ByteScope

Parquet file format

Apache Parquet, a columnar storage format for big-data analytics.

MIME type
application/vnd.apache.parquet
Extensions
.parquet
Category
Data & databases

Magic-number signature

0x0000000050415231PAR1'PAR1' header
-0x0000000450415231PAR1'PAR1' footer (last 4 bytes)

About the Parquet format

Parquet stores a table column by column instead of row by row, so a query that touches three columns out of a hundred reads only those three, and each column compresses far better because neighbouring values share a type and usually a narrow range. Everything descriptive — the schema, the row groups, each column chunk's offset, codec and min/max statistics — is serialized with Thrift's compact protocol and written after the data, which is why the file is anchored at both ends: PAR1 at offset 0 announces the format to a scanner, and PAR1 at the very end anchors the footer a reader actually starts from.

Header layout, byte by byte

OffsetLengthFieldMeaning
04File magic 'PAR1'The four bytes 50 41 52 31. It exists so a tool scanning the front of a file can name the format; no reader parses anything else from this end. A file written with an encrypted footer carries the magic PARE here and at the tail instead, which tells the reader to expect file crypto metadata ahead of the footer.
4variableFirst column chunkData begins immediately after the magic — page after page of encoded values, each introduced by a Thrift compact PageHeader. There is no schema, no index and no row count at the front, so the first megabyte of a Parquet file tells you almost nothing about what is in it.
variablevariableFileMetaData (Thrift compact)The schema, the row groups and every column chunk's offset, codec, encodings and statistics. It sits directly before the last eight bytes, and a reader finds its start by subtracting the footer length from that position — never by scanning forward from offset 0.
-84Footer lengthUnsigned 32-bit little-endian byte count of the FileMetaData that precedes it. A reader seeks to the last eight bytes, checks the magic, reads this number and seeks back that many bytes. A wrong value here is fatal even when every data page is intact.
-44Trailing magic 'PAR1'The same four bytes as offset 0 — PARE when the footer is encrypted. Because the format is anchored at the tail, these are the bytes every reader tests first, which is why a half-downloaded Parquet file is rejected outright despite a perfectly good header.

Telling it apart from its neighbours

Easily confused withHow to tell
ORCThe other columnar format in the same pipelines, and the footer-at-the-end design is the same. ORC opens with the three bytes 4F 52 43 ('ORC') rather than a four-byte magic, and its last byte is not a magic at all but the postscript length, a single value under 256. So read the last four bytes: PAR1 means Parquet, an arbitrary small byte means ORC.
Avro OCFAvro object container files come out of the same ingestion jobs but are row-oriented and self-describing. The header is the four bytes 4F 62 6A 01 ('Obj' followed by 1), then a metadata map holding avro.schema and avro.codec, then a 16-byte sync marker. There is no trailing magic, so an Avro file can be appended to and still read while a Parquet file cannot.
Encrypted Parquet (PARE)Same layout, different magic at both ends: PARE instead of PAR1, chosen deliberately so an older reader fails on the magic rather than on unreadable Thrift. When the footer is encrypted the four-byte length before the trailing magic covers the crypto metadata plus the encrypted footer, so the number is larger than the plaintext case for the same table.
SQLite databaseBoth get handed around as 'the analytics file' and both are single-file, but SQLite is a row store with its magic in the first sixteen bytes and no trailing marker whatsoever. If offset 0 reads PAR1 and the last four bytes read PAR1, nothing about the middle needs checking.

How these files break

  • Truncated tail. Anything that stops a transfer early — a killed object-store download, a writer process that died before close — leaves the head magic and gigabytes of intact pages behind a footer that was never written. Every engine reports the file as not a Parquet file, because the test they run is on the last four bytes, not the first four.
  • A footer length that no longer lines up. Concatenating two Parquet files, appending a byte, or letting an editor add a final newline shifts the anchor: the trailing magic can still read PAR1 while the four bytes before it point into the middle of a page, and the Thrift parser fails on garbage instead of reporting that the file was edited.
  • A flipped byte inside a data page. The footer parses, the schema lists, and the column reads correctly right up to the damaged page, where the decompressor errors out or values decode as nonsense. Per-page CRCs are optional in Parquet, so many writers leave nothing behind that can point at which page moved.
  • Silent schema drift across a directory. Not corruption of one file but the failure people actually hit: each file is valid on its own, yet one of them types a column as int32 where the rest say int64, and the query engine refuses the whole dataset. The answer is in each file's footer, not in its data.

Where the format stands today

Parquet is the default storage format of the analytics world. Spark, Trino, DuckDB, Polars, pandas, BigQuery exports and Snowflake unloads all read and write it, and the object-store table formats built on top — Iceberg, Delta Lake, Hudi — are directories of Parquet files plus a metadata log. It replaced CSV for anything large, because a CSV must be read and reparsed end to end for every query while a Parquet reader consults the footer, discards the row groups whose statistics rule them out, and decompresses only the columns asked for. Where it is still the wrong choice is small data and human interchange: a two-hundred-row lookup table is easier to keep as CSV, and record-at-a-time streaming ingestion belongs to Avro, because a Parquet file only becomes valid at the moment its footer is written.

Open Parquet files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with Parquet — compare their leading bytes.

FormatFirst bytesExtension
SQLite database53 51 4C 69 74 65.sqlite

Frequently asked questions

What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Have a file that might be in the Parquet format? Identify it with the File Type Identifier — it reads the magic number locally, nothing is uploaded. Or browse all formats.