About this tool
Treat signatures, MIME claims, and filename extensions as separate evidence without turning a type match into a safety claim.
File Signature & MIME Inspector answers a simple question about any local file up to 100 MB: what does its content say it is, and does that agree with its name and with what the browser assumes? It uses the file-type 22.0.1 library to read magic numbers and container structures, then compares the detected type separately against the filename extension and the browser's MIME claim, reporting match, mismatch, not supplied, or not assessed for each. Alongside that it computes a full SHA-256 checksum and shows the first 64 bytes as hex. Everything is packaged into a JSON report whose scope fields state plainly that no malware scan, structural parse, or safety judgement took place.
- Uses the maintained file-type 22.0.1 detector for supported binary signatures and container formats, while preserving unknown and detector-error outcomes.
- Compares normalized browser MIME claims and filename extensions independently, including explicit mismatch, missing, and not-assessed states.
- Calculates exact SHA-256, records the first 64 bytes, and exports versioned JSON with malware, complete-content, polyglot, and safe-to-open claims explicitly set to false.
How to use File Signature Inspector
Choose or drop a file onto the panel. The label under the name shows the MIME type the browser attached and the size, or No MIME claim if the OS supplied nothing. Press Inspect file evidence and wait for the badge row, which reads Mismatch found, Partially corroborated, Detection limited, Type unknown, or a consistent result, followed by the detected extension. The four cards show the detected type, the browser claim, and the two comparison outcomes, and the Findings list spells out any disagreement in a sentence. Copy the SHA-256 from its box when you need to record or compare a checksum, and read the header hex to eyeball the signature yourself. Download JSON writes a report named after the file for your notes or a ticket.
When this tool is useful
- A support engineer investigates why an upload named report.pdf is rejected by a server that reads magic bytes.
- A sysadmin records the SHA-256 of an installer before copying it to an offline machine.
- A content moderator checks whether a .jpg attachment is really an image or a renamed archive.
- A developer debugging a file-upload form wants to see the exact MIME string the browser attaches on macOS versus Windows.
- A data analyst confirms that a vendor's .xlsx export is a genuine ZIP-based Office container and not CSV with the wrong extension.
Practical tips
- Plain text formats such as CSV, JSON, SVG, and source code have no magic number, so Type unknown is expected for them, not a warning sign.
- A detected type of application/zip is deliberately generic; DOCX, XLSX, APK, and JAR files all start the same way, and the extension often carries the real meaning.
- Compound extensions like .tar.gz are recognised as a unit, and jpg versus jpeg or tif versus tiff are treated as the same family rather than mismatches.
- A file under 32 bytes triggers a size note because a signature alone cannot tell you the file is complete or usable.
- Executable and installer types get a review note by design. Detection tells you what a file is, never whether opening it is safe.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Renamed PNG masquerading as PDF
Example input
photo.pdf whose first bytes are 89 50 4E 47 0D 0A 1A 0A
Expected output
Mismatch found; detected image/png (.png); extension comparison mismatch; MIME comparison mismatch if the browser guessed application/pdf
The header hex box shows the PNG signature directly, so you can confirm the finding without trusting the library's label.
Recording an installer checksum
Example input
setup-2.4.1.dmg, 84 MB, dragged from the Downloads folder
Expected output
Detected application/x-apple-diskimage (.dmg), a review note about installable types, and a 64-character SHA-256
Compare the SHA-256 with the vendor's published value character by character; a single differing hex digit means different bytes.
Validation checklist
- Read all three type claims separately rather than trusting the overall badge alone.
- Copy the complete 64-character SHA-256, not a truncated display.
- Treat Type unknown for text formats as normal and check the content another way.
- Do not interpret a consistent result as proof the file is safe or complete.
- Save the JSON report if the inspection will be referenced in a ticket.