ZERO-UPLOAD SANDBOX
.glb Tier 1 · Deep AST Parser

glTF 2.0 Binary 3D Asset

Khronos Group's single-file binary 3D delivery format combining a 12-byte header, a UTF-8 JSON scene-graph chunk (`0x4E4F534A`), and a raw GPU geometry/texture buffer (`0x004E4942`).

Chunk 0 MUST be the JSON descriptor padded with `0x20` spaces to a 4-byte boundary; Chunk 1 (`BIN\0`) is padded with `0x00` bytes.

MIME Types model/gltf-binary
Byte Endianness little
PRONOM PUID fmt/1316
0xFF

Drop any .glb file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.glb Magic Bytes & Header Offset Map

Offset: 0x00 (0 B) ASCII: glTF....
67 6C 54 46 02 00 00 00

'glTF' ASCII magic + uint32_le version 2

Byte Offset Length Data Type Field Name Engineering Description
0x00 - 0x03 4 B char[4] magic ASCII 'glTF' (0x46546C67)
0x04 - 0x07 4 B uint32_le version Container version (2)
0x08 - 0x0B 4 B uint32_le length Total byte length of GLB file
0x0C - 0x13 8 B uint32_le[2] chunk0_hdr JSON chunk length + type 0x4E4F534A ('JSON')
Upload Gateway & AppSec Advisory

.glb Security & Polyglot Risk Matrix

Risk Level: low
Arbitrary Code / Macros
NO (Inert Data)
Pickle Deserialization
SAFE (No Pickle VM)
XML External Entity (XXE)
NONE
Polyglot Prepend Risk
LOW (Strict 0x00 Magic)
Backend Upload Validation Recommendation

Disallow external relative URI references inside glTF buffers/images when accepting untrusted .glb uploads on server-side renderers.

Compiler-Verified Reference Code

Read .glb Header & Metadata Without Heavy Dependencies

import json, struct, sys
with open(sys.argv[1], "rb") as f:
    magic, ver, total, c0_len, c0_type = struct.unpack("<4sIIII", f.read(20))
    assert magic == b"glTF" and c0_type == 0x4E4F534A
    scene = json.loads(f.read(c0_len).decode("utf-8"))
    print(f"GLB v{ver} ({total}B), nodes={len(scene.get('nodes', []))}")
CI/CD & Unit Test Fixtures

Deterministic .glb Sample Files & Edge Cases

Open Full .glb Sample Matrix & Mutator →
minimalexpect: valid

minimal-triangle.glb

4-byte aligned binary glTF 2.0 (`67 6C 54 46`) with JSON scene graph chunk and 36-byte float32 vertex BIN chunk.

↓ Download (316 B)
SHA-256: f9316dd27503e6edb7ab6cd653e6c920cd996cdd186c9cf0e829407a68ee5d8b
Exact: 316 bytes
curl -fsSL https://fileformat.co/fixtures/v1/glb/minimal-triangle.glb -o minimal-triangle.glb \
  && echo "f9316dd27503e6edb7ab6cd653e6c920cd996cdd186c9cf0e829407a68ee5d8b  minimal-triangle.glb" | shasum -a 256 -c
realisticexpect: valid

pbr-scene-rig.glb

glTF 2.0 binary asset with CameraRig, KeyLight, ChassisMesh nodes and PBR material definition.

↓ Download (508 B)
SHA-256: 6d0c78f35cee7254d016f06a0fcc812b412655abf063a8ce98aafb1fcbe7b7e9
Exact: 508 bytes
curl -fsSL https://fileformat.co/fixtures/v1/glb/pbr-scene-rig.glb -o pbr-scene-rig.glb \
  && echo "6d0c78f35cee7254d016f06a0fcc812b412655abf063a8ce98aafb1fcbe7b7e9  pbr-scene-rig.glb" | shasum -a 256 -c
edge-caseTruncated BIN Chunkexpect: parser_error

truncated-bin-chunk.glb

GLB header `total_length` exceeds actual EOF by 16 bytes.

↓ Download (300 B)
SHA-256: 68a6984ac6eb610b64917f6a23ad957e2f5a6c692e2a2ccc0605d531d9302e65
Exact: 300 bytes
curl -fsSL https://fileformat.co/fixtures/v1/glb/truncated-bin-chunk.glb -o truncated-bin-chunk.glb \
  && echo "68a6984ac6eb610b64917f6a23ad957e2f5a6c692e2a2ccc0605d531d9302e65  truncated-bin-chunk.glb" | shasum -a 256 -c

Related Specifications & Alternatives