File Signature (Magic Byte) Reference

What magic bytes are

Most file formats begin with a fixed byte sequence, known as the magic bytes or file signature. Operating systems and applications read it to decide what kind of file they are looking at. An extension can be changed in a second; the magic bytes are part of the binary itself, which is what makes them a dependable basis for validation.

The file command on Linux and PHP's finfo class both determine the MIME type this way.

Images

Documents and archives

Text and data formats

Audio and video

Executables and others

Validating magic bytes in PHP

 ['offset' => 0, 'bytes' => "\x89PNG\r\n\x1a\n", 'length' => 8],
        'jpg'  => ['offset' => 0, 'bytes' => "\xFF\xD8\xFF",       'length' => 3],
        'gif'  => ['offset' => 0, 'bytes' => "GIF8",               'length' => 4],
        'pdf'  => ['offset' => 0, 'bytes' => "%PDF-",              'length' => 5],
        'zip'  => ['offset' => 0, 'bytes' => "PK\x03\x04",         'length' => 4],
        'exe'  => ['offset' => 0, 'bytes' => "MZ",                 'length' => 2],
    ];

    if (!isset($signatures[$expectedType])) {
        throw new \InvalidArgumentException("Unknown file type: $expectedType");
    }

    $sig = $signatures[$expectedType];
    $handle = fopen($filePath, 'rb');
    if ($sig['offset'] > 0) fseek($handle, $sig['offset']);
    $header = fread($handle, $sig['length']);
    fclose($handle);

    if (substr($header, 0, $sig['length']) !== $sig['bytes']) {
        throw new \RuntimeException("Magic bytes do not match (expected: $expectedType)");
    }
}

// Example use
validateMagicBytes($_FILES['upload']['tmp_name'], 'png');
echo "This is a genuine PNG file";

Related resources

• MIME type reference — extensions mapped to Content-Type
• Corrupted and header-tampered files — for validation testing
• File validation implementation checklist