Editorial illustration.
Originally published 27 June 2023; rewritten and reviewed on 15 October 2026.
An uploaded file is named report.pdf, but the name tells the server only what somebody called it. Checking the opening bytes can reveal a mismatch. It cannot establish that a file is harmless or that its entire structure is valid.
Know what the prefix can tell you
| Format or family | Typical opening bytes in hexadecimal |
|---|---|
| JPEG | FF D8 FF |
| PNG | 89 50 4E 47 0D 0A 1A 0A |
| GIF | 47 49 46 38 37 61 or 47 49 46 38 39 61 |
25 50 44 46 2D |
|
| ZIP family | Often 50 4B 03 04; other ZIP record forms exist |
| GZIP | 1F 8B |
| Windows executable family | 4D 5A, followed by further structural checks |
The original article listed fifty extensions. I have replaced that inventory with a smaller reference because many extensions share a container and cannot be identified reliably by a fixed prefix alone.
Inspect the container when formats overlap
DOCX, XLSX and PPTX are ZIP-based packages. Their initial bytes do not uniquely identify which Office format they represent. Similar ambiguity appears in RIFF-based formats and other container families. Use a parser that understands the relevant structure, and apply limits to compressed size and expansion.
Plain text and CSV do not have a universal magic number. A short or empty upload should be rejected or handled deliberately rather than passed because a comparison accidentally read beyond the available data.
Make the check one layer
Use an allowlist of formats needed by the application, enforce size limits and store uploads outside executable public locations. Choose server-generated storage names and control downloads according to user permissions.
For a working upload pipeline, consult Microsoft’s file-upload guidance. A signature check is most useful when it catches an obvious mismatch early and leaves deeper validation to a format-aware process.