ByteScope

M4A file format

MPEG-4 audio, typically AAC-encoded, in an ISO-BMFF container.

MIME type
audio/mp4
Extensions
.m4a
Category
Audio

Magic-number signature

0x0000000466747970ftypISO-BMFF 'ftyp' box
0x000000084D344120M4A brand 'M4A '

About the M4A format

M4A is AAC (or ALAC) audio in an MP4 container, the format iTunes and Apple Music use for downloads. It is an ISO-BMFF file whose 'ftyp' brand is 'M4A '. ISO-BMFF is a tree of boxes, each one a big-endian 32-bit size followed by a four-character type, and that is the entire structural grammar — 'ftyp' declares what dialect the file speaks, 'moov' is the index that makes it playable, and 'mdat' holds the encoded frames. Because the index is a separate box from the data, an M4A can be perfectly intact byte for byte and still be unplayable if the wrong end of it went missing.

Header layout, byte by byte

OffsetLengthFieldMeaning
04ftyp box sizeBig-endian, and that is worth dwelling on: everything in an ISO-BMFF file is big-endian, the exact opposite of RIFF. A typical value is 00 00 00 1C, 28 bytes. A size of 1 means a 64-bit largesize follows the type field; a size of 0 means the box runs to the end of the file.
44Box type 'ftyp'66 74 79 70. It sits at offset 4 rather than 0 because the size comes first, which is why every MP4-family detector matches four bytes in and why nothing in this family has a magic number at the very start of the file.
84Major brand4D 34 41 20 — the letters M4A and a trailing space, since brands are always four characters. This one field is the only difference between an M4A, an MP4 ('isom' or 'mp42'), an M4V, a 3GP ('3gp4'), an AVIF ('avif') and a HEIC ('heic').
124Minor versionA big-endian version number of the brand, not of the file format. Apple-lineage files traditionally carry 00 00 02 00, which is 512, and readers are told to ignore it rather than treat it as a compatibility gate.
16variableCompatible brandsA list of four-byte brands filling the rest of the ftyp box — commonly 'M4A ', 'isom', 'iso2'. A player that does not recognise the major brand is allowed to play the file anyway if it recognises any brand in this list, which is how new formats stay openable by old software.
variable8Next box headerStarts wherever the ftyp size said it does — 28 for the common one-brand-plus-three-compatible-brands box — and is again a four-byte size then a four-byte type. Real files put 'free', 'moov' or 'mdat' next, so no offset beyond the ftyp box is fixed.
variablevariable'moov' boxThe index: track list, timescale, duration, codec configuration and the sample tables that map every frame to a byte offset and a timestamp. Without it nothing can play, and it may legally sit at either end of the file.
variablevariable'mdat' boxThe encoded audio frames themselves, with no internal index — it is just bytes, and only the sample tables in 'moov' give them meaning. Its own position is not fixed either: an eight-byte 'free' box after a 28-byte ftyp puts 'mdat' at offset 36, and then 'moov' begins wherever mdat's own length runs out.
variable4Codec four-character code inside 'moov'Buried in the sample description: 'mp4a' for AAC and 'alac' for Apple Lossless. Both are legal in a file whose brand says M4A, so the brand tells you the container dialect and this tells you what the audio actually is.

Telling it apart from its neighbours

Easily confused withHow to tell
MP4Byte-identical for the first eight bytes, and byte-identical in structure thereafter. The brand at offset 8 is the whole difference: 'M4A ' versus 'isom' or 'mp42'. Worse, plenty of audio-only files are written with brand 'isom', so brand alone cannot prove there is no video — for that you have to walk into 'moov' and count the tracks.
QuickTime MovieQuickTime is the format ISO-BMFF was standardised from, so the box grammar is the same. A modern .mov carries brand 71 74 20 20 ('qt ' with two trailing spaces) at offset 8, and typically a 'wide' box right after ftyp that no MP4 writer emits. That combination is the reliable tell.
3GPSame container again, with brands '3gp4', '3gp5' or '3gpp' at offset 8. The practical difference is what is allowed inside: 3GP profiles restrict the codecs to what mobile networks agreed on, so a file can be a structurally valid MP4 and still be rejected by a 3GP-only decoder.
ADTS AACA raw .aac file has no boxes at all. It is a bare stream of ADTS frames, each beginning with a twelve-bit sync word, so the file opens FF F1 or FF F9. The audio may be the very same AAC bitstream that an M4A carries, but with no ftyp, no moov and no seek table it is a different file entirely.
MP3Constantly confused because both are 'compressed audio you bought', but MP3 is a bare frame stream starting with an 'ID3' tag or a frame sync, and it has no container, no sample table and no standard way to carry cover art outside the ID3 tag. Nothing about the first sixteen bytes resembles an ISO-BMFF box.

How these files break

  • The index at the wrong end plus a truncated download. Encoders write 'mdat' first and 'moov' last unless asked to relocate it, so a download that stops at 95 per cent contains almost all of the audio and none of the index, and nothing will play a single second of it. Running a faststart pass moves 'moov' to the front and is why streaming servers insist on it.
  • Inserted or removed bytes ahead of 'mdat'. The sample tables store absolute file offsets, so gluing an ID3 tag on the front or stripping a stray prefix desynchronises every frame pointer at once. Unlike a ZIP, where readers can recompute the shift, an MP4 gives no signal that the offsets moved — playback simply produces noise or nothing.
  • A box size below 8, or 0 in the middle of a file. A parser that trusts the field either loops forever on a zero-length box or walks off the end of the buffer; hardened readers reject any size under 8 outright, and this is a classic fuzzing target for media libraries.
  • The four-gigabyte chunk-offset wall. The ordinary chunk-offset table is 32-bit, so a file past four gigabytes needs the 64-bit variant instead. A writer that never emits it produces an archive whose later offsets wrap, and playback breaks abruptly partway through a long recording.
  • Text-mode transfer. Line-ending translation inside the encoded frames leaves the box tree perfectly parseable, so the file reports its correct duration and codec and then plays as static — the metadata is untouched because the damage is all in 'mdat'.

Where the format stands today

M4A is what modern purchased and streamed music actually is. Apple built it as the iTunes download format, and AAC in an MP4 container is now the default for the Apple ecosystem, for YouTube's audio tracks, for most podcast feeds and for voice memos on both major phone platforms; ALAC in the same container covers the lossless tier. It replaced MP3 for essentially everything new, because AAC is meaningfully better at the same bitrate and because the container brings real metadata, chapters and cover art rather than a tag bolted on the end. Where it is not first choice is anything latency-sensitive or open-stack: Opus in Ogg or WebM beats AAC at low bitrates and carries no licensing baggage, so voice chat and WebRTC went that way. For production work nobody edits M4A at all — you decode to WAV, edit, and re-encode once, because AAC is lossy and every re-encode compounds.

Open M4A files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with M4A — compare their leading bytes.

FormatFirst bytesExtension
MP349 44 33.mp3
MP466 74 79 70.mp4
FLAC66 4C 61 43.flac

Frequently asked questions

What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Have a file that might be in the M4A format? Identify it with the File Type Identifier — it reads the magic number locally, nothing is uploaded. Or browse all formats.