Understanding PDF Magic Bytes

How does a computer actually know a file is a PDF? It doesn't look at the `.pdf` extension; it looks at the Magic Bytes.

The %PDF- Header

According to the ISO specification, the very first bytes of a valid PDF file must be `%PDF-` followed by a version number (like `1.4` or `1.7`).

If you open a PDF in a text editor or hex viewer, the first line will always look something like this:

Why this matters for Security

Malicious files often try to disguise themselves by changing their extension. Operating systems and browsers inspect the magic bytes to determine how to safely handle the file buffer. You can check any file yourself using our local Hex Viewer tool.