MIME Type Reference
Look up the correct MIME type for any file extension. Searchable reference of media types for images, audio, video, fonts, documents, archives, and code, with practical serving notes.
| Extension | MIME type | Format | Note |
|---|---|---|---|
| Text & markup · 11 | |||
| .html.htm | HTML document | Always send charset=utf-8; browsers sniff legacy encodings otherwise. | |
| .css | Cascading style sheet | Must be text/css or the stylesheet is ignored in strict mode. | |
| .txt.text .log | Plain text | Default fallback for unknown text; add charset. | |
| .csv | Comma-separated values | Add Content-Disposition: attachment to force a download. | |
| .tsv.tab | Tab-separated values | Registered separately from text/csv. | |
| .md.markdown | Markdown | RFC 7763; optional variant parameter, e.g. ;variant=GFM. | |
| .ics.ifb | iCalendar | Triggers calendar import on most desktop and mobile clients. | |
| .vcf.vcard | vCard contact | Older servers still use text/x-vcard. | |
| .rtf | Rich Text Format | text/rtf also appears in the wild; application/rtf is registered. | |
| .vtt | WebVTT subtitles | Required exactly for <track> to load; CORS applies. | |
| .srt | SubRip subtitles | Unregistered; convert to WebVTT for browser playback. | |
| Image · 12 | |||
| .png | Portable Network Graphics | Already compressed — skip gzip/brotli. | |
| .jpg.jpeg .jpe | JPEG image | Never image/jpg — that type does not exist. | |
| .gif | Graphics Interchange Format | Animated GIFs are far larger than equivalent WebP/AVIF video. | |
| .webp | WebP image | Universally supported since 2020; good default for photos and UI art. | |
| .avif | AVIF image | Best compression of the mainstream formats; serve behind <picture>. | |
| .svg.svgz | Scalable Vector Graphics | XML text — compresses very well, but sanitize user uploads (embedded scripts). | |
| .ico | Icon file | image/x-icon is the widely-served legacy alias. | |
| .bmp | Windows bitmap | Uncompressed; almost always worth converting before serving. | |
| .tif.tiff | TIFF image | Not rendered by browsers — download or convert server-side. | |
| .heic.heif | HEIC / HEIF image | Default iPhone photo format; Safari-only in browsers. | |
| .apng | Animated PNG | Served as image/apng so browsers do not treat it as a still PNG. | |
| .jxl | JPEG XL | Limited browser support; keep a WebP/JPEG fallback. | |
| Audio · 9 | |||
| .mp3 | MP3 audio | audio/mp3 is a non-standard alias some clients still send. | |
| .wav | Waveform audio | audio/x-wav and audio/wave appear in older stacks. | |
| .ogg.oga | Ogg audio | Use application/ogg only when the stream mixes audio and video. | |
| .opus | Opus audio | Add the codecs parameter: audio/ogg; codecs=opus. | |
| .m4a | MPEG-4 audio | audio/x-m4a is the common legacy spelling. | |
| .aac | AAC audio | Raw ADTS stream; inside an MP4 container use audio/mp4. | |
| .flac | FLAC lossless audio | Supported by every current browser. | |
| .weba | WebM audio | Audio-only WebM, usually Opus or Vorbis. | |
| .mid.midi | MIDI sequence | audio/x-midi is also registered as an alias. | |
| Video · 9 | |||
| .mp4.m4v | MPEG-4 video | Safest default; add codecs for MSE, e.g. video/mp4; codecs="avc1.42E01E". | |
| .webm | WebM video | VP8/VP9/AV1; not supported in older Safari. | |
| .ogv | Ogg Theora video | Largely superseded by WebM. | |
| .mov.qt | QuickTime movie | Often plays in Safari only; remux to MP4 for the web. | |
| .avi | AVI container | No native browser playback. | |
| .mkv | Matroska video | Unregistered x- type; remux for browser delivery. | |
| .ts.m2ts | MPEG transport stream | HLS segment format — note the .ts extension collides with TypeScript. | |
| .m3u8 | HLS playlist | application/x-mpegURL is the common alternative spelling. | |
| .mpd | MPEG-DASH manifest | Serve with CORS headers for cross-origin players. | |
| Font · 5 | |||
| .woff2 | WOFF 2.0 web font | Pre-compressed — never gzip again. The only format modern sites need. | |
| .woff | WOFF web font | Legacy fallback; also pre-compressed. | |
| .ttf | TrueType font | Compresses well with brotli, but ship WOFF2 instead. | |
