How to Open an Unknown File: By Extension and Signature
You found a file on an old drive with a baffling extension — or no extension at all. Double-clicking does nothing, Windows asks you to "choose a program," and you have no idea which. Don't guess: files carry a "fingerprint" in their first bytes that tells you the exact format. Here's how to read it — even with zero technical background.
Step 1: look at the extension
An extension is the letters after the dot in a filename: photo.jpg, report.pdf, archive.zip. It's exactly what the operating system uses to decide which program opens the file. That's the first thing to check.
The catch is that in Windows extensions are often hidden by default. To see them, open the "View" tab in File Explorer and enable "File name extensions." You may discover the file isn't "extensionless" at all — the extension was just hidden.
But the extension has a weak spot: it's just text in the name, easy to change by hand or lose in transit. You can rename picture.png to picture.txt — the contents don't change, but the system gets confused. So the extension is a hint, not the final word.
The key idea
An extension can be faked; the file's contents can't. The true format is always baked into the file's first bytes. That's the reliable way to identify it.
Step 2: read the signature (magic bytes)
Nearly every file format begins with a unique sequence of bytes — called the signature, or "magic bytes" (magic number). Think of it as a barcode at the very start of the file. Programs read those bytes and know what they're dealing with — regardless of the extension in the name.
The most famous examples are easy to remember: every PNG starts with the bytes 89 50 4E 47 (where 50 4E 47 spells "PNG"). Every JPEG starts with FF D8 FF. Every PDF starts with the characters %PDF. And a ZIP archive (plus everything ZIP-based: docx, xlsx, jar) starts with PK — the initials of the format's creator, Phil Katz.
Signature table for popular formats
Here's a cheat sheet for the most common formats. On the left are the bytes in hexadecimal (as a hex editor shows them); on the right is how they read as text. Almost all sit at the very start of the file (offset 0):
| Format | Signature (hex) | Text |
|---|---|---|
| PNG | 89 50 4E 47 | ‰PNG |
| JPEG | FF D8 FF | — |
| GIF | 47 49 46 38 | GIF8 |
25 50 44 46 | ||
| ZIP / DOCX | 50 4B 03 04 | PK.. |
| RAR | 52 61 72 21 | Rar! |
| 7z | 37 7A BC AF | 7z.. |
| PSD | 38 42 50 53 | 8BPS |
| XCF (GIMP) | 67 69 6D 70 | gimp |
| EPS / PostScript | 25 21 50 53 | %!PS |
The MP4 trick (and others)
Not all signatures sit at the very start. In an MP4 video, the ftyp marker is at offset 4, not 0. That's why online detectors read the first few dozen bytes rather than just the first three.
How to view a file's first bytes
To see the signature with your own eyes, you need a hex editor — a program that shows a file's contents as raw bytes. It's simpler than it sounds:
Open a hex editor
Free options: HxD (Windows), in-browser online hex viewers, or — if you're comfortable with it — the built-in xxd command on a Mac. The easier options above work for everyone.
Drag in the file
The editor shows the contents: bytes in hex on the left, their text representation on the right.
Look at the first line
Compare the first 3–4 bytes with the table above. A match is the real format.
If you see readable text at the start like %PDF or GIF8, the format is obvious. If the first bytes match FF D8 FF, you have a JPEG photo — whatever the file is named.
Online format detectors
If you'd rather not bother with a hex editor, there's an even easier route — online signature detectors. You upload the file, the service reads its first bytes, compares them with a large database of known signatures, and reports the real type. No technical knowledge needed — you get a result in a second.
They're handy too because such services know hundreds of formats, including rare ones that are hard to identify by hand. In effect they automate exactly what you'd do in a hex editor.
Safety: what to watch out for
Before opening an unknown file with a double-click — identify its type. That's not paranoia, it's common sense, especially if the file came from an untrusted source.
Dangerous extensions
Be especially wary of .exe, .scr, .bat, .cmd, .js, .vbs — these are executables and scripts that can contain malicious code. Images, documents and archives are relatively safe, but a file from an untrusted source is best run through antivirus. And remember: malware can disguise itself as an image by changing the extension — so checking the signature also protects you from spoofing.
What to do after identifying it
You've learned the format — great. The rest is easy. If the extension was wrong or missing, rename the file with the correct extension (e.g. .png or .pdf), and it'll open in the right program.
If the format turns out to be exotic and you don't have the right program handy, the most universal route is to convert the file into a familiar format. An image — to PNG or JPG, and any viewer will show it. A document — to PDF. That saves you hunting down and installing special software.
Found it's an image? Open it in one click
The FormatZ converter accepts dozens of graphics formats and saves them as a plain PNG or JPG — right in your browser, no install. See the full list of supported formats.
Browse all formatsIf it turns out to be a designer file — PSD, EPS or XCF — see our guide "How to open designer files." And the specific converters are right here: PSD to PNG, EPS to PNG and SVG to PNG.
