MIME Types

The complete developer reference for HTTP media types, every MIME type you are likely to set in a Content-Type header, grouped by category, with file extensions and the gotchas that catch teams in production.

Base64 Encoder HTTP Headers HTTP Status Codes

Application

application/jsonApplication.json

JSON-formatted data. The default content type for modern REST APIs.

Developer note: Always declare charset (typically UTF-8). 'application/json; charset=utf-8' avoids ambiguity with proxies that re-encode.

application/xmlApplication.xml

XML data intended for machine consumption. Use text/xml for human-readable XML.

application/xhtml+xmlApplication.xhtml

XHTML, XML-formatted HTML. Triggers strict parsing in browsers.

application/javascriptApplication.js, .mjs

JavaScript source code. Deprecated in favor of text/javascript per WHATWG, but still widely used.

Developer note: Modern advice: serve as text/javascript. Both work; spec prefers the latter.

application/wasmApplication.wasm

WebAssembly binary module. Browsers require this exact MIME for streaming compilation via WebAssembly.instantiateStreaming().

application/pdfApplication.pdf

Adobe Portable Document Format.

application/zipApplication.zip

ZIP-compressed archive.

application/gzipApplication.gz

Gzip-compressed file (single file, not an archive).

application/x-tarApplication.tar

Unix tape archive.

application/octet-streamApplication.bin

Arbitrary binary data, the catch-all for unknown content. Triggers download in browsers.

Developer note: Default when you do not know or want to disclose the real type. Pair with Content-Disposition: attachment for explicit downloads.

application/x-www-form-urlencodedApplication

Default encoding for HTML form submissions. Key-value pairs joined by '&', percent-encoded.

application/ld+jsonApplication.jsonld

JSON-LD, JSON for Linking Data. Used for schema.org structured data in HTML <script> tags.

application/manifest+jsonApplication.webmanifest

Web App Manifest. Defines PWA metadata, name, icons, theme color, start URL.

application/vnd.api+jsonApplication

JSON:API media type. Used by APIs that conform to the jsonapi.org spec.

application/problem+jsonApplication

RFC 9457 Problem Details for HTTP APIs. Structured error responses with type, title, status, detail, instance.

application/vnd.ms-excelApplication.xls

Legacy Microsoft Excel spreadsheet (BIFF binary format).

application/vnd.openxmlformats-officedocument.spreadsheetml.sheetApplication.xlsx

Modern Microsoft Excel spreadsheet (OOXML).

application/vnd.openxmlformats-officedocument.wordprocessingml.documentApplication.docx

Modern Microsoft Word document (OOXML).

application/sqlApplication.sql

SQL source file.

application/graphqlApplication.graphql

GraphQL query document.

Text

text/plainText.txt

Plain text, no formatting. Default charset is US-ASCII; always specify UTF-8 explicitly.

text/htmlText.html, .htm

HTML document.

text/cssText.css

Cascading Style Sheet.

text/javascriptText.js, .mjs

JavaScript source code. WHATWG-preferred MIME for JS over application/javascript.

text/csvText.csv

Comma-separated values.

Developer note: Default delimiter is comma per RFC 4180. Charset matters: BOM-prefixed UTF-8 is the safest for Excel compatibility.

text/markdownText.md, .markdown

Markdown document.

text/yamlText.yaml, .yml

YAML document. Not formally registered; application/yaml is also seen.

text/event-streamText

Server-Sent Events stream. Required Content-Type for SSE responses.

Developer note: Pair with Cache-Control: no-cache and Connection: keep-alive. Disable proxy buffering (X-Accel-Buffering: no on NGINX).

text/xmlText.xml

XML intended to be readable as text. Prefer application/xml for machine-only XML.

text/tab-separated-valuesText.tsv

Tab-separated values.

Image

image/jpegImage.jpg, .jpeg

JPEG image. Lossy compression, best for photographs.

image/pngImage.png

Portable Network Graphics. Lossless, supports transparency.

image/gifImage.gif

GIF, supports animation; capped at 256 colors per frame.

image/webpImage.webp

Modern image format from Google. ~30% smaller than JPEG at the same quality; supports transparency and animation.

image/avifImage.avif

AV1 Image File Format. Even smaller than WebP at the same quality; broader support since 2024.

image/svg+xmlImage.svg

Scalable Vector Graphics, XML-based vector format. Renders sharply at any size.

