Identify an Unknown File Extension

Last reviewed on May 11, 2026

You've been sent a file. The icon is generic, the extension is something you've never seen, and double-clicking produces the familiar "Windows can't open this file" or "macOS doesn't recognise this file type" dialog. Before installing anything, the most useful thing to do is identify what the file actually is. That makes everything that follows — installing the right software, converting it to a friendlier format, or recognising that it's already broken — much easier.

The diagnostic order below is built to fail fast. Each step takes a few seconds, and as soon as one of them produces a clear answer, you can stop and act on it.

Step 1: Make sure you can actually see the extension

Windows and macOS both hide common file extensions by default, which means the part you can see may not be the full extension. A file that looks like invoice may really be invoice.pdf.exe on disk — a classic phishing pattern. Before guessing, force the operating system to show the real extension:

• Windows 10/11: File Explorer → View menu → tick "File name extensions".
• macOS: Finder → Preferences → Advanced → tick "Show all filename extensions".
• Linux file managers: already show extensions by default in almost every distribution.

Mobile platforms hide extensions even more aggressively. On iOS, the Files app shows a type description rather than the extension; tap-and-hold and choose "Get Info" to see the real filename. On Android, file manager apps typically expose the extension under a long-press or rename action.

Step 2: Read the context the file came from

Before researching the extension, look at where the file appeared. The context is often a stronger clue than the extension itself:

• An email attachment from a colleague who works in a specific tool (CAD, audio editing, accounting) probably uses that tool's native format.
• A file inside a folder full of other files with familiar extensions is usually related — a project file or sidecar to those files.
• A download from a software project's release page is likely either an archive (zip, tar.gz, dmg, msi) or a platform-specific package.
• A file extracted from a phone backup belongs to the phone's app ecosystem; the extension is often app-specific.

Context also tells you when not to trust an extension. A file received from a stranger with an executable extension (.exe, .scr, .bat, .vbs, .js, .lnk, .msi, .reg, .ps1, .com, .pif) should be treated as suspicious regardless of the icon. Files received in archives that contain a hidden executable alongside a fake document icon are one of the most common malware delivery patterns.

Step 3: Look the extension up

A direct search of the form "what is .xyz file" produces an answer for the overwhelming majority of extensions in use. Useful structured references include:

• The Wikipedia article for the extension — typically lists the format's official name, the software that produces and consumes it, and the magic-number signature.
• The FileFormat.info entry — focused on format internals, including byte signatures.
• The IANA media types registry — authoritative for MIME types, useful when the file appears in an email or HTTP context.

Sanity-check the result against the file's size. A 12-byte file that claims to be a PSD is almost certainly truncated. A 4 GB file that claims to be a JSON document is more likely a database or backup blob with a wrong extension.

Step 4: Inspect the first few bytes

The extension is just a label; the bytes are the file. When the extension lookup gives an answer that doesn't fit, or when the extension is missing entirely, peeking at the start of the file is the single most useful diagnostic step. Most formats start with a fixed byte sequence — a "magic number" — that identifies them regardless of what the filename claims.

You don't need a hex editor for the basics. On Windows, PowerShell's Get-Content -TotalCount 1 -Encoding Byte shows the leading bytes; on macOS and Linux, the file command does the same job and reports the detected format. For a deeper view, see our dedicated guide on file signatures and magic numbers.

Step 5: Decide whether the file is what it claims to be

Now compare three things: the extension, the file's reported size and structure, and the detected magic number. Three outcomes are common:

• All three agree. The file is what it claims to be. Move on to opening it with the right software.
• The magic number disagrees with the extension. Either the file has been mislabelled (rename it to match the real format and try again) or it was deliberately disguised. For files received from untrusted sources, treat this as suspicious.
• No recognisable magic number is present. The file is most likely either text in some encoding, a compressed payload, or corrupted. Open it in a text editor — readable text is text; otherwise, see our guide on working with corrupted files.

Step 6: Open it with the right tool

Once the format is identified, the next step depends on what it is:

• Common consumer formats (PDF, DOCX, JPG, MP4, ZIP, and so on) — the operating system usually has a default. If it claims it doesn't, see why a file won't open.
• Specialist formats (CAD, audio session files, raw camera files) — install the originating application or a viewer designed for that format.
• Archive formats (zip, tar.gz, 7z, rar) — extract first, then re-run this guide on whatever is inside.
• Source code, data files, or anything text-based — a code editor handles them; encoding errors are covered in our character encoding guide.

If nothing fits and you have no way to find software for the format, opening a file without its native software explains the partial-fallback approaches that sometimes salvage at least the content.

Common mistakes to avoid

• Don't just rename the file to a different extension and hope it opens. That works only when the file was already in the new format but mislabelled. In every other case it produces the same "won't open" error with extra confusion.
• Don't install "universal file opener" software from a search result without checking what it actually is. Several products advertised that way are either repackaging free tools or are themselves malware.
• Don't ignore a magic-number mismatch on a file from an untrusted sender. A "document" whose bytes look like an executable is a deliberate disguise, not a clerical error.
• Don't keep retrying on a file with size zero. An empty file has no real content, regardless of its extension; the issue is upstream — at whatever sent or saved it.

When the answer is "you can't open it at all"

Some files are tied to a specific machine, account, or hardware key — DRM-protected media, encrypted backups, and licence-locked project files among them. If your identification work concludes that the file is one of those, no third-party tool will open it without the appropriate credentials. The right move is to go back to the source — the original sender, the application that created the file, or the support channel for the platform that encrypted it.

For everything else, the diagnostic order above takes a few minutes at most and lands on a clear next step almost every time.