File Extension Lookup
Paste file names or drop files to learn what each extension means: the format, its category and media type. The checker also looks for the tricks used to disguise malware, such as “invoice.pdf.exe”, hidden right-to-left characters that reverse the visible name, and long runs of spaces, and marks formats that can run code. Dropped files are never opened or uploaded; only their names are read.
- Runs in your browser
- No sign-up
- Free to use
One per line. You can also drop files below: only their names are read, never their contents.
| File | Extension | What it is | Media type | Safety |
|---|
How to use File Extension Lookup
- Type or paste file names, one per line, or drop files onto the box.
- Read the format and media type of each.
- Check the safety column for warnings.
- Treat anything marked Suspicious with great care.
File Extension Lookup features
About 200 formats
Documents, media, archives, fonts, code, data and installers.
Disguise detection
Double extensions, hidden direction characters and padded names.
Executable warnings
Programs, scripts, macro documents, shortcuts and disk images.
Compound extensions
Recognises .tar.gz and similar.
Bulk
Up to 2,000 names at once, with a summary.
Names only
Dropped files are not read or uploaded.
When to use File Extension Lookup
- Checking an e-mail attachment’s name before opening it.
- Finding out which program opens an unfamiliar file.
- Reviewing a folder listing for disguised executables.
- Teaching colleagues how malicious file names are disguised.
File Extension Lookup FAQ
What is a file extension?
The letters after the last dot in a file name, such as pdf in report.pdf. Operating systems use it to decide which program opens the file.
What is a double extension?
A name like invoice.pdf.exe. Windows hides known extensions by default, so the file appears as invoice.pdf while it is really a program. This checker flags that pattern.
What is the right-to-left trick?
An invisible Unicode character (U+202E) reverses the display of the text after it, so a file named “photo\u{202E}gpj.exe” looks like photoexe.jpg. The checker removes such characters and shows the real extension.
Does the extension prove what a file contains?
No. Anyone can rename a file. The extension says what the file claims to be; its first bytes, the file signature, show what it really is.
Are my files uploaded?
No. When you drop files, only their names are read by your browser. The contents are never opened.
Why are .docm and .xlsm marked?
The m means the document can contain macros, small programs that run when allowed. Macro documents are a common way to spread malware.
What extensions tell you, and what they hide
An extension is a naming convention, not a property of the data. It tells the operating system which application to launch, and it tells people what to expect. That makes it useful for identifying unfamiliar files, from a HEIC photo taken on an iPhone to a .webmanifest file on a website, and it is the first thing to check when someone sends you an attachment.
It is also the easiest thing to fake, which is why malware authors put so much effort into file names. The most common trick is the double extension: Windows hides extensions of known file types by default, so “Invoice_2026.pdf.exe” appears as “Invoice_2026.pdf” with a document icon chosen by the attacker. Showing extensions in Windows Explorer and macOS Finder settings defeats most of these tricks.
A subtler trick uses Unicode text-direction characters. The right-to-left override, U+202E, makes everything after it display backwards, so the real extension .exe can appear in the middle of the name while the visible end says .jpg or .pdf. The characters are invisible, so the checker strips them, names the problem and shows the extension the operating system will actually use.
Some formats deserve caution even with honest names. Executables and installers, scripts such as .ps1 and .vbs, shortcuts, HTML applications, disk images that can hide executables from download protections, and Office documents with macros can all run code. Opening them is only safe when you trust where they came from; when in doubt, ask the sender through another channel.
For certainty about content, the extension is not enough: the first bytes of a file, its signature or magic number, identify most formats regardless of the name. Upload handlers on websites should check the signature, the extension and the declared media type together. This page only reads names and never opens your files, so it is safe to use on anything you are unsure about.