File Signature (Magic Bytes) Reference

What are magic bytes?

Most file formats include a fixed byte sequence at the start of the file — the "magic bytes" or "file signature". The OS and applications use this to detect file type. File extensions are easy to spoof; magic bytes are a reliable binary-level identifier, making them essential for trustworthy upload validation.

Linux's file command and PHP's finfo class detect MIME types using this mechanism.

Image files

Documents & archives

Text & data formats

Audio & video

Executables & other

Magic byte validation in PHP

 ['offset' => 0, 'bytes' => "\x89PNG\r\n\x1a\n", 'length' => 8],
        'jpg'  => ['offset' => 0, 'bytes' => "\xFF\xD8\xFF",       'length' => 3],
        'gif'  => ['offset' => 0, 'bytes' => "GIF8",               'length' => 4],
        'pdf'  => ['offset' => 0, 'bytes' => "%PDF-",              'length' => 5],
        'zip'  => ['offset' => 0, 'bytes' => "PK\x03\x04",         'length' => 4],
        'exe'  => ['offset' => 0, 'bytes' => "MZ",                 'length' => 2],
    ];

    if (!isset($signatures[$expectedType])) {
        throw new \InvalidArgumentException("Unknown file type: $expectedType");
    }

    $sig = $signatures[$expectedType];
    $handle = fopen($filePath, 'rb');
    if ($sig['offset'] > 0) fseek($handle, $sig['offset']);
    $header = fread($handle, $sig['length']);
    fclose($handle);

    if (substr($header, 0, $sig['length']) !== $sig['bytes']) {
        throw new \RuntimeException("Magic bytes do not match (expected: $expectedType)");
    }
}

// Usage
validateMagicBytes($_FILES['upload']['tmp_name'], 'png');
echo "Valid PNG file";

Related resources

• MIME types reference — extensions and Content-Type mapping
• Broken files / corrupted headers — for validation testing