# File Type Sniffer

URL: https://phishdestroy.io/developer-tools/file-type-sniffer
Category: Files & pages
Where it runs: Runs locally (nothing you enter is uploaded)

Drop a file to see what it really is, judged by its bytes rather than its name, and whether the name, extension or contents try to hide that. Nothing is uploaded or opened.

## Example input

HTML smuggling attachment

```
Invoice_0425.pdf.html
<html><body><script>
var data = atob('UEsDBBQAAAAIAA==');
var blob = new Blob([data], {type: 'application/zip'});
var a = document.createElement('a');
a.href = URL.createObjectURL(blob);
a.download = 'Invoice_0425.zip';
a.click();
</script></body></html>
```

The first line becomes the file name and the rest its content. The sniffer reports an HTML document, flags the .pdf.html double extension and the HTML smuggling pattern (atob, Blob and a forced download), and points to the HTML Attachment Analyzer.

## FAQ

### How does the sniffer decide what a file is?

It compares the first bytes, and fixed offsets such as 0x8001 for ISO images or 257 for TAR, with about 100 format signatures, then looks inside ZIP, OLE2, PE, LNK, PDF and RTF structures: Office parts and macros, MSI and Outlook streams, EXE or DLL and CPU type, shortcut targets and PDF action keywords. Text files are classified by markers such as a shebang line, HTML tags or PowerShell syntax.

### What can it miss or get wrong?

Text formats are recognised by heuristics, so a short script can be reported as plain text, and PDF keywords inside compressed object streams are not visible to it. It describes the file type and disguise tricks but does not scan for malware, so a clean result is not a verdict.

### Is the file uploaded or opened?

No. The browser reads only the byte ranges it needs from the file on your device, nothing is executed or rendered, and nothing is sent over the network.

## Related tools

- [File Hash Calculator](https://phishdestroy.io/developer-tools/file-hash)
- [HTML Attachment Analyzer](https://phishdestroy.io/developer-tools/html-attachment-analyzer)
- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [Multi-Layer Decoder](https://phishdestroy.io/developer-tools/multi-layer-decoder)
- [X.509 Certificate Decoder](https://phishdestroy.io/developer-tools/x509-decoder)

All tools: https://phishdestroy.io/developer-tools