Tool workspace
The file is read locally and is not uploaded.
File Hash & Inspector
Inspect one local file's size, browser-reported MIME type, leading signature bytes, and SHA-256 checksum without uploading it. Signature recognition is deliberately limited and does not prove that a file is safe.
Browser-localFreeNo upload required
What this tool is for
Inspect one local file's size, browser-reported MIME type, leading signature bytes, and SHA-256 checksum without uploading it. Signature recognition is deliberately limited and does not prove that a file is safe.
How to use
- Choose a file no larger than the stated limit.
- Inspect the detected signature, reported MIME type, byte prefix, and checksum.
- Use a dedicated security scanner or format validator when the decision is safety-critical.
Example
Select a small PNG and confirm the 89 50 4E 47 signature, image/png report, size, and stable SHA-256 digest.
FAQ
Is the file uploaded?
No. FileReader and Web Crypto process it in the browser.
Does a recognized signature prove the file is safe?
No. It identifies only a small leading-byte pattern.
Reproducible examples
Known inputs and expected results
Run these examples in the workspace above and compare the result with the documented output.
PNG signature and hash
- Input
- A small PNG beginning 89 50 4E 47
- Options
- Select a file below 25 MB.
- Action
- Inspect bytes and calculate SHA-256.
- Expected output
- PNG signature hint, browser MIME comparison, size, prefix hex, and a 64-hex SHA-256 digest.
- Explanation
- The leading signature supports a format hint; the hash is over all selected bytes.
Known empty-file digest
- Input
- A zero-byte file
- Options
- Keep the file below the size limit.
- Action
- Calculate SHA-256.
- Expected output
- e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Explanation
- This is the standard SHA-256 digest of an empty byte sequence.
Error or unsupported case
MIME/signature disagreement
- Input
- A renamed .jpg file whose bytes begin %PDF
- Expected error or limit
- The page reports the disagreement but cannot prove whether the file is safe.
- Safer alternative
- Open the file with an appropriate offline validator or security scanner.
When not to use this tool
- Malware detection or deep format validation
- Files above the stated browser-memory limit
Algorithm and assumptions
File bytes stay local, Web Crypto computes SHA-256, signature detection checks a limited prefix table, and browser MIME/extension values are untrusted hints.
Input and output
Input is one local file read as bytes. Output is metadata, a limited signature match, MIME comparison, prefix hex, and SHA-256.
Supported formats and behavior
- PNG, JPEG, GIF, PDF, and ZIP signature hints
- Files up to 25 MB
- SHA-256 via Web Crypto
Limits
- No malware scan or deep file parsing
- MIME type can be missing or supplied by the operating system
Edge cases and common errors
- Renaming an extension does not change signature bytes
- ZIP is a container for many formats
- A matching header does not prove the remaining file is valid
Release testing
Checks cover known small fixtures, checksum vectors, empty files, size limit, MIME mismatch, clear, privacy network capture, and mobile selection.
Privacy boundary
The input and result stay in this browser session. ZZP Box does not upload or store the values entered in this tool.
Related reviewed tools
Choose the next tool by the operation you need, then review that page's stated input and limits.