ZERO-UPLOAD SANDBOX
.jpg .jpeg Tier 1 · Deep AST Parser

JPEG / JFIF / EXIF Image

Marker-segmented DCT lossy image format (`FF D8 FF ... FF D9`), where embedded APP1 EXIF TIFF headers carry camera rotation flags (`Orientation=6`) and GPS coordinates.

Marker segment lengths are always big-endian (`uint16_be`), EXCEPT inside the APP1 `Exif\x00\x00` payload which embeds a standalone TIFF header whose endianness can be either `'II'` (little-endian) or `'MM'` (big-endian)!

MIME Types image/jpeg
Byte Endianness mixed
PRONOM PUID fmt/43
0xFF

Drop any .jpg file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.jpg Magic Bytes & Header Offset Map

Offset: 0x00 (0 B)
FF D8 FF

JPEG SOI marker (FF D8) followed by first marker prefix 0xFF

Byte Offset Length Data Type Field Name Engineering Description
0x00 - 0x01 2 B uint16_be soi_marker 0xFFD8 Start of Image
0x02 - 0x03 2 B uint16_be app_marker 0xFFE0 (JFIF) or 0xFFE1 (EXIF)
0x04 - 0x05 2 B uint16_be segment_len Marker segment byte length (includes these 2 bytes)
Upload Gateway & AppSec Advisory

.jpg Security & Polyglot Risk Matrix

Risk Level: low
Arbitrary Code / Macros
NO (Inert Data)
Pickle Deserialization
SAFE (No Pickle VM)
XML External Entity (XXE)
NONE
Polyglot Prepend Risk
LOW (Strict 0x00 Magic)
Backend Upload Validation Recommendation

Auto-orient pixels according to EXIF Orientation (0x0112) before stripping APP1 EXIF/GPS metadata on user photo uploads.

Compiler-Verified Reference Code

Read .jpg Header & Metadata Without Heavy Dependencies

import struct, sys
with open(sys.argv[1], "rb") as f:
    soi, mkr, slen = struct.unpack(">HHH", f.read(6))
    assert soi == 0xFFD8 and (mkr & 0xFF00) == 0xFF00
    print(f"JPEG first marker=0x{mkr:04X}, len={slen}B")
CI/CD & Unit Test Fixtures

Deterministic .jpg Sample Files & Edge Cases

Open Full .jpg Sample Matrix & Mutator →
minimalexpect: valid

minimal-8x8-jfif.jpg

Real baseline JPEG encoded by Pillow: FF D8 SOI, JFIF APP0, Huffman-compressed 8×8 RGB pixels, FF D9 EOI.

↓ Download (644 B)
SHA-256: 72ad937c3cc136955b18dfa3209c4a86e6a6c739eab2e9d1d05fb3b75c051d62
Exact: 644 bytes
curl -fsSL https://fileformat.co/fixtures/v1/jpg/minimal-8x8-jfif.jpg -o minimal-8x8-jfif.jpg \
  && echo "72ad937c3cc136955b18dfa3209c4a86e6a6c739eab2e9d1d05fb3b75c051d62  minimal-8x8-jfif.jpg" | shasum -a 256 -c
realisticexpect: valid

photo-1080p-exif.jpg

Real Pillow-encoded 1080p JPEG carrying an APP1 Exif TIFF directory with Orientation=1.

↓ Download (511.7 KB)
SHA-256: 0810b6422b4ef7f11b623036c6870f20cb7e75fadbdcc05f12b7c13b35825ba6
Exact: 523,936 bytes
curl -fsSL https://fileformat.co/fixtures/v1/jpg/photo-1080p-exif.jpg -o photo-1080p-exif.jpg \
  && echo "0810b6422b4ef7f11b623036c6870f20cb7e75fadbdcc05f12b7c13b35825ba6  photo-1080p-exif.jpg" | shasum -a 256 -c
edge-caseEXIF Orientation=6 + GPSexpect: valid

exif-orientation-6-null-island-gps.jpg

Fully decodable JPEG whose EXIF IFD declares Orientation=6 and a GPSInfo IFD at Null Island — tests pipelines that strip tags without rotating pixels.

↓ Download (538.2 KB)
SHA-256: 9e84120c7d4e36e75154329a088f3226aaca6e96aa28a43fcff7b4cfd421ebaf
Exact: 551,116 bytes
curl -fsSL https://fileformat.co/fixtures/v1/jpg/exif-orientation-6-null-island-gps.jpg -o exif-orientation-6-null-island-gps.jpg \
  && echo "9e84120c7d4e36e75154329a088f3226aaca6e96aa28a43fcff7b4cfd421ebaf  exif-orientation-6-null-island-gps.jpg" | shasum -a 256 -c

Related Specifications & Alternatives