Can two different formats share the same magic bytes?

Yes. DOCX, XLSX, PPTX, and ODF are all zip archives underneath, so they all start with the same zip signature. Telling them apart needs a further look inside the archive's manifest, not just the first few bytes.

Does renaming a file's extension change its magic bytes?

No. Magic bytes live in the file's actual content, at the very start of it, and renaming only changes the filename. That's exactly why byte-level detection catches a mislabeled file that extension-based detection would miss.

Magic bytes

The fixed byte sequence at the start of a file that identifies its real format: %PDF for a PDF, PK for a zip. It works regardless of what the extension claims.

definition

Magic bytes (or a file signature) are a fixed sequence of bytes, usually at the start of a file. They reliably identify a file's format, independent of filename or metadata.

Also called: file signature, magic number

in-plain-terms

A PDF always begins with the four bytes %PDF. A zip-based format begins with the zip signature PK, and this covers DOCX, XLSX, PPTX, and ODF alike, since they're all zip archives underneath. A PNG begins with an eight-byte fixed signature. Reading these first few bytes reliably identifies a file's real container format before any content is parsed.

Detection based on magic bytes is why an extraction pipeline can catch a file that's been renamed, mislabeled, or served with a wrong Content-Type. The bytes at the front of the file don't change no matter what the filename says. A .pdf extension on a file that's actually a renamed image gets treated as an image. It doesn't get force-fed to a PDF parser that would fail on it.

why-it-matters

Extension-trust detection breaks the moment a file is renamed. It also breaks when a redirect changes the name, or a source doesn't set an accurate Content-Type. Magic-byte detection doesn't depend on any of that.
Two very different formats can share the same magic bytes at the container level. Telling a DOCX from an XLSX needs a further look inside the archive's own manifest, not just the first four bytes.

how-to-check

Drop a file into the file type inspector and see exactly which bytes it read to identify the format. Inspect a file's magic bytes

related-terms

faq

Can two different formats share the same magic bytes?: Yes. DOCX, XLSX, PPTX, and ODF are all zip archives underneath, so they all start with the same zip signature. Telling them apart needs a further look inside the archive's manifest, not just the first few bytes.
Does renaming a file's extension change its magic bytes?: No. Magic bytes live in the file's actual content, at the very start of it, and renaming only changes the filename. That's exactly why byte-level detection catches a mislabeled file that extension-based detection would miss.

related-reading

File identity

See the term in real output.

Drop a file into the free reader and watch it happen.

Open the file reader →

Get an API key →