ByteScope

PNG file format

Portable Network Graphics, a lossless raster image format.

MIME type
image/png
Extensions
.png
Category
Images

Magic-number signature

0x0000000089504E470D0A1A0A·PNG····PNG magic + CRLF guard

About the PNG format

PNG stores images without any quality loss and supports full alpha transparency, which makes it the default choice for screenshots, logos, icons and any graphic with sharp edges. Every PNG opens with an eight-byte signature that includes a newline pair so the file is corrupted visibly if it passes through a text-mode transfer.

Header layout, byte by byte

OffsetLengthFieldMeaning
08PNG signatureAlways 89 50 4E 47 0D 0A 1A 0A. The high bit of the first byte is set so a 7-bit transfer strips it visibly; bytes 1-3 spell PNG; the CR LF pair, the DOS end-of-file 1A and the trailing LF exist purely so a file mangled by a text-mode transfer fails loudly instead of silently.
84IHDR chunk lengthBig-endian byte count of the IHDR data, always 00 00 00 0D — 13 bytes. Every PNG chunk is length, type, data, CRC in that order, and IHDR must be the first one.
124IHDR chunk typeThe four ASCII letters IHDR. Chunk-type casing carries meaning: an uppercase first letter marks the chunk critical, so a decoder that does not understand it must reject the file rather than skip past it.
164WidthImage width in pixels, big-endian unsigned 32-bit. Zero is illegal and the spec caps the value at 2^31 - 1. A tool reporting absurd dimensions is almost always reading these four bytes little-endian.
204HeightImage height in pixels, encoded exactly like the width. Together with offset 16 this is the only place a PNG states its size — there is no second copy anywhere to cross-check against.
241Bit depthBits per sample: 1, 2, 4, 8 or 16. Not every depth is legal with every colour type — indexed images stop at 8, and the two alpha types start at 8.
251Colour type0 greyscale, 2 truecolour, 3 indexed (requires a PLTE chunk), 4 greyscale plus alpha, 6 truecolour plus alpha. This is the byte to read when a PNG 'lost its transparency': it says 2 where it used to say 6.
261Compression methodAlways 0, meaning deflate with a sliding window of at most 32768 bytes. No second method has ever been registered, so any other value means the header is damaged.
271Filter methodAlways 0, the set of five adaptive per-scanline filters. Which filter each row actually uses is a byte inside the compressed stream, not out here in the header.
281Interlace method0 for none, 1 for Adam7. Adam7 lets a viewer paint a coarse version of the image early at a cost of a few percent in size; almost nothing produces it today.
294IHDR CRC-32CRC-32 over the chunk type and the chunk data, but not over the length field. Change any byte from offset 12 through 28 and this stops matching, which is how a hex editor catches a hand-edited header.
33variableFirst chunk after IHDRThe next length-and-type pair. Usually IDAT, or first one of PLTE, tRNS, gAMA, sRGB, iCCP, pHYs, eXIf or acTL — the colour and metadata chunks that have to precede the pixel data.
-1212IEND trailerEvery intact PNG ends with the same twelve bytes: 00 00 00 00 49 45 4E 44 AE 42 60 82, a zero-length IEND chunk plus its constant CRC. If those are not the final bytes, the file is truncated.

Telling it apart from its neighbours

Easily confused withHow to tell
APNGAn animated PNG is byte-identical for the first 33 bytes — same signature, same IHDR. The difference is an acTL animation-control chunk, which the spec requires before the first IDAT, so search the first few hundred bytes for 61 63 54 4C. A decoder that ignores acTL renders only the still first frame, which is exactly the intended fallback.
ICOA modern .ico can store whole PNG images inside it, so a hex dump shows the PNG signature — just not at offset 0. An ICO opens with 00 00 01 00 and then a directory whose entries give each image's offset; the PNG signature sits at one of those offsets. Check offset 0 before concluding you have a PNG.
JPEGNothing subtle: FF D8 FF against 89 50 4E 47. It matters anyway, because 'Save as PNG' in most editors re-encodes a JPEG's already-lossy pixels rather than converting anything, and because screenshots renamed to .jpg keep their PNG bytes and still open everywhere.
WebPBoth handle lossless data with alpha and both are common screenshot output. WebP is a RIFF file: 52 49 46 46 at offset 0, a four-byte little-endian length, then 57 45 42 50 at offset 8. There is no PNG signature anywhere inside it.

How these files break

  • Text-mode transfer. Old FTP clients and a few CI artefact steps translate line endings, so the 0D 0A at offsets 4-5 collapses to a bare 0A, the whole file shifts by one byte and every chunk CRC after that point fails. The signature was designed to catch precisely this.
  • Truncated download. The signature and IHDR are intact, so the dimensions still read correctly and a viewer paints the top of the image before falling off into grey or transparent rows where the IDAT stream ran out. The tell is a missing IEND in the last twelve bytes.
  • A single flipped byte inside a chunk. libpng refuses the file on the CRC mismatch while browsers usually render it anyway, so the same PNG 'works' in Chrome and fails in a build script. Recomputing each chunk CRC tells you which one moved.
  • Prepended junk. A stray UTF-8 BOM, an HTML error page or a PHP warning emitted before the image body pushes the signature off offset 0. Every byte of the image is still there; the fix is deleting everything ahead of 89 50 4E 47.
  • Colour type quietly rewritten. A pipeline that re-encodes at colour type 2 instead of 6 drops the alpha channel. The result is a perfectly valid PNG with no transparency, and byte 25 is the only place in the file that admits it.

Where the format stands today

PNG is still the default for anything with hard edges or transparency: screenshots, UI assets, logos, diagrams, icons and anything destined for a README. For photographs it lost to JPEG decades ago and more recently to WebP and AVIF, which beat it badly on gradient-heavy images while keeping alpha. Where PNG remains first choice is anything that will be edited again, because it is lossless — a screenshot saved as PNG survives a dozen round trips through crops and annotations unchanged, while the same screenshot saved as JPEG visibly degrades every time. It has been supported by every browser since 1997, so unlike the newer formats it never needs a fallback.

Open PNG files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with PNG — compare their leading bytes.

FormatFirst bytesExtension
JPEGFF D8 FF.jpg
GIF47 49 46 38 39 61.gif
WebP52 49 46 46.webp
BMP42 4D.bmp

Frequently asked questions

What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Have a file that might be in the PNG format? Identify it with the File Type Identifier — it reads the magic number locally, nothing is uploaded. Or browse all formats.