MIME Types Reference
MIME types (Multipurpose Internet Mail Extensions) are internet standard identifiers for file content types, used in HTTP Content-Type headers.
How It Works
A MIME type (media type) is written type/subtype and describes the kind of data: text/plain, image/png, application/json, application/pdf. Independent of any file extension, it is the common language for negotiating format between systems.
MIME appears in the HTTP Content-Type header, in email attachment labelling, and in the OS lookup from extension to type (e.g. /etc/mime.types). application/octet-stream means "unknown binary", while text/plain is the common text fallback.
The most reliable practical strategy is an explicit mapping table rather than trusting server inference: inference differs across implementations, and the same .woff2 may come back as font/woff2, application/font-woff or even application/octet-stream — the last of which the browser refuses outright. Map anything not on the list to application/octet-stream with an attachment disposition, so behaviour stays deterministic (download rather than a silent failure) and is easier to diagnose than letting the browser guess.
Another easily missed point is that types differ between static assets and API responses: the same JSON served from an interface is application/json, but the same file placed under a public directory may still be inferred from the extension, and build artifacts with .br or .gz suffixes break inference entirely. So for static assets, set the type explicitly in the build or server config rather than relying on the seemingly convenient extension-sniffing path.
When to Use This Table
This table is for deciding what Content-Type a server should declare for a file type. MIME types are the shared identifiers across HTTP, email and resource loading, and a wrong guess means styles that do not apply, fonts that get rejected, or scripts that are blocked.
When not to consult it: you are designing client-side upload validation. The accept attribute and drag-and-drop checks are only a first filter; real type judgement must read the magic number or be delegated to the server, because both the extension and the client-declared type are trivially forged.
Rule of thumb: consult this table when writing response headers, the type attribute of <link>/<script>/<img>, or a CDN Content-Type mapping. It does not help when validating what an uploaded file actually contains — that requires reading the byte header.
Pay attention to modern +xml / +json structured suffixes (application/ld+json, image/svg+xml, application/wasm) and to the deprecated application/x-javascript: many older servers still send the latter, causing ES modules to be loaded as classic scripts and fail silently.
Boundaries and Common Pitfalls
IANA is the official registry, but registered does not mean browser-supported
The IANA list runs to over a thousand entries, many legacy or very obscure (especially the vnd.* families). Browsers support a subset, and some newer types need a minimum engine version. For obscure formats, fall back to application/octet-stream plus Content-Disposition rather than sending a type the browser does not recognise, which makes the download behaviour unpredictable.
SVG can carry script and becomes an XSS vector
image/svg+xml is a text format that can embed <script>, onload handlers and external references. Rendering a user-supplied SVG inline as image/svg+xml means executing user code. Use <img src> (the browser sandboxes it and does not run scripts) or rasterise to image/png; if inline is mandatory, combine CSP sandbox with strict sanitising.
The legacy JavaScript MIME trap is still live
application/javascript and text/javascript are both obsolete; the correct type is text/javascript, while application/x-javascript is a relic. The real cost shows up under strict MIME checking: a script served as text/plain is refused outright with an "refused to execute script" error. That is routinely misdiagnosed as a syntax error when the console MIME message gives it away immediately.
Rejected fonts are a CORS problem, not a MIME one
The most common cause of a failing @font-face is a cross-origin font without Access-Control-Allow-Origin, and the console reports a CORS policy error rather than a MIME error. If the type is right but the font still fails, check the Access-Control-Allow-Origin response header instead of tweaking the font MIME type.
How This Relates to Neighbours
For how Content-Type works in requests and responses, use the in-site HTTP Content-Type page; this one covers file-type-to-MIME mapping and consumer-side behaviour.
Validating an upload means reading magic numbers, which this table does not provide; the in-site file-type detection path works differently.
Character sets and encoding names (GBK, Shift-JIS, UTF-8) live in the Character Encodings page — MIME tables only reference them via the charset parameter.
To read an actual JSON response, use the in-site JSON formatter; this table does not parse request bodies.
Practical Snippet
Key points: (1) use text/javascript for scripts (application/javascript and application/x-javascript are obsolete) — a wrong type makes the browser refuse execution outright, not degrade; (2) fall back to application/octet-stream plus Content-Disposition: attachment for unknown types rather than letting the browser guess; (3) always reference user-supplied SVG via <img src>, which does not execute embedded script, while inlining image/svg+xml runs whatever the uploader submitted.
