What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

OpenType font file format

Q: Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

An OpenType font, typically with CFF/PostScript outlines.

MIME type: font/otf
Extensions: .otf
Category: Fonts

Magic-number signature

0x00000000

4F54544F

OTTO

'OTTO' sfnt tag

About the OpenType font format

OpenType is the joint Microsoft and Adobe successor to both TrueType and Type 1. An .otf file is the same sfnt container a .ttf uses - the same table directory, the same big-endian numbers, the same head, cmap, name and OS/2 tables - but the outlines are cubic Bezier curves written as Type 2 charstrings and stored in a single CFF table, and the tag at offset 0 is the ASCII string OTTO rather than a version number. Everything typographers associate with OpenType, from ligatures and small caps to contextual alternates, lives in the GSUB and GPOS tables and is available to TrueType-flavoured fonts just as much.

Header layout, byte by byte

Offset	Length	Field	Meaning
0	4	sfntVersion	4F 54 54 4F, the ASCII letters OTTO, and the only thing in the entire file that declares the outlines to be PostScript rather than TrueType. The same four bytes turn up at offset 4 of a WOFF or WOFF2 that wraps a CFF font, because the wrapper moves this field back by four.
4	2	numTables	The number of 16-byte table records that follow. Big-endian, and a useful sanity check on its own: a real font carries something between about nine and thirty tables, so a value in the thousands means the file is not an sfnt or the reader is byte-swapping.
6	2	searchRange	The largest power of two not greater than numTables, times 16. A legacy binary-search hint that parsers ignore, and one that real fonts routinely get wrong: Apple ships an OTTO system font whose value disagrees with the formula and which every rasteriser opens without complaint.
8	2	entrySelector	The base-two logarithm of that power of two. Part of the same abandoned hint, carried forward only because removing a field from a directory that every tool on earth reads was never worth the risk.
10	2	rangeShift	numTables times 16, minus searchRange. Third and last of the vestigial fields; a mismatch here says nothing at all about whether the font is healthy.
12	variable	Table records	Sixteen bytes each: tag, checksum, absolute file offset and length, all big-endian. Because records are sorted by tag and the space character sorts ahead of every letter, the first record in an OTTO font is nearly always CFF followed by a space (43 46 46 20), which is a two-second eyeball check that the file is what its header claims.
variable	54	head table	Found through its directory record. Twelve bytes in sits the magic number 5F 0F 3C F5; unitsPerEm is at plus 18, and it is worth knowing that 1000 is conventional for PostScript outlines and 2048 for TrueType but both are legal in either flavour and both occur in shipping fonts, so it is a hint rather than a test.
variable	variable	CFF table	A complete Compact Font Format program embedded whole, with its own header, its own INDEX structures, a top dictionary and the charstrings that draw the glyphs. It is a font inside a font, which is why a damaged CFF table produces a file that passes every sfnt-level check, reports the right family name and metrics, and renders nothing.

Telling it apart from its neighbours

Easily confused with	How to tell
TrueType font	Four bytes at offset 0 and nothing else. 4F 54 54 4F means CFF outlines, 00 01 00 00 means glyf outlines. The extension is unreliable in both directions: an .otf may legally contain TrueType outlines, and the word OpenType describes the wrapper rather than the curves inside it. If you need certainty, look for whether the directory lists a CFF table or a glyf table.
Type 1 (PFB/PFA)	The format OpenType/CFF was built to replace. A binary Type 1 font starts with the PFB segment marker 80 01, and the plain-text variant starts with the literal characters %!PS-AdobeFont. Neither is an sfnt: there is no table directory, no cmap and no way to address glyphs by Unicode code point. Adobe ended support for Type 1 in 2023, and OTTO files are where those outlines were carried over to.
WOFF2 font	A CFF font wrapped for the web reads 77 4F 46 32 at offset 0 and 4F 54 54 4F at offset 4, so the OTTO tag is still there, just displaced. This trips up naive detectors in both directions: one that scans for OTTO anywhere in the first sixteen bytes will call a WOFF2 an OpenType font, and one that checks only offset 0 will report the same file as unknown.
TrueType Collection (.ttc)	A collection can hold CFF fonts as easily as TrueType ones, and it hides both behind the tag 74 74 63 66 (ttcf) at offset 0. The real table directories are at the offsets listed from byte 12 onwards, so an OTTO tag appears deep inside the file rather than at the front - a hex search for OTTO finds it and a check of offset 0 does not.

How these files break

Truncated download. The directory is at the front and survives, so tags and lengths all look right, while the CFF table - which is usually the largest thing in the file and therefore usually last - is the part that got cut. The font lists correctly in a picker and draws nothing.
Text-mode transfer. Line-ending translation inside the CFF charstrings shifts everything after the first 0D 0A pair, and because CFF is a self-describing structure of nested INDEXes, the failure is not a clean error: the parser follows a length field into the middle of something else and reports a problem far from the actual damage.
A stale checkSumAdjustment. Any tool that subsets or patches the font and forgets to recompute the value eight bytes into the head table leaves a font that renders perfectly and fails validation, and invalidates any DSIG table that was signed before the edit.
A renamed web font. A .woff2 downloaded from a font service and given an .otf extension will not install anywhere; the bytes are Brotli-compressed and the first four are wOF2. The error the operating system gives usually says the file is damaged, which sends people looking for a corruption that does not exist.
Prepended junk. A font served through a captive portal or a proxy that returns an HTML error page arrives with a doctype at offset 0. Everything downstream reports an unrecognised font format, and one look at the first sixteen bytes in a hex viewer ends the investigation.

Where the format stands today

OTF is the format type foundries ship. Retail fonts sold by foundries, the libraries bundled with Adobe applications and almost everything aimed at print and editorial design arrive as OTTO files with CFF outlines, because that is the lineage the design world came from and because the cubic curves match how type designers draw. On the web it is in the same position as TrueType: usable through @font-face, never the right answer, superseded by WOFF2 wrapping the identical tables. In PDF it has a role nothing else fills, since a CFF font program can be subset and embedded into a PDF directly, which is why print workflows care about keeping the OTF around rather than only the web build. The variable-font story split here too: variable CFF fonts need CFF2, a newer table, and support for it arrived later and less evenly than for variable TrueType, so a designer shipping a variable family often ends up delivering the TrueType flavour even when the source drawings were cubic.

Open OpenType font files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with OpenType font — compare their leading bytes.

Format	First bytes	Extension
TrueType font	00 01 00 00	.ttf
WOFF font	77 4F 46 46	.woff
WOFF2 font	77 4F 46 32	.woff2