Online Tool Store
· 4 min read
How to Compare Two Binary Files Byte by Byte
Heshan Fernando
Co-founder & COO
Two builds of the same firmware. Same source, same toolchain, same flags — and different checksums. Or two exports of the same document, generated a minute apart, that a comparison tool insists aren’t identical.
Text diffs are no help here. You need to know where the files differ, how much differs, and whether the difference is meaningful or just a timestamp somebody stamped into a header.
What a binary diff tells you
A byte-level comparison walks both files in parallel and records the ranges where they disagree. What makes it useful isn’t the list of differing bytes — it’s where those ranges sit.
A four-byte difference at offset 0x0004, right at the start, is almost certainly a header field: a version number, a flag, a length. A difference in a fixed-size block partway through is likely a metadata section. Scattered differences throughout with no pattern suggests genuine content change — or corruption.
Reproducible builds are the reason this comes up so often. Many toolchains embed a build timestamp, an absolute path, or an archive ordering that varies between runs. The Reproducible Builds project exists specifically to eliminate those sources of variation, and its documentation is a good catalogue of what to look for when two supposedly identical outputs differ.
Why people get stuck here
- Text tools on binary files. A line-based diff on binary data reports “files differ” and stops.
- Size differences that mean nothing. Padding and alignment change file size without changing meaning.
- No sense of scale. Knowing two files differ is useless; knowing they’re 99.2% identical with three differing regions is actionable.
- Command-line friction.
cmpandxxddo the job, but not on a machine where you can’t install anything.
What a good comparison shows
A summary before the detail
How many regions differ, how large each one is, and what proportion of the file is identical. That’s usually enough to classify the problem without reading a single hex byte.
Offsets in hex
Binary formats document their layouts in hexadecimal, so an offset of 0x1200 can be looked up against a format spec directly. Decimal offsets mean converting before you can use them.
Hex alongside ASCII
The ASCII column is where embedded strings — a build date, a hostname, a path — become instantly readable. Very often that column answers the question on its own.
| Difference Pattern | Usually Means | Next Step |
|---|---|---|
| Few bytes near offset 0 | Header field, version, timestamp | Check the format spec |
| One fixed-size block | Metadata section | Look at the ASCII column |
| Scattered, no pattern | Real content change or corruption | Verify with a checksum |
| Only the tail differs | Padding or appended signature | Compare lengths |
Common mistakes to avoid
- Concluding corruption from a size difference alone — trailing padding is normal in plenty of formats.
- Comparing a file downloaded twice without checking whether the transfer completed both times.
- Ignoring the ASCII column, which frequently contains the literal answer in plain text.
- Diffing compressed archives directly. Recompression reorders everything; extract and compare the contents instead.
- Loading enormous files into a browser-based tool and blaming the tool when memory runs out.
How to do it with Binary File Diff
The Binary File Diff reads both files locally — nothing is uploaded, which also means large files depend on your device’s memory.
- Add the two files you want to compare.
- Start with the summary: how many regions differ and what share of the content is identical.
- Switch to differences-only view and read the offsets.
- Check the ASCII column for embedded strings before digging into the hex.
- If the only differences are near offset 0, look up the format’s header layout.
Other file inspection utilities are in the tools directory.
Frequently asked questions
Why do two “identical” exports differ?
Embedded timestamps, build paths, or non-deterministic ordering inside archives. Many formats stamp the creation time into a header, so byte-identical output requires a writer that’s been deliberately made deterministic.
Does a size difference mean corruption?
Not on its own. Padding, alignment and trailing metadata all change size without changing meaning. Where the difference sits matters far more than how big it is.
Are my files uploaded?
No. Both files are read in the page. That’s good for privacy and it does mean very large files are limited by available memory rather than an upload cap.
Final thought
Read the summary first and the hex last. Most binary diffs are answered by one number — the proportion that matches — and one glance at the ASCII column.