File Signatures (Magic Numbers)

Name: File Signatures (Magic Numbers)
Creator: staticdata.dev
License: https://creativecommons.org/licenses/by-sa/4.0/

File signatures — often called magic numbers — are fixed byte sequences at a known offset in a file that identify its format independently of the filename or extension. This dataset has 210 signature records for common formats across images (PNG, JPEG, GIF, WebP, HEIC), archives (ZIP, GZIP, XZ, 7-Zip, RAR), executables (ELF, Mach-O, PE/MZ), documents (PDF, Office formats, RTF), audio (MP3, FLAC, WAV, Ogg), video (MP4, MKV, AVI), databases, fonts, and more.

v1.0.0 CC-BY-SA-4.0 210 records Updated 2026-10-05 stable Source: Wikipedia: List of file signatures, Gary Kessler's File Signatures Table (last GCK version)

Quick fetch

Stable URL. CORS-enabled. No auth.

bash

curl https://staticdata.dev/v1/file-signatures.json

Or use as a typed import: import { fileSignatures } from "https://staticdata.dev/v1/file-signatures.ts"

Formats

JSON 28.8 KB

/v1/file-signatures.json

Open

min: 22.7 KB · /v1/file-signatures.min.json
CSV 11.0 KB

/v1/file-signatures.csv

Open
TypeScript 29.0 KB

/v1/file-signatures.ts

export const fileSignatures

type FileSignature = (typeof fileSignatures)[number]

Open

Schema

Each record in the dataset has the following shape.

Schema
Field	Type	Description	Example
extension	string	Common file extension (without leading dot)	png
hexSignature	string	Hex bytes of the magic number; ?? denotes a wildcard byte	89 50 4E 47 0D 0A 1A 0A
offset	number	Byte offset from the start of the file where the signature begins	0
description	string	Human-readable description of the file format	Portable Network Graphics image

Preview

First 10 records.

Data preview
extension	hexSignature	description
png	89 50 4E 47 0D 0A 1A 0A	Portable Network Graphics image
jpg	FF D8 FF E0	JPEG/JFIF image
jpg	FF D8 FF E1	JPEG with EXIF metadata
jpg	FF D8 FF E2	JPEG with ICC color profile
jpg	FF D8 FF E8	JPEG SPIFF image
gif	47 49 46 38 37 61	GIF image (version 87a)
gif	47 49 46 38 39 61	GIF image (version 89a)
bmp	42 4D	BMP/DIB bitmap image
tiff	49 49 2A 00	TIFF image (little-endian)
tiff	4D 4D 00 2A	TIFF image (big-endian)

Showing 10 of 210. View full data: JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl

curl -sSL https://staticdata.dev/v1/file-signatures.json | jq '.[0]'

JavaScript

import type { FileSignature } from "https://staticdata.dev/v1/file-signatures.ts";

const res = await fetch("https://staticdata.dev/v1/file-signatures.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const fileSignatures: FileSignature[] = await res.json();
console.log(fileSignatures[0]);

Python

import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/file-signatures.min.json") as r:
    fileSignatures = json.load(r)

print(fileSignatures[0])

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/file-signatures.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}

Rust

use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/file-signatures.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

File signatures (magic numbers) are byte patterns at a known position in a file that reliably identify its format without relying on the filename extension. Tools like file(1) on Unix, the libmagic library, and many security scanners use these patterns to classify content. This dataset was curated from the widely-cited Wikipedia list of file signatures and cross-referenced against Gary Kessler’s comprehensive signatures table.

Each record pairs an extension with the hexSignature — space-separated uppercase hex octets where ?? indicates a wildcard byte that may take any value (common in container formats whose size appears at a fixed position). The offset field gives the byte position where the pattern should match; most signatures start at offset 0, but some (e.g., ISO 9660, TAR ustar, Embedded OpenType) are found deeper inside the file. A negative offset counts from the end of the file (the TGA footer record uses -18). A single format may have multiple records when it has format variants (e.g., JPEG/JFIF vs. JPEG/EXIF) or when the same extension covers multiple binary layouts.

The dataset covers images, archives, executables, documents, audio, video, databases, fonts, certificates, virtual machine images, game ROMs, and more — 210 records representing the formats developers and security tools encounter most often. ZIP-based containers (DOCX, XLSX, EPUB, APK, JAR) correctly share the ZIP signature 50 4B 03 04; distinguishing them further requires inspecting the ZIP central directory. Several formats (Office/MSI Compound Binary, ELF objects, Mach-O, RIFF, Ogg, Matroska) likewise share a signature with other formats.

Because the list was compiled from Wikipedia’s “List of file signatures” (CC BY-SA 4.0), this dataset is distributed under CC-BY-SA-4.0; credit Wikipedia contributors and Gary Kessler’s table when reusing it.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the file-signatures changelog for this dataset's history.

Related datasets

mime-types