MIME Types Reference
The Content-Type values you actually need, mapped to extensions — with the charset rules, the sniffing vulnerability and the image format decision explained.
What a MIME type is
A media type — still universally called a MIME type after its origin in email standards — tells the recipient how to interpret a stream of bytes. It arrives in the Content-Type header:
Content-Type: text/html; charset=utf-8
Content-Type: application/json
Content-Type: image/webpThe format is type/subtype plus optional parameters. Nine top-level types are registered: text, image, audio, video, application, font, model, multipart and message.
Getting it right is not cosmetic. A stylesheet served as text/plain is ignored by browsers in standards mode. A JavaScript module served with the wrong type fails to load. A WebAssembly file must be exactly application/wasm for streaming compilation to work.
Common media types
| MIME type | Extensions | Description | Notes |
|---|---|---|---|
| text/html | .html .htm | HTML documents | Always with charset=utf-8 |
| text/css | .css | Stylesheets | Required for CSS to apply |
| text/javascript | .js .mjs | JavaScript | application/javascript is obsolete |
| text/plain | .txt | Plain text | Default when nothing else fits |
| text/csv | .csv | Comma-separated values | RFC 4180 |
| text/markdown | .md | Markdown | RFC 7763 |
| application/json | .json | JSON data | No charset parameter; UTF-8 is implied |
| application/ld+json | .jsonld | JSON-LD structured data | Schema.org markup |
| application/xml | .xml | XML documents | text/xml is discouraged |
| application/xhtml+xml | .xhtml | XHTML | Strict XML parsing |
| application/pdf | PDF documents | Indexable by search engines | |
| application/zip | .zip | ZIP archives | Also .docx, .xlsx, .epub internally |
| application/gzip | .gz | Gzip compressed | Transfer-encoding is separate |
| application/octet-stream | any | Unknown binary | Forces download |
| application/wasm | .wasm | WebAssembly | Must be exact for streaming compilation |
| application/manifest+json | .webmanifest | PWA manifest | Web app manifest |
| image/jpeg | .jpg .jpeg | JPEG images | Photographs |
| image/png | .png | PNG images | Lossless, transparency |
| image/gif | .gif | GIF images | Animation, 256 colours |
| image/webp | .webp | WebP images | 25-35% smaller than JPEG |
| image/avif | .avif | AVIF images | Best compression, wide support since 2024 |
| image/svg+xml | .svg | SVG vector graphics | Sanitise before serving user uploads |
| image/x-icon | .ico | Favicons | image/vnd.microsoft.icon is the registered name |
| font/woff2 | .woff2 | Web fonts | Serve with CORS and long cache |
| font/woff | .woff | Web fonts (legacy) | Superseded by WOFF2 |
| audio/mpeg | .mp3 | MP3 audio | |
| audio/ogg | .ogg .oga | Ogg Vorbis audio | |
| video/mp4 | .mp4 | MP4 video | H.264 is the compatibility baseline |
| video/webm | .webm | WebM video | VP9/AV1, smaller files |
| multipart/form-data | — | File upload forms | Required for file inputs |
| application/x-www-form-urlencoded | — | Default form encoding | Percent-encoded key=value pairs |
| text/event-stream | — | Server-sent events | Must not be buffered |
MIME sniffing and why it is dangerous
When a browser distrusts or lacks a Content-Type it may guess by inspecting the bytes. That behaviour, called MIME sniffing, is a security hole: a file uploaded as .txt containing HTML and script can be sniffed as text/html and executed in your origin.
The fix is one header:
X-Content-Type-Options: nosniffIt tells browsers to trust the declared type absolutely. Combined with correct types on every response it eliminates the whole class of attack.
Two further rules for user uploads. Serve them from a separate origin so a stored XSS cannot reach your session cookies. And never trust the Content-Type a client sends on upload — it is trivially forged. Detect the type from the file’s magic bytes server-side.
The charset parameter
charset only applies to text types, and only three cases matter:
- HTML: always send
text/html; charset=utf-8. The HTTP header takes precedence over the<meta charset>tag, so a wrong header overrides correct markup. - JSON: never send a charset. RFC 8259 mandates UTF-8 and the parameter is undefined for
application/json. - CSS and JavaScript: charset is permitted and harmless; UTF-8 is the sane default.
Encoding mismatches here are the most common cause of mojibake in production. If text is garbled, check the response header before touching the file — the encoding guide walks through the diagnosis.
Choosing image formats in 2026
| Format | Relative size | Use for |
|---|---|---|
| AVIF | Smallest | Photographs where every byte counts; supported in all major browsers |
| WebP | 25–35% under JPEG | The safe modern default |
| JPEG | Baseline | Universal fallback |
| PNG | Large for photos | Screenshots, transparency, sharp edges |
| SVG | Tiny for line art | Logos, icons, diagrams — scales infinitely |
Serve several and let the browser pick:
<picture>
<source srcset="hero.avif" type="image/avif">
<source srcset="hero.webp" type="image/webp">
<img src="hero.jpg" width="1600" height="900" alt="...">
</picture>Always set width and height — see the aspect ratio calculator for why.
Frequently Asked Questions
What is a MIME type?
A two-part label such as text/html that tells the recipient how to interpret a stream of bytes. It is sent in the Content-Type header.
What MIME type should I use for JavaScript?
text/javascript. The WHATWG and IANA settled on it; application/javascript is obsolete though still widely accepted.Does JSON need a charset parameter?
No. RFC 8259 requires JSON to be UTF-8, and the charset parameter is not defined for application/json. Sending it is harmless but pointless.
What is MIME sniffing?
Browsers guessing a file's type from its content rather than its declared type. It is a security risk; disable it with X-Content-Type-Options: nosniff.
Why is my CSS not loading?
Most often the server is sending the wrong Content-Type. In standards mode browsers ignore stylesheets that are not served as text/css.
What type should I use for unknown files?
application/octet-stream. Browsers will download rather than attempt to render it, which is the safe default for arbitrary binaries.Can I trust the Content-Type on an upload?
No. It is set by the client and trivially forged. Detect the real type server-side from the file's magic bytes.
Sources & further reading
- IANA media types registry — the authoritative list of every registered type
- WHATWG MIME Sniffing Standard — exactly how browsers guess when the type is missing or wrong
- MDN: MIME types — practical guidance with browser behaviour notes
- RFC 6838 — media type specifications and registration procedures