// 静态服务：用扩展名 → MIME 映射，未命中时兜底而不是猜
import { extname } from 'node:path'
const MIME: Record<string, string> = {
'.html': 'text/html; charset=utf-8',
'.js': 'text/javascript; charset=utf-8', // 不用 application/javascript
'.css': 'text/css; charset=utf-8',
'.json': 'application/json; charset=utf-8',
'.svg': 'image/svg+xml',
'.webp': 'image/webp',
'.woff2': 'font/woff2',
'.wasm': 'application/wasm',
}
function contentTypeOf(file: string): string {
const ext = extname(file).toLowerCase()
// 未知类型 → 二进制 + 强制下载，避免浏览器猜测行为
return MIME[ext] ?? 'application/octet-stream'
}
// 用户上传的 SVG：永远用 <img src> 引用，不内联渲染（内联等于执行上传者的脚本）
Practical Notes
- text/javascript vs application/javascript, plus nosniffModern browsers execute both, but if the Content-Type is wrong (say text/plain) and X-Content-Type-Options: nosniff is absent, older IE sniffs the body and executes it, opening an XSS surface. Always set an explicit type for static assets and add nosniff.
- application/octet-stream is the "force download" fallbackUse it for anything whose type you cannot determine, or that you do not want rendered inline (user uploads, for example), together with Content-Disposition: attachment. Conversely, mislabelling .html or .svg as octet-stream turns pages into downloads.
- Wrong MIME on fonts and SVG fails silentlywoff2 must be font/woff2 and SVG must be image/svg+xml. With a wrong type the browser shows no network error — just an OTS parsing error in the console, or missing glyphs — which makes it expensive to diagnose.
Data Sources
- IANA Media Types Registry
- RFC 6838 (media type registration procedures)
Codes, names and definitions above come from public specifications; we claim no originality over the specification data itself. The arrangement, Chinese annotations and practical notes on this page are written by us.
| MIME Type | Extension | Category | Description |
|---|---|---|---|
| text/html | .html | Text | HTML document |
| text/css | .css | Text | CSS stylesheet |
| text/javascript | .js | Text | JavaScript script |
| text/plain | .txt | Text | Plain text |
| text/xml | .xml | Text | XML document |
| text/csv | .csv | Text | CSV comma-separated values |
| text/markdown | .md | Text | Markdown document |
| application/json | .json | Application | JSON data |
| application/xml | .xml | Application | XML data |
| application/pdf | Application | PDF document | |
| application/zip | .zip | Application | ZIP archive |
| application/gzip | .gz | Application | Gzip compressed file |
| application/x-tar | .tar | Application | Tar archive |
| application/octet-stream | .bin | Application | Binary data stream |
| application/x-www-form-urlencoded | - | Application | URL-encoded form data |
| multipart/form-data | - | Application | Multipart form data (file upload) |
| image/jpeg | .jpg | Image | JPEG image |
| image/png | .png | Image | PNG image |
| image/gif | .gif | Image | GIF image |
| image/svg+xml | .svg | Image | SVG vector image |
| image/webp | .webp | Image | WebP image |
| image/x-icon | .ico | Image | Icon file |
| image/bmp | .bmp | Image | BMP bitmap |
| audio/mpeg | .mp3 | Audio | MP3 audio |
| audio/wav | .wav | Audio | WAV audio |
| audio/ogg | .ogg | Audio | OGG audio |
| audio/aac | .aac | Audio | AAC audio |
| video/mp4 | .mp4 | Video | MP4 video |
| video/webm | .webm | Video | WebM video |
| video/x-msvideo | .avi | Video | AVI video |
| font/woff | .woff | Font | WOFF font |
| font/woff2 | .woff2 | Font | WOFF2 font |
| font/ttf | .ttf | Font | TrueType font |
| font/otf | .otf | Font | OpenType font |
Frequently Asked Questions
What is a MIME type?
A MIME type (Content-Type) identifies the format of a file or payload as "type/subtype" (e.g. text/html); the server tells the browser how to parse it via the HTTP response header.
Must the extension match the MIME type?
Not necessarily. Browsers honor the Content-Type response header; the extension is only a convention. A wrong configuration can trigger a download or a security block.
Which MIME type for file uploads?
Use multipart/form-data for forms with files; use application/x-www-form-urlencoded for plain key-value forms.
How do I check a resource MIME type?
Inspect the Content-Type response header in the browser DevTools Network panel, or use the site's request/response parsing tools.