Files, Binary & Compression
Select a local executable or load a tiny example, then inspect its headers explicitly.
Drop one ELF, PE or Mach-O file here, or choose a file.
No file selected
Read locally in this browser; the file is never uploaded or executed.
Select a file or try an example.
Select a file or try an example.
When a build will not load, an executable file inspector can reveal whether its architecture, entry point or section offsets match what you expected. The bytes behind each field matter more than the filename extension.
If you came looking for an ELF header viewer, PE header viewer or Mach-O viewer, this executable file inspector keeps each format’s own terms. It reads one file in your browser and never starts the program.
Follow structure back to exact bytes without running a binary.
The executable file inspector labels ELF program headers separately from sections, follows PE from DOS to its optional header, and walks Mach-O load commands. A generic magic-byte verdict cannot explain those structures.
In a universal Mach-O file, each architecture has its own bounded slice. Choose arm64 or x86-64 and see the slice offset, size and header rather than treating the fat wrapper as the executable itself.
The filename and byte count appear before analysis. Files above 32 MiB are refused before they are read into memory; the three built-in examples are tiny headers, not runnable programs.
Select a file, then choose Inspect headers or press Ctrl/Cmd+Enter. A changed file makes the previous report stale, so copy and download stay disabled until a successful run.
Expand a header, section, segment or load command and select a field to see its absolute file offset and first bytes. For universal Mach-O, choose a slice and inspect again before exporting JSON.
File, program and section headers are decoded with full-width offsets. Extended section counts and string-table indexes are resolved from section zero; a deliberately absent section table remains a valid empty result.
The DOS header points to the PE signature, then the COFF and optional headers lead to the section table. Machine type, entry RVA, image base, flags and raw section ranges are kept distinct.
Both 32- and 64-bit Mach-O headers, load commands, segments and sections are listed. Fat containers retain every slice's architecture, offset and size, even when one slice is malformed.
Click a field or table row to inspect its hexadecimal file range. Zero-filled ELF and Mach-O sections are identified as memory-only, so the viewer does not invent bytes that are absent from disk.
This executable file inspector accepts ELF32/64 in either byte order, PE32/PE32+, and thin or universal Mach-O 32/64. It rejects other magic values, including raw firmware, WASM and Unix ar archives.
No. A PE or Mach-O header or code-signature command is only structural evidence. This executable file inspector does not verify certificates, hashes, revocation or whether code is malicious.
The limit is 32 MiB. The browser refuses larger files before loading their bytes, then bounds every declared table and slice. Use platform tools such as readelf, dumpbin or otool for a larger binary.
No. The File API reads it in your tab; this page has no upload or remote fetch path. The JSON report is created only when you choose Copy or Download.
No. It exposes headers, section and segment metadata, flags and byte ranges. It never translates machine instructions or reconstructs source code.
A stripped ELF may still have section headers, but some executable files legitimately omit the section table. If e_shoff and e_shnum are both zero, the viewer reports no sections; if a declared table is out of bounds, it reports damage instead.
Still have a question?
Try the ELF, PE and Mach-O examples, then use the executable file inspector on a build you need to understand. Check a field's actual offset before sharing the JSON report.
The selected file stays in this browser tab.