| .otf | OpenType font | application/x-font-otf is the deprecated legacy type. | |
| .eot | Embedded OpenType | IE-only; safe to drop from modern @font-face stacks. | |
| Document · 11 | |||
| Portable Document Format | Content-Disposition decides inline viewing vs. download. | ||
| .doc.dot | Word 97–2003 | Legacy binary OLE format. | |
| .docx | Word (OOXML) | A ZIP container — the longest MIME type you will meet in practice. | |
| .xls.xlt | Excel 97–2003 | Legacy binary spreadsheet. | |
| .xlsx | Excel (OOXML) | Preferred over text/csv when formatting matters. | |
| .ppt.pps | PowerPoint 97–2003 | Legacy binary presentation. | |
| .pptx | PowerPoint (OOXML) | ZIP-based OOXML presentation. | |
| .odt | OpenDocument text | LibreOffice / OpenOffice document. | |
| .ods | OpenDocument spreadsheet | OpenDocument equivalent of .xlsx. | |
| .odp | OpenDocument presentation | OpenDocument equivalent of .pptx. | |
| .epub | EPUB e-book | ZIP container with XHTML content. | |
| Archive · 8 | |||
| .zip | ZIP archive | Already compressed; disable transfer compression. | |
| .gz.gzip | gzip archive | For .tar.gz prefer application/gzip over the old x- forms. | |
| .tar | tar archive | Uncompressed container; compresses very well. | |
| .bz2 | bzip2 archive | Slower than gzip, smaller output. | |
| .7z | 7-Zip archive | Not registered with IANA. | |
| .rar | RAR archive | application/x-rar-compressed is the older spelling. | |
| .xz | XZ archive | LZMA2 compression, common for source tarballs. | |
| .zst | Zstandard archive | Also a Content-Encoding value (zstd) on modern servers. | |
| Data & code · 16 | |||
| .json | JSON | Always UTF-8 by spec — do not add a charset parameter. | |
| .jsonld | JSON-LD | The type search engines expect for structured data blocks. | |
| .ndjson.jsonl | Newline-delimited JSON | Streaming-friendly; one JSON value per line. | |
| .xml | XML | text/xml is legacy and defaults to US-ASCII — prefer application/xml. | |
| .yaml.yml | YAML | Registered in 2024; text/yaml is the older de-facto type. | |
| .toml | TOML config | Common for Rust and Python packaging config. | |
| .js.mjs .cjs | JavaScript | text/javascript is the standard type; application/javascript is obsolete. | |
| .wasm | WebAssembly module | Required exactly for streaming instantiation to work. | |
| .map | Source map | Plain JSON; usually blocked from public access in production. | |
| .rss | RSS feed | Readers also accept application/xml. | |
| .atom | Atom feed | The IETF-standardised alternative to RSS. | |
| .webmanifest | Web app manifest | PWA install prompts require this exact type. | |
| .sql | SQL script | text/plain is a safe fallback for browser viewing. | |
| .sh.bash | Shell script | Serve as text/plain if you want it viewed, not run. | |
| .py | Python source | application/x-python-code refers to compiled bytecode. | |
| .parquet | Apache Parquet | Registered in 2024; columnar analytics format. | |
| Binary · 10 | |||
| .bin.dat | Arbitrary binary data | The universal fallback — always triggers a download. | |
| — | File upload form body | Required for <form enctype> when uploading files. | |
| — | URL-encoded form body | Default HTML form encoding; unsuitable for binary payloads. | |
| — | Server-sent events | Disable proxy buffering or events arrive in bursts. | |
| .apk | Android package | ZIP-based; served for sideloaded installs. | |
| .exe.msi .dll | Windows executable | application/x-msdownload is the legacy type. | |
| .dmg | macOS disk image | Unregistered but universally understood. | |
| .iso | ISO disc image | Large files — make sure range requests are enabled. | |
| .torrent | BitTorrent metainfo | Handed off to the OS torrent client. | |
| .swf | Flash movie | Dead format — kept here for legacy archive work. | |
What a MIME type actually does
A MIME type — officially a media type — is the short string a server puts in the Content-Type response header to tell the client what it just received. The file extension is a hint for humans and for the operating system; the media type is what the browser actually obeys.
