Viewing files
hexdump
Display file contents in hex, octal, decimal or ASCII, with a canonical hex-plus-text layout via -C.
hexdump [OPTION...] [FILE...]hexdump (also installed as hd) dumps bytes in a format you choose. Almost everyone uses one
form, hexdump -C, the "canonical" layout: hex offset, 16 bytes in two groups of eight, and
the printable characters between | bars. On Debian it comes from util-linux, packaged in
bsdextrautils; macOS ships the BSD original with the same core options.
Without -C the default output is 2-byte words in the machine's byte order, which on a
little-endian PC looks scrambled: 7562 for the text bu. Avoid it. For full control,
-e takes a format string, which is powerful but terse; od -t or xxd are often
easier for one-off conversions.
Examples
Hex and text side by side
hexdump -C data/windows.txt00000000 6c 69 6e 65 20 6f 6e 65 0d 0a 6c 69 6e 65 20 74 |line one..line t| 00000010 77 6f 0d 0a |wo..| 00000014
-C shows each byte in hex with the text on the right. The 0d 0a pairs (shown as ..)
are CRLF line endings. The last line is the total length in hex: 0x14 is 20 bytes.
Only the first bytes
hexdump -C -n 16 photos/beach.png
00000000 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 |.PNG........IHDR| 00000010
-n 16 stops after 16 bytes, enough to see the PNG signature 89 50 4e 47 0d 0a 1a 0a.
Start at an offset
hexdump -C -s 16 -n 8 photos/beach.png
00000010 00 00 02 80 00 00 01 e0 |........| 00000018
-s 16 skips 16 bytes before dumping. These 8 bytes are the PNG's width and height:
0x280 = 640 and 0x1e0 = 480.
Repeated lines are collapsed
head -c 64 /dev/zero | hexdump -C00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000040
The 64 zero bytes would make four identical lines; hexdump prints the first and a *
for the repeats, then the final offset 0x40 (64).
Show every line
head -c 32 /dev/zero | hexdump -v -C00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000020
-v turns off the * squeezing so every line is printed, which matters when you compare dumps line by line.
The default format looks byte-swapped
hexdump todo.txt | head -n 10000000 7562 2079 696d 6b6c 660a 7869 6c20 676f
Without -C, bytes are grouped as 16-bit words in little-endian order: buy comes out as
7562 2079 instead of 62 75 79 20. This is why -C is the form to remember.
Custom output with a format string
hexdump -n 16 -e '16/1 "%02x" "\n"' README.md232064656d6f0a0a4120736d616c6c20
-e describes the layout: 16/1 "%02x" applies the %02x format to 16 one-byte units,
then a newline. The result is the first 16 bytes as one continuous hex string.
Common pitfalls
Plain
hexdump(no-C) prints 2-byte words in host byte order, so text appears with neighboring bytes swapped. Usehexdump -C.Identical consecutive lines collapse into
*, which can hide how much data is there. The offset on the following line tells you where the run ends; use-vto see everything.
GNU vs BSD and macOS
The examples above ran the GNU/Linux version. These are the differences that matter on macOS and the BSDs (written from their documentation, not run here).
Linux's
hexdump(util-linux) and the macOS/BSD version share-C,-n,-s,-vand-e. Thehdalias exists on Debian and FreeBSD; on macOS usehexdump -C.
Options worth knowing
A selection, described in our own words. For the full list, see hexdump(1) or hexdump --help.
| Option | What it does |
|---|---|
-C, --canonical | Canonical hex+ASCII layout: offset, 16 hex bytes and the text between bars. |
-n, --length LENGTH | Dump only LENGTH bytes. |
-s, --skip OFFSET | Skip OFFSET bytes from the start. |
-v, --no-squeezing | Print all lines, even identical ones. |
-e, --format FORMAT | Use a custom format string. |
-f, --format-file FILE | Read format strings from FILE. |
-b, --one-byte-octal | One-byte octal display. |
-c, --one-byte-char | One-byte character display. |
-d, --two-bytes-decimal | Two-byte unsigned decimal display. |
-x, --two-bytes-hex | Two-byte hexadecimal display. |