How file-signature detection works
A file signature—often called a magic number—is a byte sequence at a known position that identifies a format family. Bitpeek checks the beginning of the current document against a compact, reviewed signature list.
The current detector recognizes PNG, JPEG, GIF, PDF, ZIP, Gzip, ELF, WebAssembly, SQLite, BMP, WAVE, and WebP headers. The byte table remains visible so the result can be verified rather than accepted as a black box.
Recognized leading signatures
| Format | Leading bytes or text | Detection note |
|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | Exact 8-byte signature |
| JPEG | FF D8 FF | SOI followed by a marker prefix |
| GIF | GIF87a / GIF89a | ASCII version signature |
| %PDF- | ASCII header prefix | |
| ZIP | 50 4B 03 04 | Local-file-header signature |
| Gzip | 1F 8B | Gzip member prefix |
| ELF | 7F 45 4C 46 | ELF identification bytes |
| WebAssembly | 00 61 73 6D | Wasm binary magic |
| SQLite | SQLite format 3 | 16-byte ASCII header |
| BMP | 42 4D | ASCII “BM” prefix |
| WAVE | RIFF … WAVE | RIFF at 0 and WAVE at 8 |
| WebP | RIFF … WEBP | RIFF at 0 and WEBP at 8 |
What a signature can and cannot prove
A matching signature is a strong format clue, but it does not validate every field, guarantee that the file is complete, or establish that its content is safe. Different container formats can also share signatures; ZIP-based documents are a common example.
Treat magic-byte detection as the first inspection step. Continue with header fields, documented offsets, length checks, and a format-aware validator when correctness or security matters.
When the signature is unknown
- Inspect the first 32–64 bytes in both hex and ASCII.
- Use the string scanner to look for readable identifiers.
- Search for documented markers that may appear after a wrapper or preamble.
- Compare the file with a known-good example from the same source.
Local processing and privacy
The File signature checker workflow opens the same Bitpeek browser workspace. Selected file bytes, file names, pasted input, searches, edits, hashes, and comparison data are processed in local browser memory and are not sent to a Bitpeek server.
The static guide itself can be read without opening a file or creating an account.
Frequently asked questions
Is a file extension the same as a signature?
No. An extension is a file-name convention; a signature is stored in the file bytes. Either can be absent or misleading.
Is this an antivirus scanner?
No. Bitpeek identifies selected byte patterns and exposes the header. It does not evaluate whether a file is malicious.
What happens if no signature matches?
Bitpeek reports the signature as unknown while leaving all bytes, representations, searches, hashes, and strings available for manual inspection.