How to Read a Hex Dump (Offsets, Bytes, ASCII Column)

A hex dump is how engineers read binary without lying to themselves. Tools like xxd, hexdump, and debugger memory views show offset + hex bytes + ASCII sidebar. Once you can scan that layout, file headers, protocol bugs, and “mystery NUL” issues become obvious.

Identify formats with magic numbers. Decode selected bytes with Hex to String.

The three columns

00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452  .PNG........IHDR
^offset   ^hex bytes (often grouped)             ^ASCII view

• Offset: usually hexadecimal position from the start of the file or buffer.
• Hex bytes: the ground truth. Grouping (2, 4, 8, or 16 bytes per cluster) is cosmetic.
• ASCII column: printable bytes shown as characters; others become .. Useful hints, never authoritative alone.

How to read one usefully

1. Check the first line for a magic signature (89 50 4E 47, FF D8 FF, 25 50 44 46…).
2. Skim the ASCII column for paths, URLs, or error HTML accidentally saved as binary.
3. Watch for long runs of 00 (padding) or FF (erased flash / sentinels).
4. When comparing two dumps, align on offsets—not on line wrapping.

Generate a dump

xxd -g 1 -l 64 sample.bin
# or
hexdump -C -n 64 sample.bin

from pathlib import Path

def dump(path: str, n: int = 64) -> None:
    data = Path(path).read_bytes()[:n]
    for i in range(0, len(data), 16):
        chunk = data[i:i+16]
        hexa = " ".join(f"{b:02x}" for b in chunk)
        ascii_ = "".join(chr(b) if 32 <= b < 127 else "." for b in chunk)
        print(f"{i:08x}: {hexa:<47}  {ascii_}")

dump("sample.bin")

Common misreads

• Trusting ASCII only: UTF-8 multi-byte characters look like punctuation soup in the sidebar.
• Ignoring endianness: multi-byte integers need a width and a byte order—see multi-byte integers in hex.
• Copying groups with spaces into a strict decoder: strip spaces first (pitfalls guide).

Workflow for mystery files

1. Dump the first 32 bytes.
2. Match magic (signature table).
3. If it looks like text/HTML, decode as UTF-8 instead of forcing an image parser.
4. If it is a protocol buffer, stop guessing—use the proper dissector.

Annotating a dump in a ticket

When you paste a dump for coworkers, mark the field you care about:

00000010: 0000 0100  ....          ← u32 BE length = 256
00000014: 4865 6c6c 6f00  Hello.   ← payload + NUL

Offsets beat “about halfway down the screenshot.” Pair with endian notes from multi-byte integers.

FAQ

Why do some dumps use uppercase?
Preference. Values are identical.

What does * mean in xxd output?
Repeated identical lines were collapsed. Expand with options if you need every offset.

Can I paste a whole dump into Hex to String?
Only the hex digit columns—remove offsets and ASCII first, or paste a clean hex string from xxd -p.

Related: Hex to Binary · hex overview.