About this tool
Treat signatures, MIME claims, and filename extensions as separate evidence without turning a type match into a safety claim.
- Uses the maintained file-type 22.0.1 detector for supported binary signatures and container formats, while preserving unknown and detector-error outcomes.
- Compares normalized browser MIME claims and filename extensions independently, including explicit mismatch, missing, and not-assessed states.
- Calculates exact SHA-256, records the first 64 bytes, and exports versioned JSON with malware, complete-content, polyglot, and safe-to-open claims explicitly set to false.
How to use File Signature Inspector
Choose a local file, compare detected magic bytes with its extension and browser MIME claim, then record SHA-256 when integrity comparison is needed.
When this tool is useful
- Triaging an upload type mismatch.
- Recording a checksum before transferring a file.
Practical tips
- Treat an unknown signature as unsupported, not malicious.
- Use malware scanning separately.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Inspect a renamed image
Example input
photo.pdf whose bytes begin with a PNG signature
Expected output
Extension and MIME mismatch with PNG detection and SHA-256
Signature agreement does not prove the file is harmless.
Validation checklist
- Compare extension, MIME claim, and detected signature.
- Record the complete SHA-256 value.
- Do not treat detection as malware analysis.