You double-click a file and nothing happens. Or it opens in the wrong program and shows garbage. Or you have an email attachment named invoice.pdf and something about it feels off. In every one of these cases the filename is failing you, and the only thing that can answer the question “what is this, really?” is the file itself.
This guide explains how a file’s true type is worked out from its own contents, when you’d reach for that, and how to read what the file type detector tells you. Everything below happens in your browser. The file you check never leaves your device.
Why a file’s extension can’t be trusted
An extension is just the few letters after the dot in a filename, and it’s plain text that anyone can edit. Renaming cat.jpg to cat.pdf changes nothing about the actual image data. Your computer leans on the extension as a shortcut for picking a program to open the file, but it is a label, not proof.
Extensions go wrong in three common ways:
- Missing. Files exported from servers, pulled out of archives, or transferred between systems often arrive with no extension at all. The data is intact, but your operating system has no hint about which program to use.
- Wrong. A download interrupted partway, a save dialog with the wrong type selected, or a copy-paste that dropped the suffix can leave a perfectly good file wearing the wrong name.
- Misleading on purpose. This is the one that matters for safety. An attacker can name an executable
holiday-photos.jpgso it looks harmless in your inbox. The name says image. The contents say program.
Because the label is so easy to fake or lose, you need a way to ask the file directly.
How the real format is identified
Most file formats announce themselves in their opening bytes. Near the very start of a JPEG, a PDF, a PNG, a ZIP, an MP4, there’s a short fixed pattern that’s the same in every file of that kind. Think of it as a fingerprint stamped into the front of the file. A type detector reads that opening pattern, compares it against a library of known fingerprints, and reports the match. The filename is never consulted.
This is why detection is reliable where extensions are not. You can rename a file a hundred times, but you can’t rename what’s inside it without actually changing the data. The signature stays honest.
Why some files report a “container” type first
A few formats are built as containers. A Word document, an Excel sheet, an EPUB ebook, and many app save-files are really ZIP archives with a known folder structure tucked inside. Their opening fingerprint looks exactly like a plain ZIP, so an honest first answer is “ZIP archive.” A capable detector goes one step further and looks at the names of the files packed inside to tell you it’s specifically a Word document or a spreadsheet. If you ever see a bare “ZIP” result for something you expected to be an Office file, that’s normal, not a failure.
When you actually need this
You don’t reach for a type detector every day. You reach for it at the exact moments a filename has stopped being useful:
- A file with no extension. You’ve got a file called
exportordatawith nothing after it, and you need to know what to open it with. - A download that won’t open. The file claims to be one thing, your program refuses it, and you suspect the real format is different from the name.
- A suspicious attachment. Something arrived unexpectedly and you want to confirm its real type before you go anywhere near it.
- Sorting a pile of recovered files. Data recovery and forensic exports frequently produce files stripped of their original names. Detection lets you sort them back into types.
How to read the result
Drop your file in and the detector gives you a plain answer: the detected format, usually with both a friendly name (such as “JPEG image” or “PDF document”) and the technical type that programs use behind the scenes. Alongside that, you’ll often see a small confidence indication and a short hex view.
The detected type is the headline. If it matches what you expected, you’re done, and now you know which program to assign. If it doesn’t match the extension on the name, keep reading the next section, because that gap is the interesting part.
Making sense of the hex view
The hex view shows the raw opening bytes of the file in two columns. On the left, each byte is written as a pair of characters using the digits 0 to 9 and letters A to F, which is just a compact way to display the numbers a computer stores. On the right, the same bytes are shown as text where they happen to be readable.
You do not need to memorise any of it. The reason it’s shown is so you can see the fingerprint with your own eyes. Many formats leave human-readable clues right there at the start: a PDF literally begins with the letters PDF, a PNG shows PNG a couple of bytes in, a ZIP shows PK. Spotting those in the readable column is a quick sanity check that the detected type is right.
The security angle: when the name and the type disagree
This is the part worth slowing down for. A mismatch between the extension and the real detected type is one of the cleanest warning signs you can get for free.
Consider the table below.
| Filename says | Detector reports | What it likely means |
|---|---|---|
report.pdf | PDF document | Consistent. Normal file. |
photos.jpg | JPEG image | Consistent. Normal file. |
invoice.pdf | Windows executable | Danger. A program dressed up as a document. |
update.doc | Script or archive | Suspicious. Worth deleting unopened. |
The first two rows are what healthy files look like: the name and the contents agree. The last two are the pattern attackers rely on. They give a dangerous file a boring, trustworthy-looking name and count on you trusting the label. A detector strips the disguise off in seconds because it ignores the name entirely and reports what the bytes actually are.
A mismatch is not always malicious. A renamed download or a wrongly saved export can produce a harmless mismatch too. But the rule is simple: if the real type isn’t what the name promised, stop. Don’t open it, don’t run it. Find out why the two disagree before you do anything else. For files you trust but want to confirm haven’t been altered in transit, pairing this check with a checksum gives you both halves of the picture: what the file is, and whether it’s exactly the copy you expected.
A quick mental checklist
When a file’s identity is in doubt, run through this:
- Does it have an extension? If not, the name tells you nothing. Go straight to detection.
- Does the detected type match the extension? If yes, you’re fine. If no, treat it as a red flag.
- Does the readable part of the hex view back up the detected type? A quick second confirmation costs you nothing.
- For anything unexpected or unsolicited, let a “no” on step 2 be a full stop, not a speed bump.
Reading a file’s true type takes a few seconds and asks nothing of you beyond dragging it into the page. The whole check runs locally in your browser, so even a file you don’t trust stays on your own machine the entire time.