Hex viewer with structure overlay
A hexdump annotated with any known file signatures found in the bytes, including magic bytes and embedded formats.
Runs on your device. The file is never uploaded.
Hex viewer with structure overlay prints offset, hex and ASCII columns and marks each line where a known signature sits. Every offset is checked against the shared signature table, 16 bytes to a line unless you pick 8 or 32. A two-byte pattern like BM or 1f 8b matches by chance, so a marker means bytes, not a file.
Questions
What do the three columns mean?
Offset, hex, ASCII. The first column is the byte offset of the line, in hex, padded to 8 digits. The middle column is that line's bytes in hex. The column between pipes shows each byte as a character when it falls in the printable ASCII range 0x20 to 0x7e, and a dot when it does not. A line holds 8, 16 or 32 bytes, set by bytesPerLine, which defaults to 16.
What are the arrows at the end of some lines?
Signature matches. The file is scanned at every offset against the shared signature table in src/magic.ts, and each match is annotated on the line that contains it, written as "<- PNG image at +3" where +3 is the byte position inside that line. The header above the dump counts the matches and lists the types found. An annotation means a known byte pattern sits at that offset, nothing more.
Why does it flag formats that are obviously not in my file?
Because short patterns match by chance. The scan checks every offset, and some signatures are only two bytes: BM for bitmaps, 1f 8b for gzip, MZ for Windows executables. In a few megabytes of compressed or random data those turn up constantly. Treat the annotations as places to look, and confirm with Detect file type, which only matches at offset 0.
How is this different from the plain Hexdump tool?
Only the annotations. Both produce the same offset, hex and ASCII layout with the same bytesPerLine choice of 8, 16 or 32. Hex viewer additionally runs the signature scan and adds the match summary line and the per-line markers. If you want a clean dump to paste into a report or feed back through From hexdump, use Hexdump.
Does my evidence file get uploaded?
No. The file is read in your browser, handed to a Web Worker in the same tab, and the dump comes back as text. There is no upload path in the code, no account and no server-side step, and the site keeps working with the network off after the first visit. The file also never leaves memory, so nothing is written to a temp directory anywhere.
What do I get for an empty file?
One line: the file name followed by "empty file". No offsets, no summary and no signature section, because there are no bytes to scan. That is still worth knowing during triage, since a zero-byte file that should hold evidence tells you something happened to it before it reached you.