HEXDUMP(1)

📦
version 2.42.2 · 11 versions
, in ubuntu stonking

💖 HEXDUMP — the hexdump(1) page, but make it cute ✨

okay bestie, sit down, hydrate, because this is the tool that shows you exactly what's inside a file, byte by byte, in whatever base you want. her name is hexdump, she lives in section 1 (User Commands), and her alias is hd. she's iconic, she's a filter, and she's about to eat. 💅

🌸 NAME 🌸

hexdump — display file contents in hexadecimal, decimal, octal, or ascii

🎀 SYNOPSIS 🎀

hexdump [options] file ...

hd [options] file ...

🦋 DESCRIPTION 🦋

so hexdump is a filter, right? you hand her some files, she dumps them out in a format you choose. and if you hand her no files at all? she just reads from standard input, no big deal, she's flexible like that. 🫶

✨ OPTIONS ✨

quick lil heads up before we get into it, bestie — for the length and offset arguments, you can tack on multiplicative suffixes and she'll get it:

  • KiB (=1024), MiB (=1024*1024), and so on for GiB, TiB, PiB, EiB, ZiB and YiB — and btw the "iB" part is optional, so like "K" means the exact same thing as "KiB" 💖
  • OR you can go decimal: KB (=1000), MB (=1000*1000), and so on for GB, TB, PB, EB, ZB and YB

no cap, she does the math for you.

  • -b, --one-byte-octal — one-byte octal display. she prints the input offset in hexadecimal, then sixteen space-separated, three-column, zero-filled bytes of input data, in octal, per line.
  • -X, --one-byte-hex — one-byte hexadecimal display. input offset in hexadecimal first, then sixteen space-separated, two-column, zero-filled bytes of input data, in hexadecimal, per line.
  • -c, --one-byte-char — one-byte character display. input offset in hexadecimal, then sixteen space-separated, three-column, space-filled characters of input data per line.
  • -C, --canonical — canonical hex+ASCII display. this is the one everyone screenshots. input offset in hexadecimal, then sixteen space-separated, two-column, hexadecimal bytes, then those same sixteen bytes in %_p format wrapped in | characters. and listen — if you invoke the program as hd, she implies this option automatically. main character behaviour fr. 👑
  • -d, --two-bytes-decimal — two-byte decimal display. input offset in hexadecimal, then eight space-separated, five-column, zero-filled, two-byte units of input data, in unsigned decimal, per line.
  • -e, --format format_string — give her a format string to use for displaying data. (there's a whole FORMATS section down there, go read it, it's giving rich.)
  • -f, --format-file file — point her at a file containing one or more newline-separated format strings. empty lines get ignored, and so does any line whose first non-blank character is a hash mark (#). very thoughtful of her.
  • -L, --color[=when] — accept color units for the output. the optional when argument can be auto, never or always. if you just leave when off, it defaults to auto. the colors can be disabled; for the current built-in default, check the --help output. see also the Colors subsection and the COLORS section below. 🌈
  • -n, --length length — only interpret length bytes of input. that's it. that's the whole vibe.
  • -o, --two-bytes-octal — two-byte octal display. input offset in hexadecimal, then eight space-separated, six-column, zero-filled, two-byte quantities of input data, in octal, per line.
  • -s, --skip offset — skip offset bytes from the beginning of the input. ghost them. 🫥
  • -v, --no-squeezing — this one makes hexdump display all input data. without -v, any number of groups of output lines that would be identical to the immediately preceding group of output lines (except for the input offsets, obvs) get replaced with a line made of a single asterisk *. so if you're seeing a lonely *, that's her being efficient, not broken. 😭
  • -x, --two-bytes-hex — two-byte hexadecimal display. input offset in hexadecimal, then eight space-separated, four-column, zero-filled, two-byte quantities of input data, in hexadecimal, per line.
  • -h, --help — display help text and exit.
  • -V, --version — display version and exit.

for each input file, hexdump sequentially copies the input to standard output, transforming the data according to the format strings you specified with the -e and -f options, in the order that they were specified. order matters, bestie, don't forget. 💜

🌈 FORMATS 🌈

okay this is the meaty part, stay with me. 🍓

a format string contains any number of format units, separated by whitespace. and a format unit contains up to three items:

