The File Forensics Tool is 100% client-side. Your file is read with the ArrayBuffer API and everything — magic-byte detection, MD5 / SHA-1 / SHA-256 hashing, Shannon entropy, the hex dump, string extraction and EXIF parsing — runs in JavaScript, WebAssembly (hash-wasm) and the browser’s native Web Crypto API. There is no upload, no server, no CDN and no telemetry in the path, and nothing is persisted, so closing the tab discards it and the tool works offline once cached. That makes it safe for sensitive or suspicious samples in a way an online analyser — which receives your file — never can be. The only optional network use anywhere on the site is consent-gated ads, which never see your file.

Shannon entropy scores how unpredictable a file’s bytes are. Plain text and source code sit around 4–5, dense binary and Base64 climb to 6–7, and compressed archives or encrypted data push past 7.5 toward the 8.0 maximum. The tool shows the overall value and a per-block heatmap: a flat near-8 band across the whole file suggests it is encrypted or compressed, while an isolated spike inside otherwise low-entropy data can expose an embedded packed or encrypted payload — a classic packer / malware indicator. Entropy is only a heuristic, though: compressed media looks identical to encrypted output, and single-byte XOR encoding does not raise entropy at all, so treat it as a clue rather than proof.

This is a triage aid that reads bytes statically; it never executes the file, so it cannot observe what the file would do. Packed or encrypted malware deliberately hides from static analysis, a magic-byte signature can be forged, high entropy is not proof of anything, and a clean strings list means nothing. What the tool does well is answer “what is this file, really?” — catching a disguised extension, fingerprinting the file by hash so you can look it up, and flagging that it looks encrypted or packed. For an actual verdict, use up-to-date antivirus, a hash-reputation lookup, and dedicated malware-analysis tooling in an isolated sandbox — and never open or run a file you do not trust.

A file’s extension is a label anyone can change by renaming the file, but the first few bytes (the magic number) are written by the program that created it and identify the true format. The tool detects that signature with the file-type library (~400 formats) plus a curated table, then compares it to the filename extension. When they disagree — say a document named report.pdf whose bytes are actually a Windows executable — it raises a clear mismatch warning, because a disguised extension is a common trick for slipping executables past users and filters. Benign causes exist too (a .jpg that is really a .png, or a .docx which is technically a ZIP), which the tool treats as compatible aliases rather than a mismatch.