MIME Types Reference

The Content-Type values you actually need, mapped to extensions — with the charset rules, the sniffing vulnerability and the image format decision explained.

Updated: 2 August 2026Read: 7 minRuns: 100% in your browser

What a MIME type is

A media type — still universally called a MIME type after its origin in email standards — tells the recipient how to interpret a stream of bytes. It arrives in the Content-Type header:

Content-Type: text/html; charset=utf-8
Content-Type: application/json
Content-Type: image/webp

The format is type/subtype plus optional parameters. Nine top-level types are registered: text, image, audio, video, application, font, model, multipart and message.

Getting it right is not cosmetic. A stylesheet served as text/plain is ignored by browsers in standards mode. A JavaScript module served with the wrong type fails to load. A WebAssembly file must be exactly application/wasm for streaming compilation to work.

Common media types

MIME typeExtensionsDescriptionNotes
text/html.html .htmHTML documentsAlways with charset=utf-8
text/css.cssStylesheetsRequired for CSS to apply
text/javascript.js .mjsJavaScriptapplication/javascript is obsolete
text/plain.txtPlain textDefault when nothing else fits
text/csv.csvComma-separated valuesRFC 4180
text/markdown.mdMarkdownRFC 7763
application/json.jsonJSON dataNo charset parameter; UTF-8 is implied
application/ld+json.jsonldJSON-LD structured dataSchema.org markup
application/xml.xmlXML documentstext/xml is discouraged
application/xhtml+xml.xhtmlXHTMLStrict XML parsing
application/pdf.pdfPDF documentsIndexable by search engines
application/zip.zipZIP archivesAlso .docx, .xlsx, .epub internally
application/gzip.gzGzip compressedTransfer-encoding is separate
application/octet-streamanyUnknown binaryForces download
application/wasm.wasmWebAssemblyMust be exact for streaming compilation
application/manifest+json.webmanifestPWA manifestWeb app manifest
image/jpeg.jpg .jpegJPEG imagesPhotographs
image/png.pngPNG imagesLossless, transparency
image/gif.gifGIF imagesAnimation, 256 colours
image/webp.webpWebP images25-35% smaller than JPEG
image/avif.avifAVIF imagesBest compression, wide support since 2024
image/svg+xml.svgSVG vector graphicsSanitise before serving user uploads
image/x-icon.icoFaviconsimage/vnd.microsoft.icon is the registered name
font/woff2.woff2Web fontsServe with CORS and long cache
font/woff.woffWeb fonts (legacy)Superseded by WOFF2
audio/mpeg.mp3MP3 audio
audio/ogg.ogg .ogaOgg Vorbis audio
video/mp4.mp4MP4 videoH.264 is the compatibility baseline
video/webm.webmWebM videoVP9/AV1, smaller files
multipart/form-dataFile upload formsRequired for file inputs
application/x-www-form-urlencodedDefault form encodingPercent-encoded key=value pairs
text/event-streamServer-sent eventsMust not be buffered

MIME sniffing and why it is dangerous

When a browser distrusts or lacks a Content-Type it may guess by inspecting the bytes. That behaviour, called MIME sniffing, is a security hole: a file uploaded as .txt containing HTML and script can be sniffed as text/html and executed in your origin.

The fix is one header:

X-Content-Type-Options: nosniff

It tells browsers to trust the declared type absolutely. Combined with correct types on every response it eliminates the whole class of attack.

Two further rules for user uploads. Serve them from a separate origin so a stored XSS cannot reach your session cookies. And never trust the Content-Type a client sends on upload — it is trivially forged. Detect the type from the file’s magic bytes server-side.

The charset parameter

charset only applies to text types, and only three cases matter:

  • HTML: always send text/html; charset=utf-8. The HTTP header takes precedence over the <meta charset> tag, so a wrong header overrides correct markup.
  • JSON: never send a charset. RFC 8259 mandates UTF-8 and the parameter is undefined for application/json.
  • CSS and JavaScript: charset is permitted and harmless; UTF-8 is the sane default.

Encoding mismatches here are the most common cause of mojibake in production. If text is garbled, check the response header before touching the file — the encoding guide walks through the diagnosis.

Choosing image formats in 2026

FormatRelative sizeUse for
AVIFSmallestPhotographs where every byte counts; supported in all major browsers
WebP25–35% under JPEGThe safe modern default
JPEGBaselineUniversal fallback
PNGLarge for photosScreenshots, transparency, sharp edges
SVGTiny for line artLogos, icons, diagrams — scales infinitely

Serve several and let the browser pick:

<picture>
  <source srcset="hero.avif" type="image/avif">
  <source srcset="hero.webp" type="image/webp">
  <img src="hero.jpg" width="1600" height="900" alt="...">
</picture>

Always set width and height — see the aspect ratio calculator for why.

Frequently Asked Questions

What is a MIME type?

A two-part label such as text/html that tells the recipient how to interpret a stream of bytes. It is sent in the Content-Type header.

What MIME type should I use for JavaScript?
text/javascript. The WHATWG and IANA settled on it; application/javascript is obsolete though still widely accepted.
Does JSON need a charset parameter?

No. RFC 8259 requires JSON to be UTF-8, and the charset parameter is not defined for application/json. Sending it is harmless but pointless.

What is MIME sniffing?

Browsers guessing a file's type from its content rather than its declared type. It is a security risk; disable it with X-Content-Type-Options: nosniff.

Why is my CSS not loading?

Most often the server is sending the wrong Content-Type. In standards mode browsers ignore stylesheets that are not served as text/css.

What type should I use for unknown files?
application/octet-stream. Browsers will download rather than attempt to render it, which is the safe default for arbitrary binaries.
Can I trust the Content-Type on an upload?

No. It is set by the client and trivially forged. Detect the real type server-side from the file's magic bytes.

Sources & further reading

  1. IANA media types registry — the authoritative list of every registered type
  2. WHATWG MIME Sniffing Standard — exactly how browsers guess when the type is missing or wrong
  3. MDN: MIME types — practical guidance with browser behaviour notes
  4. RFC 6838 — media type specifications and registration procedures