How to hex header inspector — frequently asked questions
- Step 1Drop a file — Any file type is accepted (
*/*). The tool reads the whole file into memory, then shows the first N bytes where N is your tier cap. The file must fit your plan's size limit (10 MB Free, 100 MB Pro, 500 MB Pro+Media, 2 GB Developer). - Step 2Run it — Click Run. Processing is in-browser — the file is read with
FileReader, sliced, and rendered. No upload happens for the on-page tool. - Step 3Read the three columns — Left: hex offset, 8 digits, advancing by 16 per row. Middle: 16 uppercase hex bytes, space-separated. Right: the ASCII sidebar, where bytes 0x20–0x7E show as characters and all others (including 0x7F) as dots.
- Step 4Copy or download — Copy puts a continuous lowercase hex string on your clipboard (no offsets/spaces). Download saves the same hex string as a text file. Re-space it yourself if a downstream tool needs grouped bytes.
- Step 5Escalate when you hit a limit — Need more than 8 KB, a search, a seek, field labels, or editing? Those aren't in the inspector — use a desktop hex editor, or a sibling tool for detection (magic-byte-validator) and entropy (entropy-analyzer).
- Step 6Combine for a full picture — For triage, read the signature here, confirm type with magic-byte-validator, and score randomness with entropy-analyzer. For change detection between two files, use file-integrity-monitor.
Tier byte window and file-size limit
Two different limits people confuse: the number of header bytes shown (fixed by tier) and the maximum whole-file size the tool will load (the security file-size limit).
| Plan | Header bytes shown | Max whole-file size | Files per run |
|---|---|---|---|
| Free | 256 bytes | 10 MB | 1 |
| Pro | 1,024 bytes (1 KB) | 100 MB | 1 |
| Pro + Media | 1,024 bytes (1 KB) | 500 MB | 1 |
| Developer | 8,192 bytes (8 KB) | 2 GB | 1 |
How to read each column
What the three on-screen columns mean, and how the Copy/Download payload differs from them.
| Element | Meaning | Detail |
|---|---|---|
| Offset (left) | Byte position in hex | 8 digits, uppercase, zero-padded; starts at 0, +16 per row |
| Hex bytes (middle) | The raw bytes | 16 per row, uppercase 2-digit pairs, space-separated |
| ASCII (right) | Printable rendering | 0x20–0x7E → character; everything else (incl. 0x7F) → . |
| Copy / Download | Clipboard / file payload | Continuous lowercase hex string — no offsets, spaces, or ASCII |
What it does vs what it doesn't
An honest capability list so you don't expect features that aren't there.
| Feature | In the inspector? | If not, use |
|---|---|---|
| Offset + hex + ASCII dump | Yes | — |
| Copy bytes as hex | Yes (flat string) | — |
| In-dump search box | No | Desktop hex editor find |
| Seek to arbitrary offset | No — always from offset 0 | xxd -s / HxD / 010 Editor |
| Field labels / colour annotations / tooltips | No | 010 Editor templates |
| Edit / write bytes | No — read-only | Desktop hex editor |
| Automatic file-type verdict | No | magic-byte-validator |
| Entropy / packing score | No | entropy-analyzer |
Cookbook
Short reading recipes for the most common questions. Dumps show the on-screen layout (offset · hex · ASCII).
Reading the offset column to find byte 0x3C
A frequent question: how do I get to a documented offset? Each row label is the offset of its first byte, advancing by 16 (0x10). 0x3C lives in the row labelled 00000030.
00000030 90 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 ................
0x30 ^^ 0x3C is here
Byte at 0x3C = the 13th byte of row 00000030 (0x3C − 0x30 = 0xC).
Here it begins the 4-byte little-endian value 80 00 00 00.Why a string shows partly as dots
People ask why a name with an accent looks broken in the sidebar. The sidebar only resolves single-byte ASCII; multi-byte UTF-8 bytes fall outside 0x20–0x7E and render as dots.
Text 'café' in UTF-8 = 63 61 66 C3 A9 00000000 63 61 66 C3 A9 ... caf.. 63 61 66 → 'caf' (printable) C3 A9 → 'é' as two UTF-8 bytes, both > 0x7E → '..' Read the hex to reconstruct: C3 A9 = U+00E9 'é'.
What the Copy button actually copies
A common surprise: Copy doesn't reproduce the on-screen layout. It gives one continuous lowercase hex string of the sliced bytes.
On screen: 00000000 4D 5A 90 00 03 00 00 00 MZ...... Clipboard after Copy: 4d5a900003000000 No offsets, no spaces, no ASCII. To get spaced pairs back, re-group: 4d 5a 90 00 03 00 00 00
Confirming a file type from offset 0
The most common reason people open the inspector: 'is this file what its extension says?' Read the first row and compare to the known signature.
File: data.csv
00000000 50 4B 03 04 14 00 06 00 ... PK......
50 4B 03 04 ('PK..') is a ZIP/OOXML, not CSV text
(a CSV would show readable comma-separated text in the
sidebar). The .csv extension is wrong — likely a renamed
xlsx. Confirm with magic-byte-validator.Spotting why a file won't display fully
If you're on Free and the header you want is past byte 256, you've hit the window cap — not a bug. The dump simply stops at your tier's limit.
