MIME Types Cheat Sheet

A MIME type (or media type) names the format of a piece of content in the form type/subtype, such as image/png. Web servers send it in the Content-Type header so the browser knows whether to render a page, play a video or offer a download. Look up any extension with the MIME Type Lookup.

Common types

Rules worth remembering

• Unknown binary data is application/octet-stream. Browsers usually offer to download it instead of opening it.
• Form submissions use application/x-www-form-urlencoded by default and multipart/form-data when a file is attached.
• Text types often carry a charset, as in text/html; charset=utf-8. Always send UTF-8 for text (UTF-8).
• Structured types end in +json or +xml when they are specialised versions of those formats, such as image/svg+xml or application/ld+json.
• Vendor and experimental types start with vnd. (for example application/vnd.ms-excel) or x-.

Common problems

• A page shows as plain text. The server sent text/plain instead of text/html.
• A script or module will not run. Browsers refuse JavaScript modules and strict-MIME scripts served with a wrong type such as text/html or application/octet-stream.
• A font or WebAssembly file fails to load. Servers that do not know .woff2 or .wasm may send a generic type.
• Type sniffing. Browsers sometimes guess a type from the content. Send X-Content-Type-Options: nosniff so they trust your Content-Type instead.

Checking uploads

Never trust an uploaded file's extension or the Content-Type the client sent: both are chosen by the sender. Check the file's first bytes against its expected signature instead (see How File Signatures (Magic Bytes) Work), and serve uploads from a separate domain with nosniff.