ZERO-UPLOAD SANDBOX
.heic .heif Tier 1 · Deep AST Parser

HEIC (High Efficiency Image Container)

Apple iOS default camera photo container encapsulating HEVC (H.265) intra-coded image tiles, depth maps, and EXIF metadata inside an ISO Base Media (`ftyp`) box hierarchy.

Offset `0x04..0x07` is `'ftyp'`; offset `0x08..0x0B` stores `major_brand` (`'heic'`, `'heix'`, or `'mif1'`). Pixel dimensions reside inside nested `meta -> iprp -> ipco -> ispe` boxes.

MIME Types image/heic, image/heif
Byte Endianness big
Container Family isobmff
PRONOM PUID fmt/1101
0xFF

Drop any .heic file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.heic Magic Bytes & Header Offset Map

Offset: 0x04 (4 B) ASCII: ftypheic
66 74 79 70 68 65 69 63

ISOBMFF ftyp box with major_brand 'heic' at offset 0x04

Offset: 0x04 (4 B) ASCII: ftypmif1
66 74 79 70 6D 69 66 31

Common real-world variant: major_brand 'mif1' (most iPhone photos) with 'heic' in compatible_brands

Offset: 0x04 (4 B) ASCII: ftypheix
66 74 79 70 68 65 69 78

Variant: major_brand 'heix' (HEIC sequences without image items)

Byte Offset Length Data Type Field Name Engineering Description
0x00 - 0x03 4 B uint32_be ftyp_size Byte length of FileTypeBox
0x04 - 0x07 4 B char[4] box_type ASCII 'ftyp'
0x08 - 0x0B 4 B char[4] major_brand Primary brand ('heic', 'heix', 'mif1')
0x10 .. 4*k B char[4][] compatible_brands List of compatible 4CC brands
Upload Gateway & AppSec Advisory

.heic Security & Polyglot Risk Matrix

Risk Level: low
Arbitrary Code / Macros
NO (Inert Data)
Pickle Deserialization
SAFE (No Pickle VM)
XML External Entity (XXE)
NONE
Polyglot Prepend Risk
LOW (Strict 0x00 Magic)
Backend Upload Validation Recommendation

Check both major_brand AND compatible_brands inside ftyp (many valid HEIC photos use major_brand='mif1' with 'heic' in compatible_brands). Strip EXIF GPS boxes before public CDN storage.

Compiler-Verified Reference Code

Read .heic Header & Metadata Without Heavy Dependencies

import struct, sys
with open(sys.argv[1], "rb") as f:
    sz, btype, brand = struct.unpack(">I4s4s", f.read(12))
    assert btype == b"ftyp"
    print(f"HEIC ftyp size={sz}B, major_brand={brand.decode('ascii')}")
CI/CD & Unit Test Fixtures

Deterministic .heic Sample Files & Edge Cases

Open Full .heic Sample Matrix & Mutator →
minimalexpect: valid

minimal-64x64.heic

Real HEIC encoded by libheif via pillow-heif: ftyp heic, decodable HEVC primary item.

↓ Download (1.2 KB)
SHA-256: a391bd763c27113162242a0e7fbe0bacbe60be3c2e1458b1f0c65d9396b4554c
Exact: 1,192 bytes
curl -fsSL https://fileformat.co/fixtures/v1/heic/minimal-64x64.heic -o minimal-64x64.heic \
  && echo "a391bd763c27113162242a0e7fbe0bacbe60be3c2e1458b1f0c65d9396b4554c  minimal-64x64.heic" | shasum -a 256 -c
realisticexpect: valid

photo-1024x768.heic

Real HEIF/HEVC still image encoded by libheif at 1024×768 for decoder validation.

↓ Download (179.2 KB)
SHA-256: 833313fb74d55f1505032f5cb002d32d727eeae891a646e52311910875cc15c6
Exact: 183,476 bytes
curl -fsSL https://fileformat.co/fixtures/v1/heic/photo-1024x768.heic -o photo-1024x768.heic \
  && echo "833313fb74d55f1505032f5cb002d32d727eeae891a646e52311910875cc15c6  photo-1024x768.heic" | shasum -a 256 -c
edge-caseTruncated mdat Boxexpect: parser_error

truncated-mdat.heic

Real HEIC bytes truncated inside the HEVC payload — libheif decoder must raise.

↓ Download (1.1 KB)
SHA-256: f5de0f071b251c113f04832efea09a58ec1fc9908ac083c2f1da96bd7ab46eb8
Exact: 1,160 bytes
curl -fsSL https://fileformat.co/fixtures/v1/heic/truncated-mdat.heic -o truncated-mdat.heic \
  && echo "f5de0f071b251c113f04832efea09a58ec1fc9908ac083c2f1da96bd7ab46eb8  truncated-mdat.heic" | shasum -a 256 -c

Related Specifications & Alternatives