Developer note: User-uploaded SVGs are an XSS vector, they can contain <script> tags. Sanitize on upload or serve from a separate origin.

image/x-iconImage.ico

Windows icon format. Used for favicon.ico.

image/heicImage.heic

High Efficiency Image Container. Default photo format on iPhone since 2017.

image/bmpImage.bmp

Windows Bitmap. Uncompressed, very large files.

image/tiffImage.tiff, .tif

Tagged Image File Format. Used in publishing and scientific imaging.

Audio

audio/mpegAudio.mp3

MP3 audio.

audio/mp4Audio.m4a

MPEG-4 audio container, typically AAC-encoded.

audio/oggAudio.ogg, .oga

Ogg container, typically Vorbis or Opus audio.

audio/wavAudio.wav

Waveform Audio File Format. Uncompressed PCM.

audio/webmAudio.weba

WebM audio container, typically Opus.

audio/flacAudio.flac

Free Lossless Audio Codec.

Video

video/mp4Video.mp4

MPEG-4 video container, typically H.264 or H.265.

video/webmVideo.webm

WebM video container, typically VP9 or AV1 + Opus.

video/oggVideo.ogv

Ogg container with Theora video.

video/quicktimeVideo.mov

Apple QuickTime container.

video/x-msvideoVideo.avi

Microsoft AVI container. Legacy.

Font

font/woffFont.woff

Web Open Font Format v1.

font/woff2Font.woff2

Web Open Font Format v2, Brotli-compressed, ~30% smaller than WOFF1.

Developer note: Always serve fonts as WOFF2 with Cache-Control: public, max-age=31536000, immutable, and a fingerprint in the filename.

font/ttfFont.ttf

TrueType Font. Use only as fallback; prefer WOFF2.

font/otfFont.otf

OpenType Font. Use only as fallback.

Multipart

multipart/form-dataMultipart

Form submission encoded as multiple parts, each with its own headers. Required for file uploads.

Developer note: Always inspect Content-Type header for the boundary= parameter, the body is unparseable without it.

multipart/byterangesMultipart

Response containing multiple byte ranges of a single resource. Used with 206 Partial Content.

multipart/alternativeMultipart

Multiple representations of the same content. Common in emails (text/plain + text/html versions).

Model

model/gltf+jsonModel.gltf

glTF, open 3D scene description, JSON-formatted.

model/gltf-binaryModel.glb

glTF binary container, all assets packed into one file.

Frequently Asked Questions

What is a MIME type?+

A MIME type, also called a media type, is a two-part string in the form 'type/subtype' that identifies the format of a piece of data. Examples: application/json, text/html, image/webp, video/mp4. The HTTP Content-Type header uses MIME types to tell the recipient how to interpret the body. Originally defined for email (Multipurpose Internet Mail Extensions), MIME types are now universal across HTTP, file systems, and APIs.

What is the difference between application/json and text/json?+

application/json is the only registered MIME type for JSON, per RFC 8259. text/json is a common mistake, it never made it into the IANA registry. Always use application/json. Browsers, libraries, and APIs are forgiving and usually accept text/json, but production code should use the registered name. Same rule applies to text/xml vs application/xml: use application/xml for machine-only XML.

What MIME type should I use for JavaScript files?+

WHATWG's HTML standard prefers text/javascript over application/javascript. Both work in every modern browser and bundler. New code should use text/javascript. For ES modules (.mjs files), the same MIME type applies; the .mjs extension and the script's type='module' attribute do the actual work of switching to module semantics.

How do I serve a custom or unknown file format?+

Use application/octet-stream, the universal 'arbitrary binary data' MIME type. It tells browsers to download rather than try to render the content. If you want the user to see a specific filename, pair it with Content-Disposition: attachment; filename="report.bin". Avoid making up types like application/x-mything; use a registered type if one exists and octet-stream otherwise.

Why does my SVG upload sometimes execute JavaScript?+

SVG is XML and supports embedded <script> tags. A malicious SVG uploaded to your site and served with Content-Type: image/svg+xml from your origin can execute scripts as your origin, a stored XSS vulnerability. Defenses: (1) sanitize SVGs server-side with a library like DOMPurify or svgo; (2) serve user uploads from a separate origin (e.g., usercontent.example.com); (3) set Content-Disposition: attachment to force download instead of render.

What is the MIME type for SSE (Server-Sent Events)?+

text/event-stream. The browser's EventSource API only accepts this exact MIME type. Pair it with Cache-Control: no-cache and Connection: keep-alive. On NGINX, also set X-Accel-Buffering: no to disable proxy buffering, without it, events get held in a buffer and delivered in chunks instead of streaming.