Where to look
Zero means the first byte. A later offset means preceding fields are part of the identification context.
Reference 04
File signatures
A recognizable byte sequence can support identification. It does not prove that the rest of the file is valid, safe, or even consistently encoded.
| Format | Offset | Expected bytes | Meaning and caveat |
|---|---|---|---|
| PNG | 0 | 89 50 4E 47 0D 0A 1A 0A | The fixed eight-byte PNG signature. A decoder still needs to validate chunk order, lengths, and checksums. |
| JPEG | 0 | FF D8 FF | Begins with the Start of Image marker followed by another marker prefix. Full marker parsing is required. |
| WebP | 0, 8 | 52 49 46 46 ···· 57 45 42 50 | RIFF at offset 0 and WEBP at offset 8. RIFF alone also identifies other container families. |
| ZIP | 0 | 50 4B 03 04 | A common local-file-header signature. Empty and spanned archives can start with other PK signatures. |
| gzip | 0 | 1F 8B | The two fixed identification bytes. The next byte identifies the compression method; Deflate is method 8. |
0 | 25 50 44 46 2D | ASCII %PDF- starts the header of a conforming PDF, followed by a version number. | |
| JSON / CSV / TXT | — | No required magic bytes | Text structure, encoding metadata, and actual parsing are needed; a leading brace or comma is not a reliable signature. |
Reading the table
Offsets matter. Some signatures include length fields or container identifiers between fixed byte sequences.
What to compare
Compare only bytes defined as fixed. Wildcards and length fields should not be matched as constants.
What comes next
After tentative identification, parse the complete structure and enforce size and recursion limits.