What is a magic number in a file?

The first few bytes of a file, which identify its format regardless of what the name says. A PNG always starts with 89 50 4E 47; a ZIP with 50 4B 03 04. Operating systems, browsers and the file command all read these bytes rather than trusting the extension, which is why renaming a file does not change what it actually is.

How do I check a file's magic number myself?

On macOS or Linux, xxd -l 16 yourfile prints the first 16 bytes; on Windows, Format-Hex -Path yourfile -Count 16 in PowerShell. Or drop the file into the File Type Identifier on this site, which reads the bytes locally and names the format for you — nothing is uploaded.

Why do two formats share the same magic number?

Because one is built on the other. Every docx, xlsx, pptx, apk, jar and epub begins with the ZIP signature, since all of them are ZIP archives underneath; telling them apart means looking at the entries inside. Java class files and macOS universal binaries both start with CA FE BA BE and are distinguished by the field that follows.

Can a file have no magic number at all?

Yes. Text-based formats — XML, HTML, JSON, SVG, CSV — have no fixed byte signature, so they are recognized structurally instead: a leading <?xml declaration, a <svg element, or a { followed by a quoted key. That detection is a good guess rather than a certainty, which is why this reference marks those formats as probe-detected.

Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

Excel workbook (xlsx) file format

Q: Does a matching magic number mean the file is safe?

No. It tells you what the format is, not whether the contents are harmless — a genuine PDF or docx can still carry a malicious payload. Identifying the true type is a useful first check, especially when the extension disagrees with the bytes, but it is not a malware scan.

A Microsoft Excel workbook in the Office Open XML format.

MIME type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Extensions: .xlsx
Category: Documents

Magic-number signature

0x00000000

504B0304

PK··

'PK' — it is a ZIP

Inside the ZIP: '[Content_Types].xml' plus an 'xl/' directory.

About the Excel workbook (xlsx) format

A .xlsx is an Open Packaging Conventions package — a ZIP of XML parts — laid out for tabular data. The cells live in xl/worksheets/sheet1.xml and friends, but the strings mostly do not: repeated text is pooled into xl/sharedStrings.xml and referenced by index, which is why a workbook of a hundred thousand identical labels compresses to almost nothing. Styles are pooled the same way in xl/styles.xml. Nothing in the file's first bytes identifies it as a spreadsheet; only the entry names in the ZIP directory do.

Header layout, byte by byte

Offset	Length	Field	Meaning
0	4	Local file header signature	50 4B 03 04, the ZIP local file header. A workbook, a Word document, a deck, an e-book and an Android package are indistinguishable at this offset — the format is a container convention layered on top of ZIP, not a signature of its own.
4	2	Version needed to extract	Minimum reader version times ten, little-endian. 20 for deflate. A workbook with more than 65535 parts or one exceeding 4 GiB would push this to 45 for ZIP64, which happens with very large embedded media.
6	2	General purpose bit flag	Bit 3 moves the CRC and sizes to a data descriptor after the compressed bytes, which is what a streaming writer does. Bit 11 declares the entry name UTF-8 — relevant because worksheet part names are ASCII but embedded media filenames often are not.
8	2	Compression method	8, deflate, for every XML part. Spreadsheet XML is the most compressible content in the whole OOXML family: a sheet of numeric cells is verbose markup that routinely deflates to under a tenth of its size.
10	2	Last modified time	MS-DOS packed time with two-second resolution and no time zone. Excel normalises part timestamps, so a workbook's real edit history is in docProps/core.xml, not here.
12	2	Last modified date	MS-DOS packed date counted from 1980. Worth noting alongside the workbook's own date system, which counts days from 1900 or optionally 1904 — two unrelated epochs in the same file.
14	4	CRC-32	Checksum of this part's uncompressed bytes. Excel validates it on load, which is why a workbook damaged in transit fails cleanly rather than opening with wrong numbers in it.
18	4	Compressed size	Deflate byte count for this part. FF FF FF FF defers to a ZIP64 extra field; a workbook large enough to need that has usually gone wrong somewhere else first.
22	4	Uncompressed size	Original length of the part. The gap between this and the compressed size is where the shared-strings design pays off — the pooled table inflates to many times its stored size.
26	2	File name length	13 00, nineteen bytes, when the first entry is [Content_Types].xml as every OOXML writer emits it. This is the first field that carries any information about the file's actual type.
28	2	Extra field length	Normally zero from Excel. A workbook repacked by a script commonly picks up Unix permission or timestamp extra fields, which changes nothing functionally but does change the file's hash.
30	19	First entry name	[Content_Types].xml. Inside it, an Override element maps /xl/workbook.xml to the content type ending spreadsheetml.sheet — that string is the authoritative declaration that this package is a workbook rather than a document or a presentation.
variable	variable	xl/workbook.xml	The part that makes the package a spreadsheet. Its offset is not fixed; find it through the central directory. It names each sheet and its relationship id, which resolves through xl/_rels/workbook.xml.rels to the actual xl/worksheets/sheetN.xml part.
-22	4	End of central directory signature	50 4B 05 06, twenty-two bytes from the end with no archive comment. Everything a reader needs to enumerate the workbook's sheets is reached from here, so the last twenty-two bytes matter more than the first thirty.
-6	4	Offset of the central directory	Where the directory starts, as an absolute position from the beginning of the file. Any bytes prepended to the package invalidate it, and Excel's response is to declare the file unreadable rather than to hunt for the real offset.

