wire / magic / gzip

gzip signature (1F 8B)

A gzip member begins with the two magic bytes 0x1F 0x8B, followed by a compression-method byte (0x08 = DEFLATE) and a flags byte. gzip is a single-file container around a DEFLATE stream.

magic kind signature status standard verification verified tier B file-signature@1

aka: gz magic · \x1f\x8b

file signature

magic: 1F 8B @ offset 0

ascii: \x1f\x8b

.gz.tgz application/gzip

spec: RFC 1952

ID1=0x1f, ID2=0x8b are the fixed magic.
Byte 3 (CM) is the compression method; 0x08 = DEFLATE (the only one in common use), so files usually start 1F 8B 08.
Byte 4 (FLG) holds flags (FTEXT, FHCRC, FEXTRA, FNAME, FCOMMENT).
A '.tgz' / '.tar.gz' is a tar archive wrapped in a single gzip member.

provenance

source: https://www.rfc-editor.org/rfc/rfc1952#section-2.3
version: RFC 1952 (GZIP file format 4.3), Section 2.3 Member header
retrieved: 2026-05-29 · updated: 2026-05-29T00:00:00Z

gzip signature (1F 8B)

file signature

provenance

see also