How do I find out what type a file really is?

Open it and read the line with its name. Most formats start with a fixed signature — a PNG with 89 50 4E 47, a PDF with %PDF-, a ZIP with PK — and the tool checks the first bytes against more than fifty of them, with as much of the header as the Unix file command checks, and names the type and its MIME type. If the name’s extension disagrees with the bytes, it says so, which is how a renamed or disguised file shows itself.

Is the dump the same as xxd or hexdump?

Yes. The xxd, xxd -p, xxd -i and hexdump -C exports were checked byte for byte against the real tools’ output for the same data, including hexdump’s * for repeated lines, the real offsets of a selection and the C names xxd makes of odd file names. Pasting an xxd, xxd -p or hexdump -C dump back in reads it into the original bytes, as xxd -r does, so a dump from a terminal can be turned back into a file.

What does the panel beside the bytes show?

What the bytes at the cursor mean read as each common type: signed and unsigned 8, 16, 32 and 64-bit integers, 32 and 64-bit floats, the UTF-8 character starting there, and a 32-bit Unix time, signed and unsigned — in little-endian or big-endian order. The integers and floats were checked against Python’s struct module, and the UTF-8 reading against the browser’s own strict decoder.

No. The file is read into the page’s memory and never sent anywhere. Files up to 256 MB can be opened; the view draws only the rows on screen, so a large file stays quick to move through.

Hex & Binary Viewer

runs in your browser

Open any file as a hex dump: find its real type from the first bytes, read ints and floats at the cursor, search, and export xxd, hexdump -C or a C array.

Open

Drop a file here, or .

Any kind, up to 256 MB. Read in your browser; nothing is uploaded.

about this tool

Open anything

Drop in any file — an image, an executable, a database, a firmware blob, a file with no extension at all — and see its bytes: the offset of each row, the bytes themselves and the characters they spell. Show the bytes in hex, binary, octal or decimal, 8, 16 or 32 to a row. Only the rows on screen are drawn, so a file of up to 256 MB moves as quickly as a small one; the mouse wheel, Page Up and Page Down and the bar beside the bytes move through it, and "go to" jumps to an offset typed as 0x1f0, 1F0h, 000001f0 (leading zeros mean hex, as the rows show offsets), 496 or +16 from the cursor.

It works the other way too. Paste hex — spaced, comma-separated, colon- separated, or with 0x or \x before each byte — or a whole dump copied from xxd or hexdump -C in a terminal, and it is read back into bytes, placed at each line's offset as xxd -r places them, ready to save as a file. Anything the dump leaves out and the tool fills in — a gap between offsets, filled with zeros as xxd -r fills it — is said under the box, and a paste that looks like a dump but is not a whole one is refused rather than guessed at. Or type text to see the UTF-8 bytes it is stored as; for a character-by-character reading of a string, the Unicode inspector names each one.

What kind of file it is

Most formats begin with a fixed signature, a "magic number": 89 50 4E 47 for PNG, %PDF- for PDF, PK for a ZIP, 7F 45 4C 46 for a Linux executable. The first bytes are checked against more than fifty of them — images, audio and video, archives and compression, fonts, programs for Windows, macOS and Linux, SQLite databases, WebAssembly, and text with a byte-order mark — with as much of the header around each as the Unix file command checks, so a text file that happens to start "BM" or "MZ" is not taken for a picture or a program. The type is named with a MIME type: the one file --mime-type gives, or the registered one where file has none of its own (WebAssembly, WOFF, CAB). Those answers were checked against file on a sample header of each kind. When a file's name says .jpg but its bytes say PNG, the tool points it out: a file's extension is only a label, and the bytes are what a program actually reads. Formats built on a ZIP, and text with a byte-order mark, can carry any number of extensions, so those are not flagged.

Reading values

Click a byte, or move to it with the arrow keys, and the panel beside the dump reads the bytes from there as every common type: signed and unsigned 8, 16, 32 and 64-bit integers, 32 and 64-bit floating point, the UTF-8 character that starts there, and a 32-bit Unix time read both signed and unsigned — in little-endian or big-endian order. That is how a length field in a header, a timestamp in a log record or a float in a game save is read by hand. The integers and floats were checked against Python's struct module, and the UTF-8 reading against the browser's own strict decoder, invalid sequences included; a 32-bit float is shown as the shortest decimal that reads back to it.

Finding and exporting

Search for hex bytes, with ?? standing for any byte, or for text as UTF-8, optionally ignoring the case of A–Z; the first 10,000 matches, overlapping ones included, are marked and you can step between them. Shift with a click or the arrow keys selects a run of bytes. Export the selection, or the whole file, as an xxd dump, a hexdump -C dump, plain hex as xxd -p writes it, a C array as xxd -i writes it, or the raw bytes. A dump of a selection keeps the bytes' real offsets, as xxd -s and hexdump -s print them. The text formats match the real tools byte for byte — xxd at its default 16 a row, whatever the view shows — down to hexdump's * for a run of identical lines and the C name xxd -i makes of an awkward file name; for pasted hex or typed text, the C array has no name, as xxd -i gives none to its standard input.

Limits

This is a viewer, not an editor: bytes can be exported and a pasted dump saved, but not changed in place. Files up to 256 MB are held in memory. A text export can be made of up to 16 MB of bytes, which is 35 to 100 MB of text depending on the format, and copying stops at 1 MB. A signature names the container, not everything inside it: an .xlsx or a .jar is a ZIP, and is named as one. Nothing is uploaded.

questions

How do I find out what type a file really is?: Open it and read the line with its name. Most formats start with a fixed signature — a PNG with 89 50 4E 47, a PDF with %PDF-, a ZIP with PK — and the tool checks the first bytes against more than fifty of them, with as much of the header as the Unix file command checks, and names the type and its MIME type. If the name’s extension disagrees with the bytes, it says so, which is how a renamed or disguised file shows itself.
Is the dump the same as xxd or hexdump?: Yes. The xxd, xxd -p, xxd -i and hexdump -C exports were checked byte for byte against the real tools’ output for the same data, including hexdump’s * for repeated lines, the real offsets of a selection and the C names xxd makes of odd file names. Pasting an xxd, xxd -p or hexdump -C dump back in reads it into the original bytes, as xxd -r does, so a dump from a terminal can be turned back into a file.
What does the panel beside the bytes show?: What the bytes at the cursor mean read as each common type: signed and unsigned 8, 16, 32 and 64-bit integers, 32 and 64-bit floats, the UTF-8 character starting there, and a 32-bit Unix time, signed and unsigned — in little-endian or big-endian order. The integers and floats were checked against Python’s struct module, and the UTF-8 reading against the browser’s own strict decoder.
Is my file uploaded?: No. The file is read into the page’s memory and never sent anywhere. Files up to 256 MB can be opened; the view draws only the rows on screen, so a large file stays quick to move through.