File identity

Check what a file really is before you open it

A filename is a claim, not a fact. Foretaste reads the file's own leading bytes to work out what it is, points out names that read as one thing and end as another, and checks a download against the hash its publisher printed, all before anything reaches your disk.

Add to Chrome, free What it can and cannot see

This is not a virus scanner, and it never says "safe"

Worth saying first, because the rest of the page is easier to read once it is clear. Foretaste has no signatures, no reputation database and no way to be right about whether a file is dangerous. So it never uses the word.

What it does is report facts and let you draw the conclusion: this name reads as a document and ends in .exe, this archive contains four programs, this name contains a character that reorders the text around it. Every one of those is checkable and none of them is a verdict.

That line is enforced rather than promised. A test in the extension reads every sentence this feature can produce and fails the build on a verdict, because a tool that guesses at "safe" teaches people to trust the guess, and the guess is the part that will eventually be wrong.

It reads bytes, not names

Real download links look like download?id=18392. Servers mislabel files constantly, and a name is whatever the last person to touch it decided. So Foretaste reads four signals and trusts them in this order:

The file's own leading bytes. One kilobyte is fetched and checked against the signatures formats actually begin with. Bytes do not lie the way names do.
The Content-Type header, when the server sends a specific one. application/octet-stream counts as no answer, because it means "some bytes".
The filename in Content-Disposition, which is where the real name usually lives when the address does not have one.
The extension in the address, last, because it is the weakest of the four.

There is one deliberate exception. A container that several formats share yields to the filename: a .docx genuinely is a ZIP, and telling you so would be true and useless.

The practical effect is that a file with a misleading extension is named for what it is, and a file with no extension at all is still opened correctly. The detection order, on the format page.

The bytes can also say "program". Windows, Linux and macOS programs each begin with a signature of their own, so a link called invoice.pdf whose bytes are a Windows program is reported as exactly that: the name says PDF document and the bytes say Program. Nothing is opened, nothing is run, and Foretaste still does not tell you whether the file is dangerous. A program is how programs are distributed. Knowing you are looking at one, when the name said otherwise, is the whole of the finding.

Two things it will not do, both on purpose. A Java class file shares its first four bytes with one kind of macOS binary, so that signature is left out rather than reporting a compiled class inside a jar as a program. And a shell script is text, and stays text: treating a #! line as a signature would call every build script in every archive a program, and this is worth saying only while it is rare.

Names that are doing something

When you open an archive, Foretaste reads its index and says what it notices about the names in it. Reading the index costs nothing extra, so none of this is a separate fetch. Five things get pointed out, and each one names the files it is about so you can go and look:

What is noticed	Why it is worth a sentence
Files that run	Entries whose only purpose is to execute: `.exe`, `.msi`, `.bat`, `.ps1`, `.vbs`, `.jar`, `.apk` and the rest. Not `.js` or `.py`, because a source archive is made of those and a note that fires on every repository is one people learn to scroll past.
Names that end differently from how they read	`invoice.pdf.exe` reads as a PDF and is a program. The real extension is always the last one, and a file list showing a document icon does not change that.
Characters that reorder the text	A right-to-left override is an invisible character that makes `photo` + override + `gnp.exe` display as `photo.exe.png`. The name really does end in `.exe`. Nothing is rendering it wrong; that is what the character is for.
Paths that climb out	An entry whose path walks upward out of the folder it would be extracted into. An archive is supposed to unpack into one place.
Encrypted entries	Which files inside are locked, so a password prompt is expected rather than surprising.

All of this comes out of the archive's index, which is read over byte ranges without downloading the archive. On a 40 MB ZIP that is about 67 KB, so you get the list of names and everything above about them for the price of a small image.

Checking a download against its published hash

Projects print a SHA-256 beside a release so you can tell that the file you got is the file they published. Almost nobody checks, because checking means downloading the file, opening a terminal, remembering the command, and comparing sixty-four characters by eye.

Foretaste puts the two halves on one screen:

Paste it in whatever shape you copied it. The bare hex, a sha256: prefix off a package manager, or the whole line out of a SHASUMS file with the filename still on the end. All of them are read.
The algorithm comes from the length. 40 hex characters is SHA-1, 64 is SHA-256, 96 is SHA-384, 128 is SHA-512. This matters more than it sounds: saying "does not match" when the real problem is that somebody compared a SHA-1 against a SHA-256 is worse than saying nothing, because it tells them their download is corrupt when it is fine.
The hashing happens in your browser, on the bytes, through the browser's own crypto. Nothing is uploaded. That is the difference between this and every "drag your file here" hash site, and it matters most for exactly the files you would most want to check.

It is behind a button, and the button says what it will cost. A hash needs every byte of the file by definition, so this is one of the few things in Foretaste that cannot be done from a fragment, and it asks before it spends.

The workflow it was built for: scan a release page, read the SHASUMS text file in place, copy the line for the binary you want, and check it against the binary, all without either file reaching your disk.

What this does not tell you

A matching hash is not a promise about the contents. It says the bytes you have are the bytes at the address the hash came from. If the hash and the file came from the same compromised page, they will agree with each other perfectly.

An archive with no observations is not an archive with nothing wrong. Foretaste checks names and the index, not contents. Whether each entry's contents match its name is checked per file, at the moment you open that file, because answering it for a whole archive would mean unpacking every entry, which is the opposite of the point.

A file that opens fine can still be a file you should not run. Nothing here is a judgement about that, and nothing here is a substitute for the tools that do make one.

Knowing what a file is does not tell you what opening it does. An SVG is the clearest case: the bytes say "image", and the format also permits scripts. What runs when you open an SVG, and what does not is that question rather than this one.

The questions people ask

How can I tell what a file really is when the link has no extension?

Foretaste fetches the first kilobyte and checks it against the signatures real formats begin with, then falls back to the Content-Type header, then to the filename in Content-Disposition, and only last to the extension in the address. An address like download?id=18392 carries no information at all, and the bytes carry all of it.

Can I tell if a file is a program before I download it?

Often, yes. Windows, Linux and macOS programs each begin with a signature of their own, and Foretaste reads the first kilobyte of a file rather than trusting its name. A link called invoice.pdf whose bytes are a Windows program is reported as a program with a name that disagrees. It is not a verdict on whether the file is dangerous, and Foretaste never gives one.

What is a double extension like invoice.pdf.exe?

A filename that reads as a document and ends in something that runs. The real extension is the last one, so invoice.pdf.exe is a program. Foretaste points out any name in an archive that reads as a document and ends in a runnable extension, and names which files they are so you can go and look.

Can I verify a SHA-256 checksum in the browser without uploading the file?

Yes. Paste the published hash, or the whole line out of a SHASUMS file, and Foretaste hashes the bytes in your own browser and compares. It reads SHA-1, SHA-256, SHA-384 and SHA-512, and works out which one you pasted from its length, so it never reports a mismatch when the real problem is that you compared a SHA-1 against a SHA-256.