.TAR file signature
A POSIX tar archive file begins with the bytes 75 73 74 61 72 (ustar in ASCII) at offset 257 (0x101). The signature is the same whatever the file is named, which is why a renamed or extensionless TAR file is still recognisable.
Signature
| Offset | Hex | ASCII |
|---|---|---|
| 257 | 75 73 74 61 72POSIX tar. Very old V7 tar files have no magic at all. | ustar |
MIME type: application/x-tar · usual extensions: .tar
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 file.tar
file file.tarWindows (PowerShell):
Format-Hex -Path file.tar -Count 32This signature sits at offset 257, so look there rather than at the first bytes: xxd -s 257 -l 16 file.tar.
If the bytes do not match
A file named .tar whose first bytes are something else is not a TAR file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the TAR guide explains what a genuine file should contain.