  1. an iteration count
  2. a byte count
  3. a format

the iteration count is an optional positive integer, and it defaults to one. each format is applied iteration count times.

the byte count is also an optional positive integer. if you specify it, it defines the number of bytes to be interpreted by each iteration of the format.

if an iteration count and/or a byte count is specified, a single slash must be placed after the iteration count and/or before the byte count to disambiguate them. any whitespace before or after the slash is ignored. she's chill about the spaces but NOT about the slash, so respect the slash. 🫶

the format is required and must be surrounded by double quote (" ") marks. it's interpreted as a fprintf-style format string (see fprintf(3)), with the following exceptions:

  1. an asterisk (*) may not be used as a field width or precision.
  2. a byte count or field precision is required for each s conversion character (unlike the fprintf(3) default, which prints the entire string if the precision is unspecified).
  3. the conversion characters h, l, n, p, and q are not supported.
  4. the single character escape sequences described in the C standard are supported:
\0   NULL
\a   alert character
\b   backspace
\f   form-feed
\n   newline
\r   carriage return
\t   tab
\v   vertical tab

💫 Conversion strings 💫

hexdump also supports these extra conversion strings, and they're lowkey the best part.

  • _a[dox] — display the input offset of the next byte to be displayed, cumulative across input files. the appended characters d, o, and x specify the display base as decimal, octal or hexadecimal respectively.
  • _A[dox] — almost identical to the _a conversion string, except it is only performed once, when all of the input data has been processed.
  • _c — output characters in the default character set. non-printing characters are displayed in three-character, zero-padded octal — except for those representable by standard escape notation (see above), which get displayed as two-character strings.
  • _p — output characters in the default character set. non-printing characters are displayed as a single ..
  • _u — output US ASCII characters, with the exception that control characters are displayed using the following, lower-case, names. characters greater than 0xff, hexadecimal, are displayed as hexadecimal strings.
00 nul     08 bs      10 dle     18 can     7F del
01 soh     09 ht      11 dc1     19 em
02 stx     0A lf      12 dc2     1A sub
03 etx     0B vt      13 dc3     1B esc
04 eot     0C ff      14 dc4     1C fs
05 enq     0D cr      15 nak     1D gs
06 ack     0E so      16 syn     1E rs
07 bel     0F si      17 etb     1F us

🎨 Colors 🎨

when you put this at the end of a format specifier, hexdump highlights the respective string with the color you specified. conditions, if present, are evaluated prior to highlighting. so she checks first, then she glows. ✨

_L[color_unit_1,color_unit_2,...,color_unit_n]

the full syntax of a color unit is as follows:

[!]COLOR[:VALUE][@OFFSET_START[-END]]

  • ! — negate the condition. please note it only makes sense to negate a unit if both a value/string and an offset are specified. in that case the respective output string will be highlighted if and only if the value/string does not match the one at the offset.
  • COLOR — one of the 8 basic shell colors.
  • VALUE — a value to be matched, specified in hexadecimal, or octal base, or as a string. please note that the usual C escape sequences are not interpreted by hexdump inside the color_units.
  • OFFSET — an offset or an offset range at which to check for a match. please note that a lone OFFSET_START uses the same value as the END offset.

🧮 Counters 🧮

the default and supported byte counts for the conversion characters are as follows:

  • %_c, %_p, %_u, %c — one byte counts only.
  • %d, %i, %o, %u, %X, %x — four byte default, one, two and four byte counts supported.
  • %E, %e, %f, %G, %g — eight byte default, four byte counts supported.

the amount of data interpreted by each format string is the sum of the data required by each format unit, which is the iteration count times the byte count — or, if the byte count is not specified, the iteration count times the number of bytes required by the format. 📐

the input is manipulated in blocks, where a block is defined as the largest amount of data specified by any format string. format strings interpreting less than an input block's worth of data, whose last format unit both interprets some number of bytes and does not have a specified iteration count, have the iteration count incremented until the entire input block has been processed — or until there is not enough data remaining in the block to satisfy the format string.

if, either as a result of your specification or of hexdump modifying the iteration count as described above, an iteration count is greater than one, no trailing whitespace characters are output during the last iteration. tiny detail, huge slay.

