File Identifier & Recovery
Browser-onlyIdentify a file's real type by reading its magic bytes, and recover files with wrong extensions (like photos wrongly labeled as .dll). Everything runs in your browser. No uploads.
Drop files here to identify them
Everything runs in your browser. Files are never uploaded.
Privacy: files are analyzed in your browser. Nothing is uploaded, stored, or logged on any server.
About File Identifier & Recovery
Workforge File Identifier & Recovery inspects the first few kilobytes of any file, matches those bytes against a curated table of known file-format signatures, and tells you exactly what the file actually is - regardless of what its filename claims. If the extension is wrong, the tool offers to rename it correctly. Everything happens in your browser: nothing is uploaded, nothing is stored, nothing is logged. The most common use case is recovering photos and videos that were renamed to .dll by ransomware, a broken sync tool, or a copy-paste mishap. If the file itself is intact, a magic-byte lookup will reveal what it really is and let you download it with the right extension.
The tool covers the file formats people actually deal with day-to-day. Images: JPEG, PNG, GIF, WebP, HEIC (including iPhone Live Photos), BMP, and TIFF. Video: MP4, MOV, MKV, WebM, AVI, and M4V. Audio: MP3, WAV, FLAC, and OGG. Documents: PDF. Archives: ZIP, 7z, RAR, and GZIP. Real Windows executables (DLL, EXE) are detected via the MZ header and blocked from rename so you never touch a legitimate system file by accident.
The tool also computes Shannon entropy over the first few kilobytes of each file. When entropy is very high (approaching maximum) and no signature matches, that combination strongly suggests the file has been encrypted or heavily compressed with no format header preserved. In practice this is the fingerprint of ransomware. When that pattern shows up, the tool blocks rename, surfaces a warning panel, and links directly to nomoreransom.org (free known-decryptor lookup) and cisa.gov/stopransomware (US federal incident response guidance). Renaming an encrypted file does not recover its contents - only decryption does. The tool refuses to pretend otherwise.
Common uses beyond ransomware recovery: quickly checking the real type of a file from an unfamiliar source, batch-fixing extensions on files exported from a broken tool, verifying a file matches the extension you were told it would, and inspecting the first 16 bytes of any file for forensics or debugging. Bulk workflow: drop 100 files at once, then either download each renamed file individually or grab a single ZIP of every renameable file. All of it, still, in your browser.
Frequently asked questions
How does this identify files without uploading them?
The tool reads the first 4 KB of each file entirely in your browser using the FileReader API. That local buffer is matched against a signature table (also loaded in the browser). No network request touches your file at any point.
Can it recover files encrypted by ransomware?
No. If a file has been encrypted, its raw bytes are scrambled and no rename will restore the original data. The tool detects likely encryption via entropy analysis and warns you with links to nomoreransom.org and cisa.gov/stopransomware instead of pretending a rename fixes anything.
What if the tool says my file is a real DLL?
Real Windows executables start with the bytes 4D 5A (the MZ header). When the tool sees that, it marks the file as a real DLL/EXE and blocks rename to prevent accidentally corrupting a legitimate system file. If you dropped a batch of files and one is a real DLL, leave it alone.
What formats are supported?
Images (JPEG, PNG, GIF, WebP, HEIC, HEIF, BMP, TIFF), video (MP4, MOV, MKV/WebM, AVI, M4V), audio (MP3, WAV, FLAC, OGG), documents (PDF), and archives (ZIP, 7z, RAR, GZIP). The full signature list is documented in the @repo/file-identifier package README.
Can I rename many files at once?
Yes. After analysis, use Download all renamed (ZIP) to get a single ZIP containing every renameable file with its correct extension. Filename collisions are handled by appending -1, -2, and so on rather than silently overwriting.
Explore all File Tools
File Identifier & Recovery is part of the Workforge File Tools suite. Every tool runs in your browser. No upload, no signup, no tracking.
See all File Tools→