forensics.media Subscribe

True file type · image

Is this really the format it claims?

A file name can say anything. Drop in an image and this reads its actual signature bytes and tells you the real format, and whether the extension is honest. A .jpg that is really a PNG, or a file that is not an image at all, shows up here.

Runs entirely in your browser. Your file is never uploaded or stored.

Why the extension is not the format

The name of a file, and the .jpg or .png on the end of it, is just a label. Anyone can rename photo.png to photo.jpg and nothing about the actual bytes changes. What really decides the format is a short signature at the very start of the file, often called a magic number: a JPEG begins with the bytes FF D8 FF, a PNG with 89 50 4E 47, a GIF with GIF8. This tool reads those first bytes and reports what the file truly is, regardless of what it is called.

What a mismatch does and does not mean

A mismatch is a flag, not a conviction. Renaming happens for innocent reasons all the time: a messaging app saves everything as .jpg, a download keeps a stale extension, a screen grab tool picks its own. So a PNG called .jpg is usually just mislabelled, not sinister. Where it matters is when a file is presented as one thing and is quietly another, or when an extension has been changed to slip a file past a check that only looks at the name. Read the result as a fact about the file, then judge it in context.

What it can miss

This reads the container format only. It can tell a JPEG from a PNG, but it cannot tell an edited JPEG from an untouched one, and it does not look inside for a second file hidden after the image data. For that, pair it with the metadata viewer and the photo edit check. Some formats also share a container, so a modern .heic and an .mp4 both start from the same ISO structure and are told apart by a brand code a few bytes in, which this handles.