Suspicious File Inspector
Check a file's real structure before opening it — mismatched extensions, embedded macros, PDF active content — entirely on your device.
Also known as: Suspicious file checker, File signature checker, Macro detector, PDF malware checker
How it works
- 1Drop in any file you want to check.
- 2Review the overall risk summary and the specific flags found.
- 3Check the file details panel for its detected type, entropy, and SHA-256 hash.
- 4Treat flags as reasons for a closer look, not a final verdict.
Why use Suspicious File Inspector
Reads real magic bytes, not just the extension
Detects the actual file type from its binary signature and flags a mismatch against what the extension claims.
Actually opens ZIP-based Office files
Peeks inside .docx/.xlsm-style archives for a real vbaProject.bin entry instead of trusting the extension alone.
Scans PDFs for active-content triggers
Checks for /JavaScript, /OpenAction, /Launch, and /AA — the dictionary keys behind PDF-based malware.
Honest about being a heuristic, not antivirus
States plainly that a clean result means no known red flags, not a guarantee — no overclaiming.
SHA-256 hash and entropy included
Gives you the file's hash for cross-referencing elsewhere, plus a Shannon entropy reading.
Nothing ever uploaded
Every check runs on the file's bytes locally — the file itself never leaves your device.
Who uses Suspicious File Inspector
Checking an unexpected email attachment
Inspect a downloaded attachment's real file type and structure before opening it.
Verifying a downloaded file matches its expected extension
Confirm a file claiming to be a PDF or image is actually that file type, not a renamed executable.
Checking an Office document for embedded macros
Look inside a .docm/.xlsm (or any ZIP-based Office file) for a real VBA macro project before enabling content.
Screening a PDF for active content
Check whether a PDF contains JavaScript, launch actions, or automatic actions before opening it in a viewer that would run them.
Getting a file's SHA-256 hash for cross-referencing
Compute a hash to compare against a vendor-published checksum or to search elsewhere.
Spot-checking files from an unfamiliar source
Run a quick structural check on files from a source you don't fully trust, before deciding whether to open them.
About Suspicious File Inspector
A file's extension is just a label the operating system trusts by convention — nothing stops a program from being renamed "invoice.pdf.exe" or a script from being saved as "photo.jpg." This tool doesn't trust the label: it reads the file's actual magic bytes (the first few bytes that identify a real PE executable, ELF binary, ZIP archive, PDF, or image) and compares that against what the extension claims, flagging the mismatch when content and label disagree.
For Office documents, the most common recent attack technique is an embedded VBA macro that runs automatically or on a click. Since modern Office formats (.docx, .xlsx, .pptx and their macro-enabled cousins) are ZIP archives under the hood, this tool actually opens the ZIP structure (using the same JSZip library that powers this site's other document tools) and looks for a real vbaProject.bin entry — not just trusting the file extension, since a file can be renamed to ".docm" without actually containing a macro, and a genuinely macro-laden file can hide behind an ordinary-looking ".doc" name in some older formats.
For PDFs, it scans the raw file for the dictionary keys that indicate active content — /JavaScript, /OpenAction, /Launch, /AA — the mechanisms behind PDF-based malware that runs code or launches external programs when the file is opened. This is a text scan over the raw bytes, which means it can miss content hidden inside compressed object streams, a real and disclosed limitation rather than a silent gap.
Every check — magic-byte detection, macro peeking, PDF scanning, SHA-256 hashing, entropy calculation — runs entirely in your browser. Nothing about the file you inspect is ever uploaded. And to be direct about scope: this is a heuristic red-flag detector built from publicly documented file-format signatures, not a signature-database antivirus engine — it can catch the structural tricks described here, and it can't catch novel or heavily obfuscated malware the way a real AV engine's threat-intelligence database can.
Suspicious File Inspector vs. other options
How Open Tools Library compares to desktop software and other online tools.
| Feature | Open Tools Library | Desktop software | Other online tools |
|---|---|---|---|
| Price | Free, unlimited | N/A | Often free with upload limits |
| Content privacy | File never leaves your device | N/A | Typically requires uploading the file |
| Macro detection method | Actually opens the ZIP structure and checks for vbaProject.bin | N/A | Often just checks the file extension |
| PDF active-content scan | Checks for JavaScript, launch, and auto-action triggers | N/A | Rarely offered in a free tool |
| Honesty about scope | Clearly labeled heuristic checker, not antivirus | N/A | Sometimes overstates detection confidence |
| Speed | Instant — no upload or queue | N/A | Often requires waiting for a server-side scan |
Pro tips
- An executable signature paired with a non-executable extension (like a .exe disguised as a .txt) is the strongest single red flag this tool can raise — take it seriously.
