ZERO-UPLOAD SANDBOX
.avif Tier 1 · Deep AST Parser

AVIF (AV1 Image File Format)

Royalty-free HDR & wide-gamut next-gen web image format wrapping AV1 keyframes inside an ISO Base Media (`ftyp`) container (`major_brand` = `avif` or `avis`).

Shares the ISOBMFF box container with HEIC and MP4; requires reading offset `0x08` (`avif` for still images, `avis` for animated image sequences).

MIME Types image/avif
Byte Endianness big
Container Family isobmff
0xFF

Drop any .avif file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.avif Magic Bytes & Header Offset Map

Offset: 0x04 (4 B) ASCII: ftypavi
66 74 79 70 61 76 69

ISOBMFF ftyp box with 'avif' or 'avis' brand prefix

Byte Offset Length Data Type Field Name Engineering Description
0x00 - 0x03 4 B uint32_be ftyp_size Box byte length
0x04 - 0x07 4 B char[4] box_type 'ftyp' FourCC
0x08 - 0x0B 4 B char[4] major_brand 'avif' (still) or 'avis' (sequence)
Upload Gateway & AppSec Advisory

.avif Security & Polyglot Risk Matrix

Risk Level: low
Arbitrary Code / Macros
NO (Inert Data)
Pickle Deserialization
SAFE (No Pickle VM)
XML External Entity (XXE)
NONE
Polyglot Prepend Risk
LOW (Strict 0x00 Magic)
Backend Upload Validation Recommendation

Inspect `ispe` box dimensions before full pixel decoding to block decompression bombs (e.g. 65000x65000px 10KB solid-color AV1 frames).

Compiler-Verified Reference Code

Read .avif Header & Metadata Without Heavy Dependencies

import struct, sys
with open(sys.argv[1], "rb") as f:
    sz, box, brand = struct.unpack(">I4s4s", f.read(12))
    assert box == b"ftyp" and brand in (b"avif", b"avis")
    print(f"AVIF brand={brand.decode()}")
CI/CD & Unit Test Fixtures

Deterministic .avif Sample Files & Edge Cases

Open Full .avif Sample Matrix & Mutator →
minimalexpect: valid

minimal-128x128.avif

Real AVIF encoded by libavif via pillow-avif: ftyp avif, decodable AV1 primary item.

↓ Download (2.4 KB)
SHA-256: c1d62b9cfb1ac1ef878cabf2033ef0bd25067ff3fcc032aa0dc5c2c833687918
Exact: 2,446 bytes
curl -fsSL https://fileformat.co/fixtures/v1/avif/minimal-128x128.avif -o minimal-128x128.avif \
  && echo "c1d62b9cfb1ac1ef878cabf2033ef0bd25067ff3fcc032aa0dc5c2c833687918  minimal-128x128.avif" | shasum -a 256 -c
realisticexpect: valid

photo-640x480.avif

Real AV1 Image File Format still encoded by libavif at 640×480.

↓ Download (39.7 KB)
SHA-256: 66e43e004db1ebc43bcf2b7e3f44198d43d83ec0d828b064a69e5ffa1254667e
Exact: 40,636 bytes
curl -fsSL https://fileformat.co/fixtures/v1/avif/photo-640x480.avif -o photo-640x480.avif \
  && echo "66e43e004db1ebc43bcf2b7e3f44198d43d83ec0d828b064a69e5ffa1254667e  photo-640x480.avif" | shasum -a 256 -c
edge-caseTruncated ISOBMFF Boxexpect: parser_error

truncated-box.avif

Real AVIF truncated inside the mdat payload — libavif decoder must raise.

↓ Download (2.4 KB)
SHA-256: 8fc0516c40d536a757998b236c6d6d96a4b5a36874d8b17c72a64829251e0ae4
Exact: 2,414 bytes
curl -fsSL https://fileformat.co/fixtures/v1/avif/truncated-box.avif -o truncated-box.avif \
  && echo "8fc0516c40d536a757998b236c6d6d96a4b5a36874d8b17c72a64829251e0ae4  truncated-box.avif" | shasum -a 256 -c

Related Specifications & Alternatives