Identifying a file by its first bytes
Most formats announce themselves at the start. FF D8 FF is a JPEG, 89 50 4E 47 a PNG, 50 4B 03 04 a zip — and because .docx, .xlsx and .jar are all zip archives, they share it. 25 50 44 46 is a PDF.
Which is how you tell a file whose extension is lying. A "photo.jpg" starting with 50 4B is an archive, and that is worth knowing before opening it.
Reading the columns
The offset on the left is the byte position, in hex. The middle is the bytes themselves. The right shows any byte that happens to be a printable character, which is where embedded text, file paths and metadata become visible in something that is otherwise binary.
Large files are read in slices rather than all at once, so opening a multi-gigabyte file does not exhaust the tab.
Frequently asked questions
How do I tell what a file really is?
Read the first few bytes. FF D8 FF is a JPEG, 89 50 4E 47 a PNG, 50 4B 03 04 a zip — which also covers .docx and .xlsx, since both are zip archives.
Can I edit the bytes here?
No, this is read-only. Editing bytes safely needs a dedicated hex editor with undo.
Is my file uploaded?
No — it is read in slices by your browser, which is also what lets very large files be opened without exhausting memory.
Something wrong with this tool, or an idea for it? Tell us