Free Binary File Inspector
Binary File Inspector reads Windows PE (EXE, DLL, SYS), ELF, Mach-O (including universal binaries) and WebAssembly files in your browser. It shows architecture, 32 or 64-bit, entry point, compile timestamp with impossible dates flagged, ASLR, DEP and CFG flags, sections with entropy, imports, exports, symbols, filterable strings, SHA-256 and imphash, plus a hex view and a JSON or Markdown report.
- Formats:
- PE, ELF, Mach-O (incl. fat), WebAssembly
- Hashes:
- SHA-256, SHA-1, MD5, imphash (PE)
- File size:
- Up to 1 GB, parsed in a background worker
- Price:
- Free
- Runs:
- Locally, in your browser
- Uploads:
- None: files never leave your device
- Account:
- Not needed
Quick answers
Is my file uploaded or executed?
No. The file is read in your browser by a background worker and never leaves your device. Its code is never run: the tool only reads bytes and decodes the headers.
How do I check if a DLL or EXE is 32-bit or 64-bit?
Drop it in: the Overview shows PE32 (32-bit) or PE32+ (64-bit) and the machine, such as x86, x86-64 or ARM64. The same works for ELF .so files, Mach-O binaries and .wasm modules.
Processed on your device: your files are never uploaded. How it works
Network activity in this tab
What this page has requested since you opened the site in this tab. An upload is any request that sends data: POST, PUT, PATCH or a request with a body.
No uploads: nothing has been sent from this page.
No network requests yet.
To see every request, open your browser's developer tools (Network tab).
How to use the Binary File Inspector
- Drop an .exe, .dll, .sys, .so, .dylib, .wasm or any other file: it is read and parsed on your device, never uploaded or run.
- Read the Overview: format, architecture, 32 or 64-bit, entry point, compile timestamp, security flags such as ASLR, DEP/NX and CFG, and the entropy chart.
- Open Sections, Imports, Exports and Symbols, or Strings to filter URLs, IP addresses, file paths and registry keys.
- Press Hex on a section or a string offset to see its bytes, then use Download JSON, Download Markdown or Copy Markdown to share the report.
Credits & open source
Our own code plus open-source libraries. Thank you to the people who make these projects.
- hash-wasmFast WebAssembly hash functions (MD5, SHA, BLAKE3, CRC32...). © Dani Biró · MIT
Web platform APIs used: Web Workers, File API, Clipboard API.
Full license texts: third-party notices · all credits
Frequently asked questions
Can it tell whether a file is malware?
No. It shows facts that analysts look at, such as imports, strings, entropy and whether a signature is present, but it gives no verdict. High entropy, for example, also occurs in ordinary software that stores compressed data.
Does it verify digital signatures?
No. It reports whether a PE file carries an Authenticode certificate table or a Mach-O file a code signature, without checking the certificates. Many Windows system files are signed through a catalog instead, so they show no embedded signature.
What is the imphash?
A fingerprint of a PE file's import table: the MD5 of its imported DLL and function names in lower case, so files that import the same functions in the same order share it. Ordinal imports are written as ordN, so a few files get a different value in tools that turn some ordinals into names.