What is this file, really?

Drop executables, documents, archives, images or source code. Google's Magika model reads the first and last kilobyte of each file and identifies its true content type from the bytes, whatever the name or extension says. On top of that verdict the page triages: what runs code, what is disguised behind a wrong extension or a tricked name, what sits inside a zip, plus a SHA-256 for every file. Everything runs in this tab: files are never uploaded, and once the model is cached the page works with no network at all.

Drop files or folders here

You can also paste files or text. Large files are fine: only the head and tail are read.

File	Detected type	Triage	Confidence	Extension	SHA-256

Click a row for the first 64 bytes, the full hash and the runner-up predictions. Danger means the content runs code (executables, installers, shortcuts, scripts) or the name hides what the bytes are; Caution means an archive, disk image or macro-capable document, an encrypted archive, or a low-confidence verdict. Magika identifies what a file is, not whether it is safe: a genuine PDF can still be malicious and most executables are not. Confidence is the model's score for its top label; below Magika's per-type threshold the verdict is downgraded to a generic text or unknown type, exactly as the command-line tool does.

How it works

Model. Magika standard_v3_3 by Google (Apache-2.0): a 3 MB ONNX network trained on tens of millions of files across 200+ content types, run here with onnxruntime-web (WebAssembly).
Private by construction. The page can only talk to its own origin and the SkillSafe model registry. Your files stay in the browser; there is no server-side analysis at all.
Offline. A service worker caches the page, the runtime and the model on the first visit. Afterwards it loads and classifies with the network off; the status pill says when that is the case.
Extension check. A file called invoice.pdf that is really a Windows executable is flagged, along with anything else whose name disagrees with its bytes, and names built to deceive: invoice.pdf.exe, padding spaces before the real extension, right-to-left override characters.
Inside archives. Zip members are streamed through the browser's own inflater one at a time, classified and hashed without being extracted; an executable hiding in invoice.zip surfaces on the archive's row. Encrypted members are reported, not opened. Limits: 500 members, 256 MB per member, 1 GB per archive.
Hashes and export. Every file gets a SHA-256 (computed here, streamed for large files) to pivot on elsewhere, and the table exports as CSV or Magika-style JSON.
Same answers as the CLI. Feature extraction, thresholds and the overwrite map follow Magika's reference implementation, so labels match magika --json.