A file extension is a label, and only a label. It is the letters after the last dot in a name, and it tells your operating system which program to open the file with. It does not determine what the file contains, and changing it does not convert anything. Rename photo.jpg to photo.png, and you have a JPEG with a misleading name.
To know what a file really is, you have to look at its bytes.
What an extension does
When you double-click a file, Windows or macOS looks up the extension in its list of associations and launches the matching program. That is its main job. Extensions also drive the icon you see, the hint in file dialogs, and the type a browser or mail program declares when sending a file.
What it does not do:
- It does not decide the format. The bytes do, and those are set when the file is written by whatever program saves it.
- It does not guarantee safety.
report.pdfcan contain anything. - It does not always tell you enough.
.mp4says little about its codecs, which is why one MP4 plays and another does not..pdfdoes not tell you whether the pages are text or scans.
Files can have no extension at all and work fine. Linux and macOS tools generally do not need them to run a program, and web servers routinely serve files from URLs with no extension.
Magic numbers: how to identify a file
Most binary formats begin with a fixed signature, often called a magic number. These are the first bytes of real files we made for this article, read with xxd:
| Format | First bytes (hex) | Readable as |
|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | .PNG.... |
| JPEG | FF D8 FF E0 | Marker bytes (the last byte varies) |
25 50 44 46 2D 31 2E 33 | %PDF-1.3 | |
| ZIP | 50 4B 03 04 | PK.. |
| DOCX | 50 4B 03 04 | PK.., since it is a ZIP |
| XLSX | 50 4B 03 04 | PK.., since it is a ZIP |
| WebP | 52 49 46 46 .. .. .. .. 57 45 42 50 | RIFF + size + WEBP |
| AVIF | 00 00 00 20 66 74 79 70 61 76 69 66 | ....ftypavif |
The PK is the initials of the ZIP format’s creator. It shows up for DOCX and XLSX, since these are ZIP archives with a particular internal layout. So a signature alone cannot separate them, and a tool has to look inside. See what is inside a DOCX file.
Browsers depend on these signatures too. The WHATWG MIME Sniffing standard lists the byte patterns they use to identify formats, including PNG’s 89 50 4E 47 0D 0A 1A 0A.
Plain text formats are harder. Our .txt and .svg test files begin with ordinary characters (hello and <svg xml), and text has no signature. CSV, HTML, JSON and source code can only be told apart by reading the content, and sometimes not even then.
Check it yourself
On a Mac or Linux, the file command reads signatures and ignores the name. We copied a real JPEG and a real PDF to misleading names, and asked:
$ file renamed.png renamed.docx
renamed.png: JPEG image data, JFIF standard 1.01, ...
renamed.docx: PDF document, version 1.3, 10 pagesTo see the raw bytes:
$ xxd -l 12 pic.png
00000000: 8950 4e47 0d0a 1a0a 0000 000d .PNG........On Windows, PowerShell’s Format-Hex cmdlet gives you a similar view, or you can open a file in a text editor and look at the start. A PDF begins with %PDF, a PNG shows PNG near the start, and a ZIP-based file starts with PK.
How renaming fails
Since nothing inside changes, what happens next depends entirely on the program that opens the file.
Some programs ignore the name and read the bytes. Pillow, the Python image library, opened our JPEG named .png and reported its format as JPEG. Browsers do this as well. In Chromium, an image element loaded that same file as an image, even with the server declaring it image/png. The X-Content-Type-Options: nosniff header made no difference in that test. So the renamed file appears to work, and you may conclude that renaming did the conversion. It did not, and the file is still a JPEG, with no transparency, and it will not meet any requirement for an actual PNG.
Some programs trust the name and then fail. Open a renamed PDF in Word as a .docx and you get an error about the file being corrupt or unreadable. The same goes for a video renamed to a format your player does not handle, or a file sent to an upload form that sniffs the content. These errors look like corruption, and they are not. Change the extension back, and the file works.
Some content is really not usable as the other type. A PDF renamed to .png failed to load as an image in our Chromium test, because no image decoder recognises it.
A few renames do work. They are the ones where the formats are the same underneath: .jpg and .jpeg, .htm and .html, .txt and .csv (if the content is comma-separated text), and .docx to .zip for looking inside. In all these cases, the bytes already are what the new name says.
To really change format, the data must be decoded and written again, and that is what a converter does. For images, that means something like JPG to PNG or PNG to JPG. For documents, it means extracting the content, as DOCX to Text does.
Our image tools check the real format from a file’s first bytes, rather than trusting the name, and so they can tell you when a file named .png is really something else.
Extensions and security
Because people judge a file by its name, disguised files are a long-standing attack. These are the tricks to know:
Double extensions. invoice.pdf.exe is an executable. Only the final part counts. Windows, by default, hides extensions for known file types, so that file can appear as invoice.pdf, sometimes with a PDF-looking icon inside the program. The fix takes seconds: in File Explorer’s View menu, turn on File name extensions. On a Mac, use Finder > Settings > Advanced > “Show all filename extensions”.
Executable types people do not recognise. .exe is well known, but .scr, .bat, .cmd, .js, .vbs, .msi, .lnk and .iso can also start or contain code. The FBI’s warning about fake online converters lists .exe, .bat and .scr as outputs that should never come back from a document conversion.
Macro-enabled Office files. .docm and .xlsm can hold macros. .docx and .xlsx are not designed to. An unexpected .docm deserves suspicion, and there is no reason to enable its macros because a message told you to.
Long names. A name such as document.pdf .exe pushes the real extension out of sight in a narrow column. Widen the column or check Properties.
Reversed characters. A Unicode control character (right-to-left override) reverses how the text after it is displayed. A file really named report, then that character, then fdp.exe appears on screen as reportexe.pdf, though it is an executable. Mail systems and security tools commonly flag this. A file’s Properties dialog shows you its type, which is harder to fake than a name.
If you run a website with uploads, never rely on the extension or on the type a browser declares, since a client can send any value. Check the bytes on the server, store uploads outside your web root, give them new names, and serve them with an explicit Content-Type and X-Content-Type-Options: nosniff. The header stopped nothing in our image test, but it does stop browsers from running a file as a script or stylesheet when its declared type says otherwise.
When the extension is wrong or missing
- Missing or unknown extension: run
fileon it, or check its first bytes against the table above. Then add the correct extension, which is one of the cases where renaming really is the fix. - A file that “will not open”: check the true type before you assume it is damaged. A download named
.pdfthat is really an HTML error page is a common cause. Open it in a text editor. If you see<!DOCTYPE html>, you saved a web page rather than the document. - A file a website rejects: the site may check the bytes. Run it through a real converter rather than renaming it.
- ZIP-based files: to see what is really inside, use a copy renamed to
.zip, or our ZIP File List tool. If you findword/document.xml, it is a Word file. If you findxl/workbook.xml, it is Excel, andppt/presentation.xmlmeans PowerPoint.
Treat the extension as a useful hint from whoever named the file, and when it matters, verify with the bytes.