MIME Type Checker

The browser reports the MIME based on the filename extension — easily spoofable. We look at the actual bytes, which are much harder to fake without breaking the file. When the two disagree, something's off.

A short sequence at a known offset that identifies a file format. PNG always starts with the 8 bytes 89 50 4E 47 0D 0A 1A 0A. PDF starts with %PDF. ZIP starts with PK followed by 03 04. By checking these you can identify the format without trusting the filename.

Their magic bytes are unique within the first 4-8 bytes and have been stable for decades. They're effectively impossible to confuse with other formats.

WebP is a RIFF container — `RIFF` at byte 0 + 4-byte length + `WEBP` at byte 8. Same with WAV (RIFF + WAVE) and AVI (RIFF + AVI ). We check both patterns to avoid false matches with other RIFF formats.

We detect them as 'application/zip' because they all start with the same PK header. To distinguish a DOCX from a JAR you'd need to inspect the inner directory structure — out of scope for this tool.

We compare the file's real content type to its filename extension. If you uploaded `payload.jpg` but the bytes say it's actually a `.exe` (PE magic 'MZ'), that's a security red flag.

We don't have a 'text/plain' signature — plain text has no magic bytes, just printable characters. If we don't match any signature, you can assume plain text or an unknown format.

HEIC files have `ftyp` followed by `heic` at offset 8. We detect them, but most browsers can't display them — only Safari and iOS Photos. You'll see the MIME but no preview.

Yes — we only read the first 512 bytes, regardless of file size. A 10 GB file detects as fast as a 1 KB file.

No. The File API reads bytes from your local disk into browser memory. Toollyz has no server.

These cover the formats users encounter day-to-day. Add edge cases like DDS or PSD to the GitHub repo if you need them.