Skip to content
shellhacks.dev

MIME Types Reference

Look up the Content-Type for a file extension, or the extension for a type: web, image, font, audio, video, archive, document and API media types.

Free · No sign-up · Your inputs stay in your browser

Reference

MIME types by file extension

ExtensionContent-TypeNotes
.html .htmtext/htmlAdd ; charset=utf-8.
.csstext/css
.js .mjstext/javascriptRFC 9239 made this the one standard type; application/javascript is obsolete.
.json .mapapplication/jsonAlways UTF-8 (RFC 8259); a charset parameter is meaningless.
.jsonldapplication/ld+jsonStructured data.
(none)application/problem+jsonError responses (RFC 9457).
.ndjsonapplication/x-ndjsonNewline-delimited JSON. Not IANA-registered.
.xmlapplication/xmltext/xml is also accepted.
.txttext/plain
.csvtext/csvRFC 4180.
.mdtext/markdownRFC 7763.
.yaml .ymlapplication/yamlRegistered in RFC 9512 (2024).
.tomlapplication/toml
.icstext/calendar
.vcftext/vcard
(none)text/event-streamServer-sent events.
.svgimage/svg+xmlCan contain script. Serve user uploads with Content-Disposition: attachment or from another origin.
.pngimage/png
.jpg .jpegimage/jpeg
.gifimage/gif
.webpimage/webp
.avifimage/avif
.icoimage/vnd.microsoft.iconimage/x-icon is common and works.
.bmpimage/bmp
.tif .tiffimage/tiff
.heicimage/heiciPhone photos; most browsers cannot display it.
.woff2font/woff2
.wofffont/woff
.ttffont/ttf
.otffont/otf
.mp4video/mp4
.webmvideo/webm
.movvideo/quicktime
.mp3audio/mpeg
.m4aaudio/mp4
.wavaudio/wav
.oggaudio/ogg
.flacaudio/flac
.aacaudio/aac
.pdfapplication/pdf
.zipapplication/zip
.gzapplication/gzipNot to be confused with Content-Encoding: gzip.
.tarapplication/x-tar
.zstapplication/zstd
.bz2application/x-bzip2
.xzapplication/x-xz
.7zapplication/x-7z-compressed
.rarapplication/vnd.rar
.docapplication/msword
.docxapplication/vnd.openxmlformats-officedocument.wordprocessingml.document
.xlsapplication/vnd.ms-excel
.xlsxapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheet
.pptxapplication/vnd.openxmlformats-officedocument.presentationml.presentation
.odtapplication/vnd.oasis.opendocument.text
.epubapplication/epub+zip
.rtfapplication/rtf
.wasmapplication/wasmRequired for WebAssembly.instantiateStreaming.
.webmanifestapplication/manifest+json
.jarapplication/java-archive
.apkapplication/vnd.android.package-archive
.shapplication/x-sh
.bin .exe (any binary)application/octet-streamThe fallback: the browser downloads it instead of guessing.
(form)application/x-www-form-urlencodedDefault HTML form encoding.
(form)multipart/form-dataForms with file uploads. Never set it by hand in fetch: the browser must add the boundary.

Send X-Content-Type-Options: nosniff so browsers trust the Content-Type instead of guessing, and get the type right, because with nosniff a script or stylesheet served with the wrong type is refused. Types follow the IANA media type registry unless noted.

Why the type matters

Browsers decide what to do with a response from its Content-Type, not its file name. With X-Content-Type-Options: nosniff, which every site should send, a script served as text/plain is refused and a stylesheet with the wrong type is ignored. Types are registered in the IANA media types registry.

Recent changes

JavaScript's one type is text/javascript since RFC 9239 in 2022, and YAML got application/yaml in 2024. For uploads, check the file's content rather than trusting the type the browser sent, which comes from the file name; Laravel's mimes validation rule reads the content.

Share

Frequently asked questions

What is the MIME type for JSON?
application/json. It is always UTF-8, so a charset parameter adds nothing.
What Content-Type should a file download use?
Its real type, with Content-Disposition: attachment to force the download. application/octet-stream is the fallback when the type is unknown.
Is what I paste sent anywhere?
No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

Go deeper

Suggested reading

Keep planning

Similar tools