MP3 / ID3 signature (ID3 or FF Fx frame sync)

An MP3 file most often begins with an ID3v2 tag whose first three bytes are the ASCII 'ID3' (0x49 0x44 0x33). A bare MPEG audio stream instead begins with an 11-bit frame sync: 0xFF followed by a byte whose top 3 bits are set (0xE0 mask), commonly seen as FF FB / FF F3 / FF F2.

file signature

magic: 49 44 33 @ offset 0

ascii: ID3

.mp3 audio/mpeg

Tagged file: starts 'ID3' (49 44 33) — an ID3v2 header — then the audio frames follow after the tag.
Untagged file: starts with an MPEG frame sync, 0xFF then a byte masked 0xE0, e.g. FF FB (MPEG-1 Layer III), FF F3 / FF F2 (MPEG-2/2.5 Layer III).
ID3v1 metadata, if present, is a fixed 128-byte block at the END of the file starting with the ASCII 'TAG' (54 41 47).
Because the audio is frame-based, detection by frame sync can have false positives; the ID3 prefix is the reliable signal when present.

provenance

source: https://id3.org/id3v2.4.0-structure
version: ID3v2.4.0 structure (tag identifier 'ID3'); MPEG frame sync per ISO/IEC 11172-3
retrieved: 2026-05-29 · updated: 2026-05-29T00:00:00Z

per-fact attribution:

ext.magic_hex — https://id3.org/id3v2.4.0-structure ID3v2 tag begins with the file identifier 'ID3' (49 44 33) followed by two version bytes and flags.
ext.notes — https://en.wikipedia.org/wiki/MP3#File_structure Corroborates that MPEG audio frames begin with an 11-bit sync (FF Ex/Fx); ID3v2 tags commonly prefix MP3 files, ID3v1 trails them.

agent: curl -H 'accept: application/json' wire.phall.io/magic/mp3-id3 or /magic/mp3-id3.json

MP3 / ID3 signature (ID3 or FF Fx frame sync)

file signature

provenance

see also