What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

PDF file format

Q: Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Portable Document Format, Adobe's fixed-layout document standard.

MIME type: application/pdf
Extensions: .pdf
Category: Documents

Magic-number signature

0x00000000

255044462D

%PDF-

'%PDF-' + version

About the PDF format

A PDF is a graph of numbered objects — dictionaries, arrays, streams, numbers and strings — plus a cross-reference table that maps each object number to its byte offset in the file. That design is why a reader opens a 500-page PDF instantly: it reads the last few hundred bytes, follows startxref to the cross-reference table, and jumps straight to the objects it needs. It is also why PDFs are unusually resilient to appending and unusually fragile to any edit that shifts bytes, because every offset in that table is absolute.

Header layout, byte by byte

Offset	Length	Field	Meaning
0	5	%PDF- header marker	The five ASCII bytes 25 50 44 46 2D. A PDF is a text-ish format at the top level, so this is literally a PostScript-style comment; the percent sign is the comment character, and the whole first line is legal to a parser that knows nothing about PDF.
5	3	Version number	'1.0' through '1.7' for ISO 32000-1 and its Adobe predecessors, or '2.0' for ISO 32000-2. The version here is a floor, not a fact: a document catalog may carry a /Version key that overrides it upward, so a file marked 1.4 can legitimately use 1.7 features.
8	1	Header end-of-line	A single LF (0A), a single CR (0D), or the CR LF pair — in which case this run is two bytes and everything below shifts by one. The header line is not allowed to carry anything else.
9	variable	Binary comment line	ISO 32000-1 clause 7.5.2 recommends that a file containing binary data follow the header with a comment line holding at least four bytes whose codes are 128 or greater. Its whole purpose is to make transfer software classify the file as binary rather than text. Common producers write %âãÏÓ; its absence is legal but tells you the writer was casual.
-5	5	%%EOF marker	The last line of a well-formed file is the five bytes 25 25 45 4F 46. A trailing end-of-line may follow, so readers scan backwards through the final 1024 bytes for it rather than trusting a fixed position — and a file with several %%EOF markers is not damaged, it has been incrementally updated.
variable	variable	startxref and the trailer	Immediately before %%EOF comes the keyword 'startxref' and, on the next line, a decimal byte offset. That offset is where the reader jumps to find the cross-reference table or cross-reference stream, and through it the /Root, /Info and /Encrypt entries. Nothing about this is at a fixed position, which is exactly why the marker at the end has to be found by scanning.

Telling it apart from its neighbours

Easily confused with	How to tell
PDF/A	PDF/A is the archival profile and PDF/X the print-exchange one, and neither leaves a mark at offset 0 — the conformance level is metadata, not a signature. A PDF/A file declares itself in an XMP metadata stream through the pdfaid namespace with a part and conformance level, and it additionally must embed every font and carry an output intent. So a file can claim PDF/A in its XMP and still fail validation; the header tells you nothing either way.
Encrypted PDF	Also byte-identical at the top. The tell is an /Encrypt key in the trailer dictionary at the end of the file. Note what PDF encryption usually means in practice: a permissions-only 'owner password' with an empty user password, so the content is fully readable and the restriction on printing or copying is enforced by the viewer being polite. That is not the same thing as a user password, which does encrypt the streams.
OLE2 / CFB	The two are the alternatives you meet when someone says 'send me the document'. A pre-2007 Word file is a Compound File Binary container opening D0 CF 11 E0; a PDF opens %PDF-. The difference that matters downstream is that a PDF fixes glyph positions on the page and a .doc does not, which is why a .doc reflows on a machine missing its fonts and a PDF does not.
PostScript	PDF's direct ancestor, and still confused with it because both use the same object syntax and the same comment character. A PostScript file opens '%!PS-Adobe-'; an EPS opens the same way and may carry a binary preview header C5 D0 D3 C6 in front. PostScript is a full programming language executed top to bottom, PDF is a static object graph with random access — which is the whole reason PDF replaced it.

How these files break

A byte-shifting edit. Because the cross-reference table stores absolute byte offsets, inserting or deleting a single byte anywhere in the file invalidates every entry after it. Viewers cope by rebuilding the table — scanning the whole file for 'N 0 obj' patterns — which is why a hand-edited PDF opens with a delay and a warning instead of a clean load.
Truncated download. The objects near the front survive, so a page or two may render after a rebuild, but the cross-reference table and trailer at the end are gone and the reader has nothing to start from. The check is whether %%EOF appears in the last 1024 bytes.
Text-mode transfer. FTP in ASCII mode rewrites 0D 0A pairs inside compressed FlateDecode streams. The header is untouched and the file still parses, so it opens — and then individual pages come up blank or throw a stream-decoding error, because the deflate data no longer inflates.
An incremental update appended to the wrong base. PDF supports appending changes rather than rewriting, so a signed or annotated file is the original plus a second cross-reference section pointing back at the first. Splice on a section whose /Prev offset does not match where the earlier %%EOF actually sits and the chain breaks; the file still shows an intact header and an intact final trailer.
A generator that wrote a cross-reference stream but claimed version 1.4. Compressed cross-reference streams and object streams arrived in PDF 1.5. A reader honouring the declared version literally will not look for them, so the document appears to have no objects at all even though every byte is present and correct.

Where the format stands today

PDF is the only widely accepted format for a document whose appearance must not change, and after thirty years nothing has displaced it in that role. Contracts, invoices, statements, academic papers, forms, print-ready artwork and anything that has to be archived or signed all end up as PDF, because it embeds its fonts and fixes every glyph position rather than reflowing to fit the reader. Where it is a poor choice is anything that will be edited again — a PDF stores drawing instructions, not paragraphs, so 'editing' one means reverse-engineering text runs back into words — and anything read on a phone, where a fixed A4 page is exactly the wrong shape and EPUB's reflowable text wins outright. Its specialised variants have carved out durable niches of their own: PDF/A for long-term archival, where every font must be embedded and no external dependency is allowed, and PDF/X for print handoff. The format is now an ISO standard rather than an Adobe one, and browsers ship their own renderers, so a PDF is one of the very few file types that reliably opens on any device without installing anything.

Open PDF files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with PDF — compare their leading bytes.

Format	First bytes	Extension
OLE2 / CFB	D0 CF 11 E0 A1 B1	.doc
RTF	7B 5C 72 74 66 31	.rtf
Word document (docx)	50 4B 03 04	.docx