerprint with File checksum (MD5, SHA-256).