Detect file type
Identify a file by its magic bytes, not its extension; nothing is uploaded.
Runs on your device. The file is never uploaded.
Detect file type checks a file against the 34 magic-byte signatures and prints every type that matches, with its extension and MIME type. Where the name's extension is not among the matched types, a note reports the disagreement without calling it tampering. Only offset 0 is examined, so a ZIP appended to a JPEG is never seen here.
Questions
How does it identify the file?
By magic bytes, not by extension. The file is checked against a table of about 34 signatures, each with its own position: PNG, JPEG, GIF, WebP, BMP, TIFF, ICO, PDF, ZIP, GZIP, BZIP2, 7-Zip, RAR, XZ, ZSTD, TAR, ELF, Windows PE, Mach-O, Java class, WASM, SQLite, MP4, Matroska, MP3, OGG, FLAC, RTF and a few more. A signature only counts when it matches where it belongs, for example ustar at offset 257 for TAR and ftyp at offset 4 for MP4.
Why did it say no known signature matched?
Because nothing in that table matched at offset 0, and the message says exactly that along with the file size and the fact that this checks about 30 common formats rather than a full signature database. Plain text, CSV, JSON, HTML, most source code and many proprietary formats carry no magic bytes at all, so an unmatched result is common and is not a sign of tampering.
Why did I get more than one type?
Because some signatures are genuinely shared. ZIP and DOCX/XLSX/PPTX both start with PK 03 04, and MP4 and HEIC/AVIF both carry ftyp at offset 4. Every matching entry is listed with its extension and MIME type rather than one being picked for you. To tell an OOXML document from a plain ZIP, list the contents with File tree from archive and look for the [Content_Types].xml entry.
What does the extension mismatch note mean?
That the bytes and the file name disagree. When the file has an extension and none of the matched signatures uses it, a note reports the claimed extension and what the bytes matched instead. That is worth investigating, but it is not proof of anything: renamed files are routine, and plenty of legitimate formats share containers.
Does it check anywhere except the start of the file?
No. Only signatures anchored at the start, each at its own defined offset. A ZIP appended to the end of a JPEG will not appear here, and the file will be identified as a JPEG, correctly. Use Scan for embedded files to check every offset in the file.
Is my file uploaded to be identified?
No. The bytes are compared against a table that ships with the page, inside a Web Worker in this tab. No hash and no sample is sent anywhere, which is the difference between this and an online file identifier. It works offline.