Free tier shows bytes 0x00–0xFF (256 bytes), then stops. If your field is at offset 0x140 (320), it's beyond the Free window. Options: - Upgrade to Pro (1 KB) or Developer (8 KB) - Or read the field in a desktop hex editor
Edge cases and what actually happens
Big file rejected even though only the header shows
RejectedThe inspector reads the entire file into an ArrayBuffer before slicing the first N bytes, and it enforces your plan's file-size limit (10 MB Free → 2 GB Developer). So a 50 MB file on Free is rejected with an exceeds the limit message even though only 256 bytes would display. Carve a sample with a desktop tool or upgrade.
Want a bigger byte window than your tier
By designThe window is fixed: 256 B Free, 1 KB Pro / Pro+Media, 8 KB Developer. There's no slider to raise it — the note above the result just states your active cap. For more than 8 KB, use a desktop hex editor; in-browser DOM rendering of large dumps is why the cap exists.
Looking for a search box
Not availableThe hex view renders offset/hex/ASCII rows only — there is no in-dump search. To find a byte sequence, copy the hex string out and search it in a text editor, or use a desktop hex editor's find. Older descriptions mentioning a search box do not match the current tool.
Expecting colour-coded fields or tooltips
Not availableThe dump is uniform monospace — no colour highlighting of magic bytes, no field labels, no per-byte tooltips. You interpret structure yourself. For an automatic file-type verdict, run magic-byte-validator.
Copy output isn't xxd format
By designCopy and Download produce a continuous lowercase hex string with no offsets, spaces, or ASCII — the raw bytesToHex output. It is not interchangeable with xxd. If a tool expects grouped bytes or an offset column, re-format the string first.
Trying to edit and save bytes
Not availableThe inspector is strictly read-only — there's no editing surface and no write path. You can download the bytes it read, but you can't modify them in the tool. To produce a modified binary, edit in a desktop hex editor.
Signature appears mid-file
Out of viewThe inspector always reads from offset 0, so a mid-file signature (e.g. a self-extracting archive's embedded PK 03 04) won't appear — you'll see the wrapper instead. Seek to the embedded offset in a desktop tool.
Empty (zero-byte) file
Empty resultA zero-byte file produces an empty dump — there are no bytes to show. This is expected behaviour, not an error; the file simply has no header.
0x7F renders as a dot
ExpectedThe printable test is >= 0x20 && < 0x7F, which excludes 0x7F (DEL). So 0x7F shows as a dot in the ASCII sidebar like other non-printable bytes — by design, since DEL is a control character.
Frequently asked questions
How many bytes does each tier show?
Free shows the first 256 bytes, Pro and Pro+Media show 1,024 bytes (1 KB), and Developer shows 8,192 bytes (8 KB). The cap is fixed by tier — there's no byte-count slider. For most magic-byte and header reads, 256 bytes is enough.
Does the file get sent anywhere?
No. The on-page tool reads bytes into your browser's ArrayBuffer via the FileReader API and renders entirely in-page JavaScript — no network request carries your file. (A separate server-safe path exists for the public API, but the tool on the page runs locally.)
Why was my big file rejected when I only wanted the header?
The tool reads the whole file into memory before slicing the header, so the file as a whole must fit your plan's size limit (10 MB Free / 100 MB Pro / 500 MB Pro+Media / 2 GB Developer). It doesn't stream just the first bytes. Trim a sample on the desktop or upgrade.
Can I copy the hex output?
Yes — the Copy button puts the sliced bytes on your clipboard as a single continuous lowercase hex string (no offsets, spaces, or ASCII). Download saves the same string as a text file. It isn't xxd format, so re-space it if a downstream tool expects grouped bytes.
Why do some bytes show as dots in the ASCII column?
The sidebar only resolves bytes in the printable range 0x20–0x7E to characters. Everything else — control bytes, high-bit/UTF-8 bytes, and 0x7F (DEL) — renders as a .. It's how you tell readable strings from binary data at a glance.
Which formats get colour-coded field annotations?
None — the inspector doesn't annotate or colour-highlight any format. It shows raw offset/hex/ASCII for every file and you interpret the structure yourself. For an automatic file-type identification, use magic-byte-validator, which matches 300+ signatures.
Is there a search box to find a byte pattern?
No. The hex view has no search. Copy the hex string out and search it in your editor, or use a desktop hex editor (HxD, 010 Editor) with built-in find for full-file searches.
Can I jump to a specific offset?
There's no seek — the inspector always reads from offset 0 and shows the first N bytes. Use the offset column to locate a field within that window (rows advance by 16). For offsets beyond your window or a mid-file seek, use a desktop tool.
Can I edit the bytes here?
No — the inspector is read-only with no write path. You can download the bytes it read, but you can't modify them in the tool. For byte editing, use a desktop hex editor and save from there.
What file types does it accept?
Any type — the drop zone accepts */* and the bytes are read raw. Executables, images, archives, documents, and unknown blobs all work. It reports what's actually there without transforming the content.
How do I check whether a file is encrypted or packed?
Visually, a header full of dots with no readable strings is a hint. To quantify it, send the file to entropy-analyzer, which scores 256-byte chunks; values above ~7.5 bits/byte indicate compression or encryption.
What should I use for jobs the inspector can't do?
For an automatic type verdict, magic-byte-validator; for randomness/packing, entropy-analyzer; for comparing two files byte-for-byte, file-integrity-monitor; for hashing, multi-hash-fingerprinter. For editing, seeking, or searching whole files, a desktop hex editor.
Privacy first
Every JAD Security operation runs entirely in your browser. Files, passwords, and PGP private keys never leave your device — verified by zero outbound network requests during processing.