⚠️ it is an error to specify a byte count as well as multiple conversion characters or strings — unless all but one of the conversion characters or strings is _a or _A. don't do it, bestie, she will simply not.

if, as a result of the specification of the -n option or end-of-file being reached, input data only partially satisfies a format string, the input block is zero-padded sufficiently to display all available data (i.e., any format units overlapping the end of data will display some number of the zero bytes).

further output by such format strings is replaced by an equivalent number of spaces. "an equivalent number of spaces" is defined as the number of spaces output by an s conversion character with the same field width and precision as the original conversion character or conversion string — but with any '+', ' ', '#' conversion flag characters removed, and referencing a NULL string. yeah. that's the definition. write it down. 📝

if no format strings are specified, the default display is very similar to the -x output format (the -x option causes more space to be used between format units than in the default output).

💀 big important note, do not skip this one: the default format and the -x, -d, and -o options use multi-byte format units that are displayed in the system's native byte order (endianness). this means the same input may produce different output on little-endian (e.g., x86, ARM64) and big-endian (e.g., s390x) systems. for byte-order independent output, use single-byte formats such as -b, -c, -C, or -X. that's your get-out-of-endianness-jail card. 🔥

💀 EXIT STATUS 💀

hexdump exits 0 on success and > 0 if an error occurred. simple as. periodt.

👑 CONFORMING TO 👑

the hexdump utility is expected to be IEEE Std 1003.2 ("POSIX.2") compatible. certified, accredited, and still cute. 🎀

💖 EXAMPLES 💖

Okay bestie, this is the part where it all clicks, I promise.

✨ Showing the input in perusal format ✨

Like, just display it pretty:

"%06.6_ao "  12/1 "%3_u "
"\t" "%_p "
"\n"

✨ Doing the -x option by hand ✨

This is literally what -x does under the hood, no cap:

"%07.7_Ax\n"
"%07.7_ax  " 8/2 "%04x " "\n"

✨ MBR Boot Signature example ✨

Obsessed with this one actually. The goal: make the addresses cyan, and make the bytes at offsets 510 and 511 green if their value is 0xAA55, and red if it's anything else. Periodt.

"%07.7_Ax_L[cyan]\n"
"%07.7_ax_L[cyan]  " 8/2 "   %04x_L[green:0xAA55@510-511,!red:0xAA55@510-511] " "\n"

Like, that !red:0xAA55@510-511 is the "otherwise" branch. The way it just works 🫶

🌈 COLORS 🌈

The whole colorization thing is powered by terminal-colors.d(5) functionality. Iconic collab fr fr.

You can turn off the implicit coloring with an empty file:

/etc/terminal-colors.d/hexdump.disable

and that one's just for the hexdump command specifically. But if you wanna kill colors for all the tools? Use:

/etc/terminal-colors.d/disable

Also!! Since version 2.41, the $NO_COLOR environment variable is supported too — it disables output colorization, unless you explicitly enable it with a command-line option. (So a command-line option beats $NO_COLOR. iykyk.)

Your personal override lives at $XDG_CONFIG_HOME/terminal-colors.d or $HOME/.config/terminal-colors.d, and it overrides the global setting. Your config, your rules 💅

Heads up bestie: output colorization may be enabled by default — and in that case the terminal-colors.d directories don't have to exist yet. So don't be confused if there's no directory and colors are still happening. That's just how it is.

🐛 REPORTING BUGS 🐛

Found a bug? Spill it in the issue tracker: <https://github.com/util-linux/util-linux/issues>

(Not me writing the URL exactly right so you don't get lost 😭)

🌸 AVAILABILITY 🌸

The hexdump command is part of the util-linux package, and you can download that whole thing from the Linux Kernel Archive: <https://www.kernel.org/pub/linux/utils/util-linux/>

And that's the whole page, bestie!! You made it all the way through, which is main character energy honestly 🎀 This one's from util-linux 2.42.2, dated 2026-06-16, so if you're reading it much later, maybe go vibe check for a new edition. Slay, go flex on some hex dumps now 👑✨🦋

📦 where this page comes from