ByteScope

QuickTime Movie file format

Apple QuickTime container, the ancestor of the modern MP4 format.

MIME type
video/quicktime
Extensions
.mov
Category
Video

Magic-number signature

0x0000000466747970ftypISO-BMFF 'ftyp' box
0x0000000871742020qt brand 'qt '

About the QuickTime Movie format

MOV is Apple's QuickTime container and the direct ancestor of MP4 — ISO took the QuickTime file format as the starting point for the ISO base media file format, so the two share a box structure, most box names and much of their semantics. A modern QuickTime file announces itself with the same FileTypeBox every MP4 has, carrying the brand 'qt ' with two trailing spaces. Files written before that box was introduced have no header magic at all: they simply begin with the first real box, which is why a detector for MOV cannot rely on a single fixed byte string the way one for PNG can. Where MOV genuinely differs from MP4 is in what it is allowed to contain — timecode tracks, ProRes and DNxHD video, edit lists that trim and reorder without re-encoding, and reference movies that point at media in other files entirely.

Header layout, byte by byte

OffsetLengthFieldMeaning
04ftyp box sizeBig-endian length of the FileTypeBox including these four bytes. 00 00 00 14 is 20, which is the smallest useful size: a type, a major brand, a minor version and exactly one compatible brand. MP4 files are usually longer here because they list several compatible brands.
44Box type 'ftyp'66 74 79 70, the same FileTypeBox every ISO base media file carries. Its presence says nothing about which format this is; only the brand that follows does.
84Major brand 'qt '71 74 20 20 — the letters q and t followed by two ASCII spaces, which are part of the brand and not padding to be trimmed. A great many tools strip trailing whitespace from four-character codes and then fail to match this one.
124Minor versionA big-endian 32-bit number, informative only. ffmpeg writes 00 00 02 00 here; Apple's own writers put a build-date-shaped value in this field instead. Neither is a constraint, and no reader should reject a file over it.
16variableCompatible brandsThe remainder of the box, four bytes per brand. A QuickTime file commonly lists just 'qt ' again. When a MOV also lists isom or mp42 here it is telling you the contents are within what a plain MP4 reader can handle.
208Second box headerIn a 20-byte ftyp this is the next box, and in QuickTime output it is very often 'wide' — an 8-byte placeholder box that exists only so the 'mdat' behind it can later be promoted to a 64-bit size without shifting the file. Otherwise expect 'moov', 'mdat' or 'free'.
44Legacy first box typeIn a pre-2004 QuickTime file there is no ftyp box, and this same position instead holds the type of the first real box: 'moov', 'mdat', 'free', 'skip', 'wide' or 'pnot'. The offset is the same, the meaning is not, and that ambiguity is why MOV detection is confidence-based rather than exact.

Telling it apart from its neighbours

Easily confused withHow to tell
MP4Identical through offset 7. The decision is entirely the major brand at offset 8: 'qt ' means QuickTime, while isom, iso2, mp41, mp42 or avc1 mean MP4. Beyond the header the real difference is content — a MOV holding ProRes, DNxHD or a timecode track is legal QuickTime and not something a general MP4 player will decode, even though every box in it parses cleanly.
M4VBrand 'M4V ' at offset 8 rather than 'qt '. Both come out of Apple's ecosystem and both frequently hold H.264 and AAC, so the extension tells you where the file came from rather than what is inside it. Renaming one to the other works far more often than it should, which is exactly why people end up in a hex editor when it does not.
AVIThe other container that still turns up in older capture and editing workflows, and not remotely similar in structure: AVI is RIFF, starting 52 49 46 46 at offset 0 with the form type 'AVI ' at offset 8. Sizes there are little-endian, while every size in a QuickTime file is big-endian — a good sanity check when you are unsure which one you are reading.
3GPAlso an ftyp box, brands 3gp4, 3gp5 or 3gp6. The practical difference is scope: 3GP restricts codecs and box usage to what a handset could manage, while QuickTime deliberately does the opposite and allows almost anything, including references to media stored in a completely different file.

How these files break

  • A recording that never got its moov box. This is the classic broken MOV: a camera or a screen recorder that lost power writes all its frames into mdat and dies before appending the index, leaving a multi-gigabyte file that no player will open. The frames are all there and recoverable, but only by borrowing the sample-table structure from a healthy file shot on the same device with the same settings.
  • A reference movie whose media moved. QuickTime lets a MOV point at samples living in other files, so an edit can be saved without copying any video. Move or rename the source and the MOV is still perfectly valid — it opens, it shows the right duration, and it plays nothing, which reads as corruption but is not.
  • Truncation. Because the ftyp box is tiny and lives at the front, the header stays healthy no matter how much of the tail is lost. What actually tells you is walking the boxes: the last one declares a size that runs past the end of the file.
  • Text-mode transfer or a stripped brand. Any process that rewrites bytes it thinks are text can trim the two ASCII spaces in the 'qt ' brand at offset 8, and a strict reader then rejects a file that is otherwise byte-for-byte intact.
  • An edit list that hides the picture. A damaged or oddly written 'elst' box can start playback at an offset past the end of the media, producing a file that opens, reports a duration, and shows nothing but black. It is a header-level problem, not a decoder one, and it survives a straight remux.

Where the format stands today

MOV lives on the production side rather than the delivery side. Final Cut Pro and Avid work in it, ProRes and DNxHD are distributed in it, cameras from Canon, Blackmagic and RED record it, and macOS screen recordings are MOV files by default. Nothing has replaced it there, because the things it does that MP4 does not — timecode tracks, alpha channels, huge intermediate codecs, edit lists, reference movies — are exactly what an editing workflow needs. For anything leaving that workflow it is the wrong choice: MP4 with H.264 or H.265 plays everywhere, and a ProRes MOV is both enormous and undecodable on most machines. In practice the last step of almost every project that starts in MOV is an export to MP4, and the MOV stays behind as the master.

Open QuickTime Movie files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with QuickTime Movie — compare their leading bytes.

FormatFirst bytesExtension
MP466 74 79 70.mp4
M4V66 74 79 70.m4v
AVI52 49 46 46.avi

Frequently asked questions

What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Have a file that might be in the QuickTime Movie format? Identify it with the File Type Identifier — it reads the magic number locally, nothing is uploaded. Or browse all formats.