Extensions, MIME types, and magic bytes are different evidence
A filename extension is editable, a browser MIME value is often inferred from that name, and magic bytes are structural markers stored inside the file. Agreement is useful evidence; disagreement deserves investigation.
Inspect a file
Choose a file, compare the declared extension and browser MIME with the detected signature, then read the confidence and evidence fields. The hexadecimal and printable prefix help technical users verify what was examined.
Office and media formats can share containers
DOCX, XLSX, and PPTX are ZIP packages distinguished by internal directory names. MP4-family media and AVIF/HEIF use ISO Base Media boxes and brands, so a container match may be more certain than an exact codec claim.
Identification is not a malware scan
A valid PDF, ZIP, or executable signature says what structure begins the file; it does not establish that the content is safe. Treat unexpected executable files and active documents cautiously.
Unknown and ambiguous results
Short, truncated, proprietary, or polyglot files may remain unknown. JSON and XML prefix checks are deliberately labeled likely because bounded text evidence cannot prove the entire document is valid.
- Renaming an extension does not convert a file.
- OpenFileTools normally reads only a 4 KB prefix.
- Bounded ZIP inspection is used for Office subtypes.