ByteScope

Matroska file format

Matroska, an open multimedia container supporting nearly any codec.

MIME type
video/x-matroska
Extensions
.mkv
Category
Video

Magic-number signature

0x000000001A45DFA3·E··EBML header

The EBML DocType string near the start reads 'matroska'.

About the Matroska format

Matroska is the open container that set out to hold anything: any video codec, any audio codec, an arbitrary number of subtitle tracks, chapters, attachments, tags and per-track languages, all in one file. It is built on EBML, a binary encoding shaped like XML in which every element is a variable-length identifier followed by a variable-length size and then either a value or nested elements. Because sizes are declared rather than implied, a Matroska file can be walked without understanding a single element in it, and a reader can skip whatever it does not know. WebM is the same encoding with a smaller codec list, so the two are identical for their first twenty-one bytes and differ only in the DocType string that names the format.

Header layout, byte by byte

OffsetLengthFieldMeaning
04EBML master element ID1A 45 DF A3, the magic number, and the only field in the file at a position fixed by the specification rather than by convention. WebM has exactly the same four bytes here.
41EBML header sizeA variable-length integer whose leading 1 bit marks it one byte long, the remaining seven bits giving the size of the header body. A3 is 35 in a Matroska file against 9F, 31, in a WebM one — the four-byte difference is the length of 'matroska' minus 'webm'. Writers are allowed to pad this integer to as many as eight bytes.
54EBMLVersion element42 86 81 01 — element ID, a size of 1, and the value 1. Every element in this header carries a default and may legally be omitted, so the offsets below describe what ordinary writers emit rather than a layout the specification guarantees.
94EBMLReadVersion element42 F7 81 01. The minimum EBML version a reader must implement to parse the file. It has never moved off 1.
134EBMLMaxIDLength element42 F2 81 04. The longest element identifier used anywhere in this file, four bytes in practice, which lets a parser fix its buffer sizes before it starts.
174EBMLMaxSizeLength element42 F3 81 08. The longest size field in the file. Eight is the usual value, and it is what makes the unknown-size marker on a live-written Segment eight bytes wide.
212DocType element ID42 82. Names the EBML-based format the file actually is, and the single reason a Matroska file cannot be distinguished from a WebM one by its first twenty bytes.
231DocType length88 — a one-byte variable-length integer holding 8, the length of the string that follows. WebM reads 84 here for its four-character name, and every offset after this point differs by four between the two formats.
248DocType value6D 61 74 72 6F 73 6B 61, the ASCII letters matroska. This is the field that decides the format, and the reason a file-type check has to read at least thirty-two bytes rather than four.
324DocTypeVersion element42 87 81 04. Which revision of the Matroska element set the writer used — 4 covers the additions most current muxers rely on. A reader is expected to skip unfamiliar elements rather than reject the file.
364DocTypeReadVersion element42 85 81 02. The minimum revision needed to parse the file at all, which is deliberately lower than the version above so older readers are not locked out.
404Segment element ID18 53 80 67, the master element containing the entire body of the file: track definitions, clusters of frames, the cue index, chapters, tags and attachments. Its size follows immediately, and it is the unknown-size form in a file still being written.

Telling it apart from its neighbours

Easily confused withHow to tell
WebMThe same encoding with a different name at offset 24: 'matroska' against 'webm'. The tell one byte earlier is quicker — the DocType length at 23 is 88 here and 84 there — and the EBML header size at offset 4 differs for the same reason, A3 against 9F. Codecs are what actually matter: Matroska carries H.264, HEVC, AC-3, DTS and TrueHD, none of which a browser will decode from a WebM-labelled file.
MKAAn .mka is a Matroska file holding only audio, .mks only subtitles, and .mk3d a stereoscopic one. Not one of them has a distinguishing header byte — the DocType reads 'matroska' in every case — so the extension is the writer's claim about the content and the Tracks element is the only place the truth is recorded.
MP4Structurally unrelated: MP4 is a tree of boxes with big-endian 32-bit sizes and 'ftyp' at offset 4, while Matroska is EBML with variable-length identifiers and sizes and its magic at offset 0. They are compared constantly because both can hold H.264 and AAC, and remuxing between them is a lossless copy, but nothing about their bytes is shared.
AVIThe container Matroska was built to replace. AVI is RIFF with little-endian sizes, starting 52 49 46 46 and 'AVI ' at offset 8, and it has no proper support for variable frame rate, modern audio, subtitles or per-track language. A file remuxed from AVI into MKV keeps the same compressed frames and gains all of that.

How these files break

  • An unknown Segment size that was never patched. A muxer writing to a pipe or a live source sets every value bit of the Segment size integer, the all-ones form EBML defines for exactly this case, and is supposed to go back and write the real length when it finishes. Killed partway through, it never does — leaving a file that plays from the beginning, reports no duration and cannot seek.
  • A missing Cues element. The seek index normally goes at the head or the tail of the Segment and is simply absent from anything captured live. Players fall back to scanning clusters, which is slow and inexact on a large file; a straight remux writes a proper index without recompressing a frame.
  • Truncation. Every element states its own length, so a reader walks cleanly to the last complete cluster and then meets a size promising bytes that do not exist. Some players show everything up to that point and stop; others call the whole file corrupt, which is why a partly downloaded MKV opens in one tool and not another.
  • Subtitle text in the wrong encoding. The container records a CodecID and a language per track but not, for the older text formats, a reliable character encoding. A subtitle track written in Big5, GBK or Shift-JIS and read as UTF-8 comes out as mojibake while every byte of video and audio is perfect.
  • A damaged element identifier. Because identifiers and sizes are both variable length, one flipped byte in a size field can make a parser jump into the middle of a frame and read garbage as the next element. The file often still plays, because clusters resynchronise, but a strict parser stops at the point of the flip and reports everything after it as unreadable.

Where the format stands today

Matroska is where video goes to be kept rather than delivered. Anything with multiple audio languages, several subtitle tracks, chapters and attached fonts is an MKV, because no other container handles that combination without argument, and remuxing into it is a lossless copy of the frames rather than a re-encode. It is also the working format of most encoding tools, which is why files from them arrive as .mkv even when the contents would fit an MP4 perfectly. Where it loses is reach: no browser plays it, iOS and most televisions refuse it, and hardware players support it unevenly enough that the safe answer for anything being sent to someone else is still MP4. The usual pattern is to archive in Matroska and export to MP4, and because the video inside is untouched, that export is a container swap rather than a quality loss.

Open Matroska files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with Matroska — compare their leading bytes.

FormatFirst bytesExtension
WebM1A 45 DF A3.webm
MP466 74 79 70.mp4
AVI52 49 46 46.avi

Frequently asked questions

What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Have a file that might be in the Matroska format? Identify it with the File Type Identifier — it reads the magic number locally, nothing is uploaded. Or browse all formats.