MD5, SHA-1 and SHA-256 of any file, with ready VirusTotal and MalwareBazaar search links.
New
File Type Sniffer
Runs locallyNew
Use File Type Sniffer
What it does
Drop a file to see what it really is, judged by its bytes rather than its name, and whether the name, extension or contents try to hide that. Nothing is uploaded or opened.
It runs entirely in your browser: nothing you enter is uploaded.
Example
HTML smuggling attachment
Invoice_0425.pdf.html
<html><body><script>
var data = atob('UEsDBBQAAAAIAA==');
var blob = new Blob([data], {type: 'application/zip'});
var a = document.createElement('a');
a.href = URL.createObjectURL(blob);
a.download = 'Invoice_0425.zip';
a.click();
</script></body></html>Invoice_0425.pdf.html
254 B (254 bytes) · read 254 B
DETECTED TYPE
HTML document
KIND
web page text/html
EXTENSION
.html matches
.html fits HTML document.
Danger: HTML smuggling pattern: script decodes embedded data and offers it as a download (Blob/atob/msSaveOrOpenBlob).
Warning: Double extension: ".pdf" is decoration, the real extension is ".html" (a web page posing as a document, typical of phishing attachments).
Text encoding
UTF-8 or ASCII
Script and form hints
script element; atob() Base64 decoding; Blob construction; URL.createObjectURL(); forced download (download attribute)
FIRST 64 BYTES
0000 3C 68 74 6D 6C 3E 3C 62 6F 64 79 3E 3C 73 63 72 <html><body><scr
0010 69 70 74 3E 0A 76 61 72 20 64 61 74 61 20 3D 20 ipt>.var data =
0020 61 74 6F 62 28 27 55 45 73 44 42 42 51 41 41 41 atob('UEsDBBQAAA
0030 41 49 41 41 3D 3D 27 29 3B 0A 76 61 72 20 62 6C AIAA==');.var bl
Copy hex dump
Next: HTML Attachment Analyzer (inspect scripts, forms and embedded payloads); File Hash Calculator (hash the file for VirusTotal and MalwareBazaar lookups). Open it and drop the same file there.The first line becomes the file name and the rest its content. The sniffer reports an HTML document, flags the .pdf.html double extension and the HTML smuggling pattern (atob, Blob and a forced download), and points to the HTML Attachment Analyzer.
FAQ
How does the sniffer decide what a file is?
It compares the first bytes, and fixed offsets such as 0x8001 for ISO images or 257 for TAR, with about 100 format signatures, then looks inside ZIP, OLE2, PE, LNK, PDF and RTF structures: Office parts and macros, MSI and Outlook streams, EXE or DLL and CPU type, shortcut targets and PDF action keywords. Text files are classified by markers such as a shebang line, HTML tags or PowerShell syntax.
What can it miss or get wrong?
Text formats are recognised by heuristics, so a short script can be reported as plain text, and PDF keywords inside compressed object streams are not visible to it. It describes the file type and disguise tricks but does not scan for malware, so a clean result is not a verdict.
Is the file uploaded or opened?
No. The browser reads only the byte ranges it needs from the file on your device, nothing is executed or rendered, and nothing is sent over the network.