Binary Hex Editor | View and Edit Files in Hexadecimal
Drag and drop a file to view its contents as a byte-by-byte hex dump. Identify the true file type via magic bytes, edit individual bytes, and download the result. Nothing is ever uploaded to a server.
Common file signatures (magic numbers)
| Format | Leading bytes (hex) | Offset | Note |
|---|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | 0 | Image file. All 8 bytes matching confirms PNG with near certainty |
| JPEG | FF D8 FF | 0 | Image file. The 4th byte varies by variant (JFIF, Exif, etc.) |
| GIF | 47 49 46 38 39 61 / 47 49 46 38 37 61 | 0 | The ASCII string "GIF89a" or "GIF87a" |
| 25 50 44 46 2D | 0 | The ASCII string "%PDF-", followed by the version number | |
| ZIP / docx / xlsx / jar | 50 4B 03 04 | 0 | ZIP format. Office Open XML and many archive formats are internally ZIP |
| Windows executable (EXE/DLL) | 4D 5A | 0 | The ASCII string "MZ" - a legacy MS-DOS header still present in the PE format |
| ELF executable | 7F 45 4C 46 | 0 | Executables and shared libraries used on Linux and similar systems |
Tips for using the hex editor
- To unmask a file whose extension was changed, compare its leading bytes (magic bytes) against the table above. An extension is just a label, but magic bytes come from the format itself and are far harder to fake.
- In manual hex mode you can paste byte sequences copied from other tools (space-separated or newline-separated both work) and load them directly.
- If you click the wrong cell while editing, press Esc to cancel that cell's edit without changing the byte.
- When debugging a binary protocol, line up the bytes you expected against what was actually sent or received in this tool to spot exactly where they diverge.
Frequently asked questions
FF D8 FF, it is very likely a JPEG image regardless of its extension.
Side Note — Why a file's true identity is in its bytes, not its extension
A file extension is just a hint that tells the operating system which application to open a file with — it is a label that exists independently of the file's actual content. Renaming `photo.jpg` to `notes.txt` does not turn it into text, and stripping the extension from a real image does not erase the image data underneath. Because this label is essentially self-declared, malware has long exploited it to disguise executables as innocuous images or documents.
To work around this, most file formats embed a unique identifier — called magic bytes or a magic number — in their first few bytes. A PNG file, for example, always begins with the exact 8-byte sequence `89 50 4E 47 0D 0A 1A 0A` as defined by the specification. This means an operating system or application can only be truly confident about a file's format after inspecting its actual content, not its name. Unix's `file` command and browsers' MIME-type sniffing both rely primarily on matching these magic bytes rather than trusting the extension.
Some magic byte sequences carry a clever design history. PNG's 8 bytes deliberately include a line-ending sequence (0D 0A) specifically so that file transfers over text-mode channels — which sometimes mangle line endings — can be detected as corrupted. Far from being an arbitrary identifier, it doubles as a built-in corruption check, a small detail that hints at just how much thought goes into binary format design.