Why Can a File Named .jpg Actually Be a PNG?

Take a PNG image called `photo.png` and rename it `photo.jpg`.

Nothing inside the image changes.

It does not suddenly use JPEG compression. It does not lose its transparency. Its pixels are not rewritten. The file has simply been given a new name.

That leaves you with something slightly absurd: a file whose name says JPEG while the data inside it still says PNG.

Sometimes the file will open anyway. Sometimes an upload form will reject it. Sometimes one program calls it a JPEG while another insists it is a PNG.

All three reactions can make sense, because a computer has more than one way to decide what kind of file it is looking at.

The `.jpg` at the end of a filename is called a file extension.

Extensions are useful. They give people and software a quick hint about what a file probably contains. `.jpg` usually means a JPEG image. `.png` usually means PNG. `.pdf` usually means a PDF document.

Operating systems can also use the extension to decide which app should open a file. Double-click a `.jpg` and your computer knows that an image viewer is a reasonable place to send it.

But the extension is part of the filename. It is not the image format itself.

Renaming `photo.png` to `photo.jpg` is a little like peeling the label off one jar and replacing it with another. The label changed. The contents did not.

Many file formats begin with recognizable bytes that help software identify what is inside.

These are often called file signatures or, less formally, magic numbers.

A PNG file begins with an eight-byte signature defined by the PNG specification. Part of it even spells out the letters P, N and G when interpreted in the right way.

JPEG data begins differently. JPEG streams start with a marker represented by the bytes `FF D8`.

So a program does not always have to trust the filename. It can open the file, inspect its beginning and ask a much better question: what does this data actually look like?

Imagine that `holiday.png` is renamed to `holiday.jpg`.

From the outside, the filename now suggests JPEG.

Inside, however, the first bytes still contain the PNG signature. The rest of the file is still arranged according to the PNG format as well.

Software that trusts only the extension may treat it as a JPEG.

Software that examines the contents can notice the disagreement immediately.

That is how two programs can look at the same file and reach different conclusions without either one necessarily being broken.

This is the part that causes a lot of everyday confusion.

Renaming an extension is not file conversion.

If you want a PNG to become a JPEG, software has to decode the PNG image and then encode that image again using the JPEG format.

That conversion can change more than the filename.

PNG supports transparency. Ordinary JPEG does not. PNG normally uses lossless compression, while JPEG is usually lossy. The two formats store image information differently.

A real converter creates a new representation of the image. File Explorer's Rename command does not.

Image software is often more forgiving than people expect.

An image viewer may inspect the contents rather than blindly assuming the extension is correct. If it recognizes valid PNG data, it may simply decode the PNG and show the picture.

From the user's point of view, the trick appears to have worked: `photo.jpg` opens perfectly.

But that does not make it a JPEG.

It means the program was smart enough to look past the bad label.

Websites have to decide what you uploaded too, and they do not all make that decision in the same way.

A basic upload form might check the filename and see `.jpg`. Another system may inspect the type reported by the browser. A stricter service may read the file itself and verify that its contents actually match an allowed image format.

Those checks can disagree.

Browsers themselves add another wrinkle. For a local file, the MIME type exposed to a website may be inferred from the filename or operating-system configuration rather than discovered by carefully decoding the file's bytes.

So a PNG renamed to `.jpg` may arrive carrying a JPEG-looking filename and type even though its internal data is still PNG.

A website that later inspects the actual image can then discover the mismatch.

Suppose one website accepts JPG and PNG images.

It may not care much that your extension is wrong. If it can decode the image successfully, it can continue processing it.

Another website may require the extension, reported media type and detected file format to agree. The same image could be rejected there as invalid or unsupported.

A third service might attempt to run the file through a JPEG decoder because the name ends in `.jpg`. The decoder reaches PNG data instead and throws an error.

This explains a surprisingly common situation: an image opens normally on your computer but refuses to upload somewhere else.

The image may not be corrupt at all. Its name and its contents may simply disagree.

Checking what is really inside an upload is not just pedantry.

A website that accepts files from strangers has to treat filenames as untrusted information. Anyone can rename a file.

The OWASP Foundation recommends that upload systems use several checks rather than trusting one clue alone. That can include validating the extension, checking the reported content type, examining a file signature and, for images, actually processing the file as an image.

None of those checks is perfect by itself.

That is important because a file can be deliberately given a misleading name, not merely renamed by accident.

For an ordinary user, this security machinery sometimes appears as an annoyingly vague message such as 'invalid file type.' Behind it may simply be a server refusing to believe the filename without checking.

On the web, file formats are also described using media types, commonly called MIME types.

JPEG normally uses `image/jpeg`. PNG uses `image/png`.

When a web server sends an image to your browser, it can include that information in the HTTP `Content-Type` header. Browsers use it to help decide how the response should be handled.

But a MIME type and a filename extension are still descriptions of the data, not the data itself.

A server can send the wrong content type. A filename can have the wrong extension. A browser or application can sometimes try to infer the real format from the bytes instead.

That is why file identification can involve several layers that normally agree — until one of them does not.

The phrase 'magic number' can make file detection sound simpler than it really is.

Recognizing the opening bytes is a useful clue, but robust software may examine much more of the file to make sure its structure is valid.

Not every format has a simple unique signature. Files can be malformed. Some formats are containers that can hold several kinds of data. Deliberately crafted files can also be designed to confuse weak checks.

That is why security guidance does not recommend trusting a signature alone.

For everyday mismatched images, though, the basic idea is enough: the bytes inside a file often reveal information that its filename does not.

A picture does not stop being a PNG because its filename has no `.png` at the end.

The extension helps software and people identify it conveniently, but the encoded image is still there.

This becomes easier to understand when you separate three things that usually travel together: the filename, the description of the file type, and the actual data.

Most of the time they agree, so we never notice the distinction.

`photo.jpg` is normally a JPEG, reported as `image/jpeg`, containing JPEG data.

It is only when those pieces stop agreeing that the difference suddenly becomes visible.

If a website asks for JPEG and your file is PNG, WebP, AVIF or another format, changing the letters after the dot is not a reliable fix.

Convert the image instead.

A real conversion reads the source format and creates a new file encoded in the destination format. The new extension then describes what is genuinely inside the file.

The same principle applies beyond images. Renaming a PDF to `.docx` does not turn it into a Word document. Renaming a video does not change its codec. Renaming a ZIP file does not rebuild it as another archive format.

The name tells us what a file is supposed to be.

The bytes tell the computer what it actually is.