Hex Viewer

A hex editor presents raw binary data in three aligned columns: the byte offset (the position of each byte in the file, counting from zero), the hexadecimal value of each byte, and an ASCII gutter that renders printable characters while substituting a dot for anything else. This layout — popularized by tools like xxd, od and the classic DOS debug utility — is designed so a human can scan a file's structure at a glance without needing a decoder for the format.

The offset column is more than decoration. When a protocol specification says "bytes 4–7 encode a big-endian uint32," the offset column is what lets you jump directly to those bytes. The hex column is the ground truth — every byte is shown as exactly two hex digits, 00 through FF, representing the full 0–255 range of a byte. The ASCII gutter is a convenience view: it's the same bytes reinterpreted as characters, but it's lossy because most byte values don't correspond to printable text.

A byte is 8 bits, which means it can represent 256 distinct values. Different notations make different aspects of that value visible. Decimal (0–255) is intuitive for arithmetic and matches how we think about numbers day to day. Hexadecimal (00–FF) is compact — two characters per byte — and maps cleanly to binary: each hex digit is exactly 4 bits, so 0x3F is 00111111, 0xFF is 11111111. That bit-level transparency is why hex is the standard notation for binary data.

ASCII is a 7-bit character encoding that maps values 0–127 to letters, digits, punctuation, and control codes. Values 32–126 are the printable characters you see in the ASCII gutter: space through tilde. Values 0–31 and 127 are control characters (NUL, TAB, LF, CR, ESC) that have no visual glyph, which is why they appear as dots. Bytes 128–255 aren't ASCII at all — their meaning depends on the interpretation (Latin-1, UTF-8 continuation bytes, or raw binary data), so the gutter can't render them meaningfully.

Endianness describes the order in which a multi-byte value is stored in memory. Big-endian stores the most significant byte first — the natural left-to-right reading order, used by network protocols (TCP/IP), JPEG, and most mainframe formats. Little-endian stores the least significant byte first — the order used by x86/x64 processors and therefore by most files created on modern PCs. The same 32-bit value 0x12345678 appears as 12 34 56 78 in big-endian and 78 56 34 12 in little-endian.

Endianness matters most when reading multi-byte integers from a dump. If you're decoding a protocol header or a binary file format, the spec tells you which endianness to assume — and if you assume wrong, 0x12345678 becomes 0x78563412, a value off by a factor of roughly 2.8 billion. Text encodings like UTF-16 make the ambiguity explicit with a byte-order mark (BOM) — FF FE for little-endian, FE FF for big-endian — which is why the UTF-16 view in a hex viewer is always labeled with its endianness.

Hex inspection is indispensable for binary file analysis. When you encounter an unknown file format, the first bytes often contain a magic number — a constant signature that identifies the format: 89 50 4E 47 for PNG, 25 50 44 46 for PDF, 50 4B 03 04 for ZIP. Spotting these in a hex dump is faster than trying to open the file in the wrong application. Protocol debugging is another core use case: when a device or service sends unexpected bytes, a hex dump of the raw packet lets you verify field-by-field that the bytes match the specification.

Reverse engineering and security analysis rely on hex editors for tasks like patching binaries, analyzing malware, or extracting embedded resources. Even in pure software development, hex dumps help debug encoding issues — if a UTF-8 string renders as mojibake, a hex dump of the bytes immediately reveals whether the data was encoded as Latin-1, UTF-16, or something else entirely.

Reading a hex dump is a skill built on pattern recognition. Start with the offset column to orient yourself — are you looking at the start of the file, a specific structure, or the middle of a payload? Then scan the hex column for recognizable patterns: runs of 00 bytes often indicate padding or unused fields, repeating patterns suggest fixed-size records, and the transition from structured data to repetitive or random bytes often marks the boundary between a header and its payload.

The ASCII gutter is your friend for spotting embedded text — filenames, error messages, format strings, and protocol constants all show up as readable fragments. A JPEG, for instance, will show JFIF or Exif as ASCII near the start. A well-formed text file is almost entirely printable ASCII in the gutter with occasional 0A (newline) and 0D (carriage return) bytes. A file that's mostly dots and scattered hex is likely compressed, encrypted, or binary — and the absence of readable text is itself a diagnostic signal.