- A ".docm" or ".xlsm" extension alone doesn't mean a file actually contains a macro — this tool checks for a real embedded VBA project, not just the file name.
- The PDF active-content scan is a text-based scan of the raw file and can miss content hidden inside compressed object streams — a clean PDF result isn't an absolute guarantee.
- High entropy is completely normal for already-compressed files (ZIP, JPEG, PNG) — this tool only flags high entropy as unusual for text/script file types, where it can indicate obfuscation.
Technical specs
- Signature detection
- PE/ELF/Mach-O executables, ZIP/RAR/7Z/GZIP archives, PDF, RTF, OLE, common image formats
- Macro detection
- Opens ZIP-based Office files and checks for a real vbaProject.bin entry
- PDF active-content scan
- Scans raw bytes for /JavaScript, /OpenAction, /Launch, /AA (capped at 4 MB scanned)
- Entropy calculation
- Shannon entropy, sampled from the first 1 MB
- Hashing
- SHA-256 via the Web Crypto API
- Processing location
- 100% local, in your browser
Privacy & security
A tool for checking whether a file is safe to open shouldn't itself require sending that file anywhere.
Every check — signature detection, macro peeking, PDF scanning, hashing — runs entirely in your browser.
The file you inspect is never uploaded, stored, or sent to any server.
No account, no email, no login — just a file in, a flag list out.
Equally private whether you're checking a small script or a large document.
Frequently asked questions
Is this a real antivirus scanner?
No — it's a heuristic checker built from publicly documented file-format signatures. It can catch structural red flags like disguised executables, embedded macros, and PDF active content, but it can't catch novel or heavily obfuscated malware the way a signature-database antivirus engine can.
Is my file uploaded anywhere?
No — every check runs on the file's bytes entirely in your browser. The file itself is never sent to a server.
What does the entropy number mean?
It's a 0-8 measure of byte randomness (Shannon entropy). Already-compressed files naturally run high (7.5-8); this tool only flags it as notable for text/script files, where high entropy can suggest obfuscated or packed content.
Why does it check inside ZIP-based Office files?
Modern Office formats (.docx, .xlsm, and similar) are ZIP archives — opening the structure and looking for a real vbaProject.bin entry is more reliable than trusting the file extension alone, since either can be misleading on its own.
What file types does it recognize?
Common executables (PE/ELF/Mach-O), archives (ZIP/RAR/7Z/GZIP), documents (PDF/RTF/OLE), and common image formats — plus extension-based checks for known-dangerous script and installer types.
Should I still run a real antivirus scan?
Yes, for anything you're genuinely unsure about — this tool is a fast first look at a file's structure, not a replacement for a dedicated antivirus engine's signature database and behavioral analysis.
Troubleshooting
Why was my file flagged as an extension mismatch?
The file's actual byte signature doesn't match what its extension claims — for example, content matching a ZIP signature but named with a .pdf extension. This can be an honest mistake (a wrong extension) or a deliberate disguise, so it's worth verifying the source.
My Office file was flagged for a macro, but I don't remember adding one
Templates, add-ins, or a previous editor can embed a VBA project without it being obvious in the document itself — the flag reflects a real vbaProject.bin entry found inside the file's ZIP structure.
The PDF scan says it might miss hidden content — why?
The scan looks for active-content dictionary keys as raw text in the file. Some PDFs compress their internal object structure ("object streams"), which can hide those keys from a simple text scan — a disclosed, real limitation.
Why does a completely normal ZIP or JPEG show high entropy?
Already-compressed formats naturally have high entropy — that's expected and not flagged. This tool only raises an entropy flag for text/script file types, where high entropy is unusual and can indicate obfuscation.
Related searches
Landed here looking for something worded a little differently? Suspicious File Inspector covers all of these too:
Ready to use Suspicious File Inspector?
Free, private, and ready right now — no signup required.
Scroll to Suspicious File Inspector