See what your bytes mean.
Nybble turns any binary file into a structure you can read. Click a byte, see its field. Click a field, watch its bytes light up. Describe any format with a small schema — then explore it.
struct TinyPng { signature bytes[8] length u32 chunkType char[4] width u32 height u32 bitDepth u8 colorType PngColorType compression u8 filter u8 interlace PngInterlace crc u32}
Not just a hex editor
Hex editors show bytes without meaning. Format viewers understand one format. Nybble is general — teach it any layout and it maps every byte for you.
Byte ↔ field highlighting
Click a field to light up its exact bytes; click a byte to select the field that owns it. No more counting offsets by hand.
A readable schema language
Describe a format's layout in a small DSL — structs, enums, bitfields, conditionals, pointers, unions, and computed fields. No C-like scripting.
File-map ribbon
A proportional, color-coded band shows where every top-level field lives across the whole file. See structure at a glance and jump anywhere.
Typed & pattern search
Find every uint32 that equals 42 — width- and endianness-aware — alongside hex, text, and UTF-16 search with find next/prev.
Non-destructive editing
Edit a parsed value (re-encoded to its type and endianness) or overwrite raw bytes, with undo/redo, dirty-byte highlighting, and safe save.
Multi-gigabyte files
Memory-mapped reads and a virtualized hex view open huge files instantly, without loading them into memory.
Build a schema by dragging
Drag a range in the hex view and Nybble offers the readings those bytes support — each with a live preview. Pick one, name it, and the field is written into your schema. No DSL knowledge required to start.
Errors that point at the byte
A schema that doesn't fit still shows everything that did parse, plus exactly where it stopped — the byte offset, the field path, and the line of your schema to fix.
Compare two files
Diff the open file against another, byte-aligned. Changed bytes show what they used to be, and the parse tree marks old → new on every field that moved — not just which bytes changed, but which field they were.
Checksums that fix themselves
Declare a field's checksum — CRC-32, the four common CRC-16s, Adler-32, sums, XOR — and every parse validates it. Edit the file and one click rewrites every stale checksum, so it still opens in the tool that made it.
See what's still unknown
Every parse reports how much of the file your schema explains and shades the bytes nothing claims. Shape hints suggest what an unknown run is — repeating records and their stride, offset tables, string pools, padding.
Community format registry
79 format packs, from firmware and disk images to game ROMs and medical imaging. Open a file nothing installed can read and Nybble names the pack that can — matched locally — and installs it in one click.
Eight formats built in, 79 more a click away
Nybble detects the format by magic number and one-click loads a schema. When nothing installed reads a file, it offers the registry pack that does. Or write your own — the language is the same one the built-ins use.
PE handles both PE32 and PE32+; ELF follows the program- and section-header tables through their file offsets; ZIP walks every entry, the central directory, and the end record. Every built-in is snapshot-tested.
Detection also knows the files a firmware dump turns up — SquashFS, U-Boot images, pcapng, DEX, zstd, xz, bzip2, LZ4, CAB, MP4, Matroska, TIFF — so you start with a lead, not "unknown format". The registry covers archives, disk images, executables, fonts, audio, ROMs, and more.
enum PngColorType : u8 {
Grayscale = 0
RGB = 2
RGBA = 6
}
struct PngIhdr {
length u32
chunkType char[4]
width u32
height u32
bitDepth u8
colorType PngColorType // shows "RGBA (6)"
interlace u8
crc u32 check crc32 over(chunkType .. interlace)
}nybble parse png.schema shot.png --json # the field tree, for jq
nybble diff before.sav after.sav # what changed, field by field
nybble detect firmware.bin # what is this?
nybble strings firmware.bin --min 6 # the readable text in it
nybble entropy firmware.bin # where is the packed data?
nybble hints firmware.bin --at 0x4000 # what shape are these bytes?
nybble check my.schema # does my schema compile?
# In CI: fail when the schema stops explaining the file
nybble parse fw.schema out.bin --min-coverage 99 --quietA command line for the other half
The app is for exploring one file. nybble runs a finished schema over a hundred of them, diffs two captures in a script, and triages a directory of firmware from a shell.
A schema carries its own entry point and byte order in its // @entry header, so the usual invocation needs no flags. Exit status is what scripts want: 0 matched, 1 didn't (a fault, a failed checksum, a difference), 2 a usage error. --min-coverage catches the parse that succeeds but quietly stops explaining the file. More in the docs.
Built for the file nobody has a template for
When you're reverse-engineering an unknown format, the feedback loop is everything.
The fastest loop
Live re-parse, two-way highlighting, and a schema that keeps working while it's still wrong: a bad field stops the parse where it breaks instead of blanking the tree, and tells you which byte and which line. You go from guess to confirmed layout in seconds — not a write-compile-stare cycle.
Your bytes stay yours
Fully offline and native. Nothing is uploaded anywhere — even a registry check downloads only the public index and matches your file locally. Built in Rust and Tauri, so it's small, fast, and safe with untrusted files.
Describe once, share
Save schemas to a library and export self-contained files with their metadata baked in. Teach a teammate a proprietary format in one file.
Download Nybble
Free and native. Windows, macOS, and Linux. Published on GitHub Releases.
Builds are not code-signed yet, so Windows SmartScreen and macOS Gatekeeper will warn on first launch. Every release ships a SHA256SUMS.txt so you can verify your download, or you can build from source.