File Type Checker Online

Detect the real type of a file from its bytes (130+ formats), compare it with the name and Content-Type, and flag disguised executables and macros.

Result

Press “Run” to see the result.

Upload a file (multipart, raw body or file_base64) or give a url and the API identifies what the bytes really are, without trusting the extension: images (JPEG, PNG, WebP, AVIF, HEIC, raw photos…), PDF, Office documents (DOCX / XLSX / PPTX told apart by their ZIP entries, legacy DOC / XLS / PPT by their OLE2 streams, ODF, EPUB), archives (ZIP, RAR, 7z, gzip, bzip2, xz, zstd, tar, ISO…), audio and video containers, executables (Windows PE with architecture and DLL / .NET flags, ELF, Mach-O, APK, JAR, DEX, WebAssembly, scripts with a shebang, LNK shortcuts, MSI, DEB / RPM), fonts, SQLite and many data formats; text files are classified as SVG, HTML, XML, JSON, CSV, PEM and so on.

The answer gives the MIME type, canonical extension, kind and details, then compares it with the file name (filename, or the uploaded name) and the declared content_type. Warnings have a severity and the overall risk is the highest one: executables hidden behind a document or image extension, VBA macros (especially in a file named .docx / .xlsx), double extensions (invoice.pdf.exe), right-to-left override characters in names, SVG / HTML with scripts, PDF with JavaScript or Launch actions, archives containing executables.

Only the first 64 KB are inspected (plus the ZIP central directory for uploads), so a URL is fetched with a 64 KB cap. The file is not stored. This is a content-type check, not an antivirus: a "none" risk does not prove a file is harmless.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/file-type" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "0=@./my-file"

const form = new FormData();
form.append('0', fileInput.files[0]);

const res = await fetch('https://apibox.io.vn/v1/file-type', {
  method: 'POST',
  headers: { Authorization: 'Bearer YOUR_API_KEY' },
  body: form,
});
console.log(await res.json());

import requests

res = requests.post(
    "https://apibox.io.vn/v1/file-type",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    files={"0": open("my-file", "rb")},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/file-type');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => ['0' => new CURLFile('my-file')],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

How are DOCX, XLSX and PPTX distinguished?

They are all ZIP files: the API reads the entry names ([Content_Types].xml, word/, xl/, ppt/, vbaProject.bin) to tell them apart and to detect macros.

Does it scan for viruses?

No. It detects the real format and risky traits (executable code, macros, scripts); use an antivirus for malware.

How much of a URL is downloaded?

At most 64 KB. For ZIP-based files only the local headers in that part are read, which is enough to recognise Office files.