Telling it apart from its neighbours

Easily confused with	How to tell
Word document (docx)	Identical through every field of the local file header and identical again at offset 30, because both packages lead with [Content_Types].xml. The separator is the directory listing at the end of the file: xl/workbook.xml and an xl/ tree for a workbook, word/document.xml and a word/ tree for a document. Reading the extension is not a substitute — Excel opens whatever the bytes say it is.
xls	The predecessor, and a completely different animal: a Compound File Binary container opening D0 CF 11 E0 A1 B1 1A E1 with a stream named 'Workbook' inside. Both open in Excel, both are called 'an Excel file', and the row and column limits differ enormously — 65536 by 256 for the binary format against 1048576 by 16384 for .xlsx, which is the practical reason most of the world converted.
csv	Constantly conflated in practice, never at byte level: a CSV is plain text with no signature at all, while a .xlsx is a ZIP. The distinction that bites is semantic — a CSV carries values, a workbook carries values plus formulas, types, formatting and multiple sheets, so 'export to CSV' discards most of the file and 'open CSV in Excel' invents types that were never there.
xlsm	A macro-enabled workbook, byte-identical to .xlsx through the header and distinguished only by an xl/vbaProject.bin part and a different ContentType declaration. Since the extension is the only visible difference and renaming is free, this is the pair a mail filter has to open the package to resolve.

How these files break

The end-of-central-directory record is gone. A truncated download leaves every worksheet part intact and compressed correctly, and Excel still refuses to open the file, because enumeration starts at the end. Carving forward from 50 4B 03 04 and rebuilding the directory usually recovers every sheet.
Bytes prepended to the package. A proxy error page or a stray BOM ahead of 50 4B 03 04 shifts the file, so every absolute offset in the central directory is wrong by that amount. The workbook is entirely present; deleting the junk in front restores it.
Text-mode transfer. Line-ending translation inside the deflate streams leaves headers, entry names and sizes perfectly readable, so the package lists correctly and then fails a CRC check while inflating a sheet. Nothing in the ZIP structure hints at it beforehand.
A hand-edited part repacked incorrectly. Because sheets are plain XML, editing one directly is tempting; adding a BOM before the XML declaration, changing an entry name's case, or including directory entries for the folders will each make Excel reject a package that every archive tool calls healthy.
A damaged xl/sharedStrings.xml. Cell text is pooled and referenced by index, so corruption in this one part does not blank one cell — it shifts every string index in the workbook, and the sheet opens full of the wrong labels attached to the right numbers. It is the most misleading failure the format has.

Where the format stands today

The .xlsx package is the universal interchange format for tabular data with any structure to it, and its reach is largely a business fact rather than a technical one: it is what finance, operations and government publish, so every data tool has to read it. Technically it is a reasonable format for what it is — an open ISO standard, compressible, recoverable because the parts are XML, and free of the .xls row limit that made large exports impossible. It is a poor choice as a data-processing format: parsing means unzipping and streaming megabytes of XML, dates are stored as serial numbers against a 1900 epoch with a deliberate leap-year bug preserved from Lotus, and long numeric identifiers get silently coerced to floats and reformatted in scientific notation. Anything analytical is better served by CSV for simple exchange or Parquet for scale, both of which read orders of magnitude faster. Where .xlsx is genuinely first choice is a deliverable a person will open and edit: formulas, multiple sheets, formatting and charts all survive, and none of them survive a CSV.

Open Excel workbook (xlsx) files on this site

Every one of these runs in your browser — the file never leaves your machine.

Related formats

Formats that are easy to confuse with Excel workbook (xlsx) — compare their leading bytes.

Format	First bytes	Extension
Word document (docx)	50 4B 03 04	.docx
PowerPoint presentation (pptx)	50 4B 03 04	.pptx
ZIP	50 4B 03 04	.zip
OLE2 / CFB	D0 CF 11 E0 A1 B1	.doc