Every type has the form type/subtype, optionally followed by parameters: text/html; charset=utf-8. The top-level type is one of a small fixed set — text, image, audio, video, font, model, application, plus the composite multipart and message. The subtype identifies the exact format, and IANA maintains the official registry.
Get it wrong and behaviour breaks in ways that look unrelated to the header: a stylesheet served as text/plain is silently ignored, a WebAssembly module served as octet-stream cannot stream-instantiate, and a PWA manifest with the wrong type never triggers an install prompt.
Prefixes: what x-, vnd., and + mean
| Pattern | Meaning | Example |
|---|---|---|
| x- | Unregistered / experimental. Deprecated by RFC 6648 but still everywhere in legacy configs. | application/x-7z-compressed |
| vnd. | Vendor tree — a format owned by a specific company or product. | application/vnd.ms-excel |
| prs. | Personal tree — formats registered by individuals rather than organisations. | text/prs.lines.tag |
| +xml, +json, +zip | Structure suffix — the format is built on top of that base syntax, so generic parsers can still read it. | image/svg+xml · application/epub+zip |
| ; charset= | Encoding parameter. Required for text types; forbidden for application/json, which is UTF-8 by definition. | text/html; charset=utf-8 |
| ; codecs= | Media parameter naming the exact codecs in the container — needed by Media Source Extensions. | video/mp4; codecs="avc1.42E01E" |
Types people get wrong
- image/jpg does not exist. The registered type for a .jpg file is image/jpeg. Some servers accept the wrong one; treat that as luck, not spec.
- JavaScript is text/javascript. The HTML spec settled on it and marked application/javascript obsolete — the opposite of the advice that circulated for a decade.
- JSON takes no charset. application/json; charset=utf-8 is not wrong so much as meaningless; the spec fixes the encoding at UTF-8.
- application/xml beats text/xml. The legacy text/xml defaults to US-ASCII when no charset is given, which mangles non-English content.
- Fonts moved out of application/. RFC 8081 created the font/ top-level type, so font/woff2 replaced application/font-woff2.
- .ts is ambiguous. On a web server it means an MPEG transport stream (video/mp2t); in a source tree it means TypeScript. Build tools and CDNs regularly disagree.
Sniffing, downloads, and security
When a browser distrusts or lacks a Content-Type it falls back to MIME sniffing— inspecting the first bytes to guess the format. That is a real attack surface: a user-uploaded file declared as an image but sniffed as HTML can execute script on your origin. Sending X-Content-Type-Options: nosniff turns sniffing off and makes the declared type binding.
The media type decides what the file is; Content-Disposition decides what to do with it. inline renders in the tab where possible, attachment; filename="report.pdf" forces a save dialog. A PDF served as octet-stream downloads not because of the type alone but because the browser has no viewer for that type.
Rule of thumb for uploads
Never trust the Content-Type a client sends with an upload, and never derive it from the filename. Detect the type from the file's magic bytes server-side, compare it against an allowlist, and re-serve it with a type you chose — from a separate domain if the files are public.
Where the mapping lives on a real server
Nginx
Reads /etc/nginx/mime.types, included from the http block.
include mime.types; default_type application/octet-stream;
Apache
Ships mime.types; extend it per-directory.
AddType application/wasm .wasm AddType font/woff2 .woff2
Node / Express
Set it explicitly when you build the response yourself.
res.type("application/json");
res.setHeader("X-Content-Type-Options", "nosniff");Checking what you actually send
The header is the only source of truth — read it, don't assume it.
curl -sI https://example.com/app.wasm \ | grep -i content-type