ByteScope

MP4 file format

MPEG-4 Part 14, the standard ISO-BMFF container for video/audio on the web.

MIME type
video/mp4
Extensions
.mp4
Category
Video

Magic-number signature

0x0000000466747970ftypISO-BMFF 'ftyp' box
0x0000000869736F6Disoma major brand, e.g. 'isom'/'mp42'

About the MP4 format

MP4 is the dominant delivery container for streaming and download video, typically carrying H.264, H.265 or AV1 video alongside AAC audio. It is not a stream of frames but a tree of boxes, each one a big-endian 32-bit size followed by a four-character type, and ISO/IEC 14496-12 requires the FileTypeBox to be the first of them. That is why the recognisable ASCII 'ftyp' sits at offset 4 rather than offset 0: the four bytes in front of it are the size of the box it introduces. Everything a player needs in order to decode — track list, codec parameters, sample tables, timestamps — lives in the 'moov' box, and the compressed samples themselves live in one or more 'mdat' boxes. Nothing in the format says which of the two comes first, and that single unconstrained ordering decision is behind most of the practical trouble people have with MP4 files.

Header layout, byte by byte

OffsetLengthFieldMeaning
04ftyp box sizeBig-endian byte count of the whole FileTypeBox, these four bytes included. 00 00 00 20 is 32 bytes, enough for a major brand, a minor version and four compatible brands. A size of 1 means a 64-bit largesize follows the type; a size of 0 means the box runs to the end of the file. Neither escape hatch is ever used for ftyp.
44Box type 'ftyp'66 74 79 70. This is the actual magic number of every ISO base media file, and it is deliberately not at offset 0 because every box in the format carries its length in front of its name.
84Major brandThe four-character code naming the specification the file claims to follow: isom, iso2, iso5, iso6, mp41, mp42, avc1, or dash for a segmented stream. This is the byte range that separates MP4 from MOV, M4V, M4A, 3GP, AVIF and HEIC, all of which have an identical ftyp box in front of it.
124Minor versionA big-endian 32-bit number that is informative only — the specification says a reader must not reject a file because of it. ffmpeg writes 00 00 02 00 next to the isom brand, and that value shows up in an enormous share of files on the web for no better reason.
16variableCompatible brandsA list of four-character brands, four bytes each, filling whatever is left of the box. A player that does not understand the major brand is allowed to proceed if it recognises any entry here, which is how a dash segment or an avc1 file still opens in a decoder that only knows isom.
328Second box headerSize and type of whatever follows ftyp — 'moov', 'mdat', 'free' or 'wide'. Offset 32 is where it lands when the ftyp box is 32 bytes long, which is the common case but not a rule: read the size at offset 0 instead of assuming the position.

Telling it apart from its neighbours

Easily confused withHow to tell
QuickTime MovieByte-identical for the first eight bytes, and the only thing that separates them is the major brand at offset 8: 'qt ' with two trailing spaces, 71 74 20 20, means QuickTime. There is a second case a brand test misses entirely — QuickTime files written before around 2004 have no ftyp box at all, and open directly with 'moov', 'mdat', 'free', 'skip', 'wide' or 'pnot' at offset 4.
M4VSame box, same layout, brand 'M4V ' (4D 34 56 20, note the trailing space) at offset 8. An unprotected M4V is an MP4 in every respect and renaming the extension is enough; the ones that will not play are FairPlay-protected, and that is visible deeper in the file as encrypted sample entries, not here in the header.
3GPBrand 3gp4, 3gp5 or 3gp6 at offset 8 — 33 67 70 followed by the digit. 3GP is a restricted profile of the same container aimed at mobile handsets, so every box in it is legal MP4 and the reverse is not true: an MP4 carrying H.265 or AC-3 is not a valid 3GP file even though a parser will walk it happily.
AVIFAlso an ftyp box, brand 'avif' or 'avis', and also full of boxes with the same names — but it is a still image, with its picture in an 'meta' box rather than in timed tracks. HEIC is the same story with brands 'heic', 'heix' or 'mif1'. Any tool that decides on 'ftyp' alone will happily call a photograph a video.
WebMNot related at all: WebM and Matroska are EBML files that begin 1A 45 DF A3 at offset 0. Confusion comes from the extensions rather than the bytes, because both carry AV1 and Opus and both play in a browser, so files get renamed between the two and then fail to open.

How these files break

  • The moov box is missing. A recording that stopped when the battery died, or an export killed halfway, leaves a file whose mdat holds every frame and whose index was never written, because most muxers build the moov in memory and append it at the end. The file is large, plainly full of video data in a hex dump, and completely unplayable; recovering it means rebuilding the sample tables from a second, intact file made by the same device.
  • The moov box is at the end and the file is being streamed. Nothing is damaged here at all, but a player fetching the file over HTTP has to download to the end before it can start, which looks exactly like a broken file on a slow connection. Moving the box to the front is what the faststart flag does, and it rewrites offsets rather than re-encoding anything.
  • A truncated download. Because a box declares its length up front, a parser reaches the last complete box and then finds a size field promising more bytes than remain. Well-written readers stop and play what they have; others report the file as corrupt outright even though most of it decoded fine.
  • A box size that lies. A size smaller than 8 is impossible, since the size and type fields alone are 8 bytes, yet a damaged byte can produce one — and a naive parser that adds the size to its cursor then loops forever on the same offset. It is worth checking by hand when a file hangs a tool instead of failing it.
  • Prepended bytes. An HTML error page saved under a .mp4 name, or a stray BOM in front of the real data, pushes 'ftyp' off offset 4. Every chunk offset in the moov box is measured from the start of the file, so even after the junk is identified the file will not play until it is removed, not merely skipped.

Where the format stands today

MP4 is what video on the internet actually is. HLS and DASH deliver it in fragmented form, every phone records into it, every browser and every hardware decoder on the planet plays H.264 inside it, and every editor imports it. Its patent situation is the reason WebM exists, and for royalty-free AV1 and VP9 on the open web WebM took a real share; Matroska took archival use, because it handles many subtitle and audio tracks with less fuss. What keeps MP4 first choice anyway is hardware: an H.264 track in an MP4 decodes on a dedicated block in essentially every phone, television and laptop made in the last fifteen years, which is worth more than a compression win on any device running off a battery. It is also the only container Safari and iOS treat as fully first class, which settles the argument for anyone shipping video to a general audience.

Open MP4 files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with MP4 — compare their leading bytes.

FormatFirst bytesExtension
QuickTime Movie66 74 79 70.mov
M4V66 74 79 70.m4v
M4A66 74 79 70.m4a
WebM1A 45 DF A3.webm
AVIF66 74 79 70.avif

Frequently asked questions

What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Have a file that might be in the MP4 format? Identify it with the File Type Identifier — it reads the magic number locally, nothing is uploaded. Or browse all formats.