Is this file really a PDF or image? Check for a fake or double file extension
Last reviewed 2026-09-19
A file's extension is just part of its name, and anyone can change it. Attackers use double extensions (invoice.pdf.exe) and text tricks to make a program look like a document, and honest mistakes such as a renamed file are just as common. The reliable check is the file's first bytes, which identify its real type.
Messages you might see
- “invoice.pdf.exe”
- “A file that won't open because its extension doesn't match its content”
- “Is this attachment safe?”
Why it happens
- Phishing attachments that disguise a program as a document.
- A file renamed to another extension without converting it.
- An archive or program appended to a picture.
Try this first (free, no tool needed)
- Turn on file extensions in Windows Explorer (View > Show > File name extensions) so double extensions are visible.
- Never open an unexpected attachment. Check with the sender through another channel.
- Scan the file with your antivirus, and use an online multi-engine scanner if you are comfortable uploading the file to it.
If that didn't work
These tools run in your browser. Your file is read and repaired on your own device and is never uploaded.
File-Type Safety Checker
Reads a file's first bytes to work out what it really is and compares that with its name: a program disguised as a PDF, an archive hidden after an image, double extensions and right-to-left-override names. It produces a plain-language report and never modifies the file. It is a quick signature and name check, not a virus scan.
Open File-Type Safety CheckerCommon questions
Can it tell me a file is safe?
No. It tells you what the file really is and whether the name is misleading. It is not a virus scan, so use your antivirus for that.
Is my file uploaded anywhere?
No. The tool runs as a program inside your own browser, so the file is read and repaired on your device and never sent to a server.