Sniff a file's real MIME type and compare it to the declared type.
Tip: use samples, upload, copy, download, and send-to actions inside the workspace where available.
MIME Type Detector is a free, browser-based tool that helps you convert between formats. Sniff a file's real MIME type and compare it to the declared type. It's built for speed and privacy: Everything runs locally in your browser — your data is never uploaded to a server. No sign-up, no installs, and no daily limits.
Start with the source file or pasted payload, then confirm delimiters, headers, and field handling before conversion.
Review the preview, copy or download the result, and keep everything local in your browser.
File Signature Checker: Identify a file's true type by its magic bytes.
Open toolThe bytes say Windows PE / DOS MZ (application/vnd.microsoft.portable-executable); the filename says .jpg which maps to image/jpeg. That combination is how executables are delivered to people expecting a document or a picture. Do not open it; treat it as hostile until proven otherwise.
Confidence rises with the number of concrete bytes the signature pins down and with the extension agreeing; it falls when several signatures match the same header or when the format is only a container (ZIP, ISO-BMFF, RIFF) whose real type lives inside.
The bytes are a Windows PE / DOS MZ (application/vnd.microsoft.portable-executable) but the filename claims ".jpg". Executable content behind a document or image extension is the single most common malware delivery trick — do not open this file.
DOS stub header; the real PE header offset is the 32-bit LE value at 0x3C.
The browser reported "image/jpeg" (it derives that from the extension, not the bytes) while the signature says "application/vnd.microsoft.portable-executable". Trust the bytes, not the declaration.
| File | Ext | Sniffed | MIME | Conf. | Verdict |
|---|---|---|---|---|---|
| holiday-photo.jpg | .jpg | Windows PE / DOS MZ | application/vnd.microsoft.portable-executable | 37% | Security finding |
| quarterly-report.pdf | application/pdf | 75% | Consistent |
Click a row to load its full report above. Sorting is the order you dropped the files in, so a “Security finding” badge anywhere in this table deserves attention before anything else.
| Extension | MIME type | Has magic bytes? |
|---|---|---|
| .7z | application/x-7z-compressed | yes — 7-Zip |
| .aac | audio/aac | no signature, extension only |
| .accdb | application/x-msaccess | yes — MS Access (ACE) |
| .aif | audio/aiff | yes — AIFF |
| .aiff | audio/aiff | yes — AIFF |
| .apk | application/vnd.android.package-archive | no signature, extension only |
| .avi | video/x-msvideo | yes — AVI |
| .avif | image/avif | yes — AVIF |
| .avro | application/avro | yes — Apache Avro |
| .bmp | image/bmp | yes — BMP |
| .bz2 | application/x-bzip2 | yes — BZIP2 |
| .cab | application/vnd.ms-cab-compressed | yes — CAB (Windows) |
| .class | application/java-vm | yes — Java class |
| .cr2 | image/x-canon-cr2 | yes — Canon RAW 2 |
| .crt | application/x-x509-ca-cert | yes — PEM block |
| .csv | text/csv | no signature, extension only |
| .cur | image/vnd.microsoft.icon | yes — CUR (cursor) |
| .dcm | application/dicom | yes — DICOM |
| .deb | application/vnd.debian.binary-package | yes — Debian package |
| .der | application/x-x509-ca-cert | yes — DER structure (ASN.1) |
| .dex | application/x-dex | yes — Dalvik DEX |
| .dll | application/vnd.microsoft.portable-executable | yes — Windows PE / DOS MZ |
| .doc | application/msword | yes — OLE2 (legacy Office) |
| .docx | application/vnd.openxmlformats-officedocument.wordprocessingml.document | no signature, extension only |
| .epub | application/epub+zip | yes — EPUB |
| .exe | application/vnd.microsoft.portable-executable | yes — Windows PE / DOS MZ |
| .exr | image/x-exr | yes — OpenEXR |
| .flac | audio/flac | yes — FLAC |
| .flv | video/x-flv | yes — FLV |
| .gif | image/gif | yes — GIF (87a) |
| .gz | application/gzip | yes — GZIP |
| .heic | image/heic | yes — HEIC / HEIF |
| .htm | text/html | no signature, extension only |
| .html | text/html | yes — HTML (doctype) |
| .ico | image/vnd.microsoft.icon | yes — ICO |
| .ics | text/calendar | no signature, extension only |
| .iso | application/x-iso9660-image | yes — ISO 9660 |
| .jar | application/java-archive | no signature, extension only |
| .jp2 | image/jp2 | yes — JPEG 2000 |
| .jpeg | image/jpeg | yes — JPEG |
| .jpg | image/jpeg | yes — JPEG |
| .js | text/javascript | no signature, extension only |
| .json | application/json | no signature, extension only |
| .key | application/x-pem-file | yes — PEM block |
| .lnk | application/x-ms-shortcut | yes — Windows shortcut |
| .lz4 | application/x-lz4 | yes — LZ4 |
| .m4a | audio/mp4 | yes — M4A audio |
| .md | text/markdown | no signature, extension only |
| .mdb | application/x-msaccess | yes — MS Access (Jet) |
| .mid | audio/midi | yes — MIDI |
| .midi | audio/midi | yes — MIDI |
| .mkv | video/x-matroska | yes — Matroska / WebM |
| .mov | video/quicktime | yes — MOV (QuickTime) |
| .mp3 | audio/mpeg | yes — MP3 (ID3v2) |
| .mp4 | video/mp4 | yes — MP4 (ISO-BMFF) |
| .mpeg | video/mpeg | yes — MPEG program stream |
| .mpg | video/mpeg | yes — MPEG program stream |
| .msi | application/x-msdownload | yes — OLE2 (legacy Office) |
| .ndjson | application/x-ndjson | no signature, extension only |
| .odp | application/vnd.oasis.opendocument.presentation | no signature, extension only |
Showing 60 of 109 matching entries — refine the search to see the rest. The third column matters more than it looks: types marked “no signature” (CSV, JSON, JavaScript, Markdown, plain text) have no magic bytes at all, so nothing about their content can confirm the type — only parsing can. For everything else, the bytes are authoritative and the extension is just a hint that anyone can rename.
