How do I know a file is a SQLite database?

The first 16 bytes are the literal string "SQLite format 3" followed by a null byte. Nothing else uses that signature.

What are the -wal and -shm files?

Write-ahead log and shared-memory index files created in WAL journal mode. A database copied without them can be missing the most recent transactions — a common evidence-handling mistake.

Why does page size matter?

It sets the I/O granularity and the maximum row-fitting behaviour. It is fixed at creation and can only be changed by rebuilding the database with VACUUM.

SQLite Header Decoder

Decode a SQLite database header and read its page layout and settings.

on the roadmapFile Format & Archivesfree · no sign-up

This bench is being wired up

The sqlite-header-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the SQLite Header Decoder?

A SQLite header decoder parses the first 100 bytes of a .db file — the fixed header every SQLite database begins with — revealing page size, text encoding, journal mode, schema version and the library version that last wrote it.

Every SQLite database starts with the 16-byte string 'SQLite format 3' followed by a null, then a fixed 100-byte header. It records the page size (512 to 65 536 bytes, 4096 by default), the file format versions, the reserved space per page, the text encoding (UTF-8, UTF-16LE or UTF-16BE), the schema cookie and the version of SQLite that last modified the file.

This matters in forensics more than in development. SQLite is the storage engine behind browsers, phones, chat clients and most desktop applications, so the header is often the first thing you read when identifying a file recovered from a device. The write-version and read-version bytes reveal whether write-ahead logging is in use — which in turn tells you to look for the -wal and -shm sidecar files, where recently written and 'deleted' records frequently survive.

SQLite Header Decoder at a glance

Magic: "SQLite format 3\0" — the first 16 bytes
Header size: 100 bytes, fixed layout
Page size: 512–65 536 bytes, power of two (4096 default)
WAL mode: Write/read version byte 2 — look for -wal and -shm files

How to use the SQLite Header Decoder

1Load the database file, or paste its first 100 bytes as hex.
2Read the page size, encoding, versions and journal mode.
3If WAL mode is indicated, collect the -wal and -shm files alongside the database.

When you would reach for it

Identifying an unknown file recovered during a mobile forensics examination.
Confirming a database's page size and encoding before a migration.
Checking whether WAL sidecar files are needed for a complete copy.

SQLite Header Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools