Maximum file size: 200 MB. Nothing leaves your browser.
The Complete Guide to Hex Dumps and Binary Inspection
When a file behaves unexpectedly - an image that will not open, an archive that refuses to extract, or an executable flagged by security software - the only way to understand what is really inside is to look at the raw bytes. A hex dump gives you exactly that: an unfiltered, byte-by-byte view of a file's true contents, with no interpretation layer obscuring the data.
How to Use This Tool
Drag and drop any file onto the upload zone, or click Choose File. The hex viewer appears instantly, showing each byte in three columns: the Offset (position from the start, in hex), the Hex column (each byte's value in base-16), and the ASCII column (printable characters or dots for non-printable bytes).
Use the Bytes Per Row control to adjust how many bytes appear on each line. 16 is the standard for most forensics work and aligns well with most binary structures. 32 is useful for scanning large files quickly. 8 can help when analyzing data with known 8-byte alignment. The Endian toggle switches between Big Endian (bytes in their natural stored order, ideal for file header analysis) and Little Endian (bytes within each 4-byte word are reversed, useful for analyzing data written by x86 processors). Use the Search Hex box to type any hex sequence - for example FF D8 FF for a JPEG header - and every matching byte position is highlighted in the viewer as you type. Click Export Hex Dump to download the full dump as a clean, portable text file.
What to Look for at Offset 00000000
The very first bytes of any file are the most informative. Compare what you see against the magic byte signatures below to identify the file format. A mismatch between a file's extension and its magic bytes is a red flag in security analysis.
| Format | Magic Bytes (Hex) | ASCII Hint |
|---|---|---|
| JPEG Image | FF D8 FF | (binary header) |
| PNG Image | 89 50 4E 47 0D 0A 1A 0A | .PNG.... |
| PDF Document | 25 50 44 46 2D | %PDF- |
| ZIP / DOCX / XLSX / JAR | 50 4B 03 04 | PK.. |
| GIF Image | 47 49 46 38 | GIF8 |
| ELF Executable (Linux) | 7F 45 4C 46 | .ELF |
| Windows PE (.exe / .dll) | 4D 5A | MZ |
| MP3 (ID3 tag) | 49 44 33 | ID3 |
| SQLite Database | 53 51 4C 69 74 65 20 33 | SQLite 3 |
| Java / .NET Class File | CA FE BA BE | (binary) |
| WebP Image | 52 49 46 46 .. .. .. .. 57 45 42 50 | RIFF....WEBP |
| Zstandard Archive | 28 B5 2F FD | (binary) |
Virtual Scrolling for Large Files
For large files such as firmware images, video files, or disk images, a naive hex dump would try to render hundreds of thousands of rows at once, which would freeze any browser. This tool uses virtual scrolling: only the rows currently visible in the viewport (plus a small buffer above and below) are rendered as DOM elements at any given moment. As you scroll, rows are added and removed in real time, while the scrollbar height reflects the full file size. A 100 MB file scrolls as smoothly as a 100 byte file.
Practical Uses in Forensics, Security, and Development
Hex inspection is a core skill across several technical disciplines. In digital forensics, investigators use hex dumps to recover deleted file fragments, identify file types regardless of extension, and locate timestamps embedded in binary metadata. In malware analysis, security researchers look for encoded payloads, obfuscated strings, and unusual byte sequences that antivirus heuristics might miss. In reverse engineering, hex dumps reveal how proprietary binary protocols lay out their fields - which is the first step toward writing a parser. In embedded systems development, engineers inspect firmware images to verify flash memory contents, locate bootloader headers, and confirm that compiled code matches expected byte patterns.
Frequently Asked Questions
A hex dump is a raw, uninterpreted view of a file's binary contents displayed in hexadecimal (base-16) notation, alongside its ASCII text representation. Developers and security researchers use hex dumps to inspect file headers and magic bytes to confirm a file's true format, to recover data from corrupted files by locating intact regions, to reverse-engineer proprietary binary formats, to detect embedded payloads or obfuscated code in files, and to understand how data structures are physically laid out in memory or on disk.
Hex dumps are a foundational tool in low-level debugging, digital forensics, malware analysis, and embedded systems development. Any time you need to see what a file truly contains - without any operating system or application layer filtering the view - a hex dump is the right tool.
Magic bytes are a fixed sequence of bytes at the very beginning (or sometimes end) of a file that identify its format. They are called magic bytes because they act like a signature that reveals what a file truly is, regardless of its filename extension. Load the file in this tool and look at the first few bytes at offset 00000000. Compare those bytes against the reference table in the section above.
File extensions can be renamed to disguise a file's true type - a malicious executable renamed to .jpg will still show 4D 5A (MZ) at its start rather than FF D8 FF. Use the Search Hex box to paste a known magic byte sequence and the tool will immediately highlight every match in the file, making it easy to find embedded file structures within larger binary streams such as memory dumps or disk images.
Endianness describes the order in which bytes of a multi-byte value are stored in memory. In Big Endian byte order, the most significant byte (the highest-value part of the number) is stored first, at the lowest memory address. This is the natural, human-readable order: the number 1000 in hexadecimal is 0x000003E8, and in Big Endian memory it appears as 00 00 03 E8 reading left to right.
In Little Endian byte order, the least significant byte is stored first, so the same number appears as E8 03 00 00. Little Endian is used by most modern desktop processors (x86 and ARM in little-endian mode), while Big Endian is common in networking protocols (sometimes called network byte order), PowerPC and SPARC architectures, and certain file formats such as AIFF and TIFF (in one of its modes). When analyzing binary data, knowing which endianness was used when the data was written is critical for correctly interpreting multi-byte integers, floating-point numbers, and memory addresses.
Your file is processed entirely inside your own browser using the Web File API (FileReader.readAsArrayBuffer) and the JavaScript Uint8Array typed array. No bytes of your file are ever uploaded to a server, sent over a network connection, or stored anywhere outside your local browser tab. The hex rendering, search, and export functions all run as pure client-side JavaScript.
You can verify this yourself: load the page, disconnect from the internet, and upload a file. The tool will continue to work perfectly with no network activity whatsoever. This is especially important for sensitive files such as documents containing personal data, proprietary source code, firmware images, or encrypted archives - files you should never send through an online service you do not fully control.
The ASCII column shows a text interpretation of each byte. ASCII (American Standard Code for Information Interchange) maps values 32 through 126 to printable characters: letters, digits, punctuation, and spaces. For each byte in the hex column, the ASCII column shows the corresponding printable character if one exists, or a dot placeholder for bytes outside that range.
The ASCII column lets you quickly spot embedded strings, file format markers, and human-readable metadata inside binary files without needing to decode hex values manually. A PDF file shows %PDF near the beginning of its ASCII column. A ZIP file shows PK. A SQLite database shows SQLite 3. Even in heavily binary files, readable strings embedded in the data - error messages, copyright notices, URLs, and configuration keys - will stand out clearly in the ASCII column.
Dots in the ASCII column represent bytes whose values do not correspond to a printable ASCII character. Bytes with values 0 through 31 are ASCII control codes (null, tab, carriage return, line feed, escape, and others) and bytes with values 127 through 255 are either the delete character or extended values outside the 7-bit ASCII printable range.
These bytes have completely legitimate roles in binary files: they serve as structural markers, integer fields, padding, compressed data blocks, encoded media samples, and memory addresses. But they cannot be meaningfully displayed as readable text characters. Replacing them with a dot keeps the ASCII column perfectly aligned with the hex column and lets you scan the printable string content at a glance, without the display being corrupted by invisible or ambiguous control characters.