# SQLite Header Decoder

> Decode a SQLite database header and read its page layout and settings.

- Page: https://decoder.tools/sqlite-header-decoder
- Category: File Format & Archives
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A SQLite header decoder parses the first 100 bytes of a .db file — the fixed header every SQLite database begins with — revealing page size, text encoding, journal mode, schema version and the library version that last wrote it.

## What is the SQLite Header Decoder?

Every SQLite database starts with the 16-byte string 'SQLite format 3' followed by a null, then a fixed 100-byte header. It records the page size (512 to 65 536 bytes, 4096 by default), the file format versions, the reserved space per page, the text encoding (UTF-8, UTF-16LE or UTF-16BE), the schema cookie and the version of SQLite that last modified the file.

This matters in forensics more than in development. SQLite is the storage engine behind browsers, phones, chat clients and most desktop applications, so the header is often the first thing you read when identifying a file recovered from a device. The write-version and read-version bytes reveal whether write-ahead logging is in use — which in turn tells you to look for the -wal and -shm sidecar files, where recently written and 'deleted' records frequently survive.

## How to use the SQLite Header Decoder

1. Load the database file, or paste its first 100 bytes as hex.
2. Read the page size, encoding, versions and journal mode.
3. If WAL mode is indicated, collect the -wal and -shm files alongside the database.

## When to use it

- Identifying an unknown file recovered during a mobile forensics examination.
- Confirming a database's page size and encoding before a migration.
- Checking whether WAL sidecar files are needed for a complete copy.

## SQLite Header Decoder at a glance

| | |
|---|---|
| Magic | "SQLite format 3\0" — the first 16 bytes |
| Header size | 100 bytes, fixed layout |
| Page size | 512–65 536 bytes, power of two (4096 default) |
| WAL mode | Write/read version byte 2 — look for -wal and -shm files |

## FAQ

### How do I know a file is a SQLite database?

The first 16 bytes are the literal string "SQLite format 3" followed by a null byte. Nothing else uses that signature.

### What are the -wal and -shm files?

Write-ahead log and shared-memory index files created in WAL journal mode. A database copied without them can be missing the most recent transactions — a common evidence-handling mistake.

### Why does page size matter?

It sets the I/O granularity and the maximum row-fitting behaviour. It is fixed at creation and can only be changed by rebuilding the database with VACUUM.