Every File Format, Explained

A photo, a Word file or a PDF holds more than you see when you open it: an embedded thumbnail, metadata recording when, where and on what device it was made, and a file signature in its first bytes that identifies the format.

A photo of dogs on a beach, as you normally see it.

Photo by Aliceinthealice, released into the public domain on Wikimedia Commons. The values on the red layer are copied from the file they published.

What is in the stack

A file is a sequence of bytes, and different parts of that sequence do different jobs, so here is the beach photo again, one layer at a time, with its real values.

The picture3.7 MB in this file

The image data is compressed: this photo is 4,032 by 3,024 pixels, which would take 36.6 MB as uncompressed 24-bit RGB, and JPEG’s lossy compression brings it down to 3.7 MB by discarding fine detail your eye is unlikely to miss.

The embedded thumbnail160 × 120 pixels

Cameras also embed a thumbnail so galleries and file browsers can show previews without decoding every full-size image, and some older editors cropped or blurred the main image while leaving the thumbnail untouched, which leaked the original.

The metadataEXIF, a standard from 1995

The camera writes EXIF metadata into the file: the timestamp, device model, lens settings and, with location services on, GPS coordinates accurate to a few metres. Word documents, spreadsheets and PDFs carry their own metadata, such as author, company and total editing time.

The file signatureFF D8 FF

The first bytes are the file signature, also called a magic number. Every JPEG begins with FF D8 FF, so software checks those bytes rather than trusting the file extension, which is why a photo still opens after it has been renamed.

Word files, PDFs, songs and videos

Each format is structured differently, but nearly all of them carry metadata about who made the file, when, or where.

A Word file

  1. The text and pictures
  2. Comments and tracked changes
  3. Author, last modified by, total editing time
  4. PK, because it is a ZIP archive of XML files

A PDF

  1. The pages
  2. Earlier revisions from incremental saves
  3. Author, creator app and producer
  4. %PDF-

A song

  1. The sound
  2. Cover art
  3. ID3 tags: title, artist, encoder
  4. ID3

A phone video

  1. The frames and the sound
  2. A thumbnail frame
  3. Device, timestamp and often GPS coordinates
  4. ftyp

How a computer knows what a file is

Most formats begin with a fixed byte sequence, the file signature or magic number, and software reads it to identify the format, treating the file extension as a hint that anyone can change.

Renaming a photo changes nothing inside it

Pick a different extension. The signature bytes stay where they are, so software that reads them still identifies the file as a PNG.

What files record about you

Software embeds metadata in files by default, such as the device and GPS coordinates of a photo or the account name of whoever last saved a document, and that metadata travels with the file wherever it is sent.

Security agencies’ PDFs, checked

Two researchers extracted the metadata from 39,664 PDFs published by 75 security and intelligence agencies in 47 countries.

Of the PDFs the agencies had cleaned before publishing, 65% still gave something away. Adhatarao and Lauradoux, “Exploitation and Sanitization of Hidden Data in PDF Files”, 2021.

The famous ones

These are the 57 formats most people open every week. Press one to see its layers, who made it and what it is for.

Every extension on record

All 7,765 file extensions listed by the UK National Archives and Wikidata, from .pdf to formats almost nobody has heard of.

How this page works

The layers on this page are drawn from the real bytes of each format, and the notes on the beach photo were read straight out of the file its owner published on Wikimedia Commons, which anyone can download and check.

The 57 famous formats were checked against their published specifications, the Library of Congress format descriptions, PRONOM and Gary Kessler's signature table. The full list merges PRONOM with Wikidata, so some obscure entries are thin, because almost nobody has written about them.

One story like this, every Tuesday

The Data Drop is a free newsletter from sheets.works, and every issue is one interactive page built like this one.