What is a MIME type and where is it used?

A MIME type (Multipurpose Internet Mail Extensions) is a standard identifier that describes the format of a file or data stream. It is sent in the HTTP Content-Type header so browsers and clients know how to handle a response — whether to display it as HTML, parse it as JSON, play it as audio, or prompt a download. For example, application/json tells the client the body is JSON.

What MIME type should I use for a JSON API response?

Use application/json. This is the correct and universally expected Content-Type for JSON API responses. Some older APIs use text/plain or text/javascript, but these are incorrect — modern REST APIs and any API client expecting JSON should send and accept application/json.

What is the difference between application/octet-stream and a specific MIME type?

application/octet-stream is a generic binary type meaning "unknown file format." Browsers typically prompt a download for this type. Use a specific MIME type whenever possible (e.g. application/pdf for PDFs, image/png for PNGs) so browsers can handle the content appropriately. Use application/octet-stream only as a fallback when no specific type applies.

MIME Types — Complete Reference

Media types mapped to file extensions in both directions, covering the full IANA registry.

56 types

Ext	MIME Type	Category	Description
.html	text/html	Text	HTML document
.css	text/css	Text	Cascading Style Sheets
.csv	text/csv	Text	Comma-Separated Values
.ics	text/calendar	Text	iCalendar format
.js	text/javascript	Text	JavaScript (IANA-recommended)
.md	text/markdown	Text	Markdown document
.txt	text/plain	Text	Plain text
.xml	text/xml	Text	XML document (text form)
.json	application/json	Application	JSON data
.jsonld	application/ld+json	Application	JSON-LD linked data
.xml	application/xml	Application	XML document
.zip	application/zip	Application	ZIP archive
.gz	application/gzip	Application	Gzip compressed
.tar	application/x-tar	Application	Tape archive
.7z	application/x-7z-compressed	Application	7-zip archive
.rar	application/vnd.rar	Application	RAR archive
.pdf	application/pdf	Application	Portable Document Format
.doc	application/msword	Application	Microsoft Word (legacy)
.docx	application/vnd.openxmlformats-officedocument.wordprocessingml.document	Application	Microsoft Word (OOXML)
.xls	application/vnd.ms-excel	Application	Microsoft Excel (legacy)
.xlsx	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet	Application	Microsoft Excel (OOXML)
.ppt	application/vnd.ms-powerpoint	Application	Microsoft PowerPoint (legacy)
.pptx	application/vnd.openxmlformats-officedocument.presentationml.presentation	Application	Microsoft PowerPoint (OOXML)
.odt	application/vnd.oasis.opendocument.text	Application	OpenDocument text
.ods	application/vnd.oasis.opendocument.spreadsheet	Application	OpenDocument spreadsheet
.odp	application/vnd.oasis.opendocument.presentation	Application	OpenDocument presentation
.wasm	application/wasm	Application	WebAssembly binary
.bin	application/octet-stream	Application	Arbitrary binary data
.woff	font/woff	Application	Web Open Font Format
.woff2	font/woff2	Application	Web Open Font Format 2
.apng	image/apng	Image	Animated Portable Network Graphics
.avif	image/avif	Image	AV1 Image File Format
.bmp	image/bmp	Image	Bitmap image
.gif	image/gif	Image	Graphics Interchange Format
.ico	image/x-icon	Image	Icon format
.jpg	image/jpeg	Image	JPEG image
.png	image/png	Image	Portable Network Graphics
.svg	image/svg+xml	Image	Scalable Vector Graphics
.tif	image/tiff	Image	Tagged Image File Format
.webp	image/webp	Image	WebP image
.aac	audio/aac	Audio	Advanced Audio Coding
.flac	audio/flac	Audio	Free Lossless Audio Codec
.mp3	audio/mpeg	Audio	MPEG audio
.ogg	audio/ogg	Audio	Ogg audio
.opus	audio/opus	Audio	Opus audio
.wav	audio/wav	Audio	Waveform Audio
.weba	audio/webm	Audio	WebM audio
.avi	video/x-msvideo	Video	AVI video
.mp4	video/mp4	Video	MPEG-4 video
.mpeg	video/mpeg	Video	MPEG video
.ogv	video/ogg	Video	Ogg video
.ts	video/mp2t	Video	MPEG-2 Transport Stream
.webm	video/webm	Video	WebM video
.mov	video/quicktime	Video	QuickTime video
.otf	font/otf	Font	OpenType font
.ttf	font/ttf	Font	TrueType font

The ones people get wrong

File	Correct type	Commonly seen	Consequence
`.js`	`text/javascript`	`application/javascript`	Both work; text/javascript is the standard as of the WHATWG spec
`.mjs`	`text/javascript`	`text/plain`	Modules fail to load with a strict MIME type error
`.json`	`application/json`	`text/json`	text/json is not registered; some clients refuse to parse it
`.svg`	`image/svg+xml`	`image/svg`	Wrong type means the image does not render
`.woff2`	`font/woff2`	`application/font-woff2`	The application/ forms were deprecated in RFC 8081
`.csv`	`text/csv`	`application/vnd.ms-excel`	Opens in the wrong application
`.md`	`text/markdown`	`text/plain`	Loses editor and preview associations
`.wasm`	`application/wasm`	`application/octet-stream`	Streaming compilation is refused; the module fails to instantiate

Type names are case-insensitive but conventionally lowercase. Parameters follow a semicolon: text/html; charset=utf-8. For text types, always send the charset — omitting it leaves the browser guessing, and the guess can be exploited.

MIME sniffing turns an upload into an exploit

When a Content-Type looks wrong or generic, browsers historically inspected the bytes and decided for themselves. That behaviour is called MIME sniffing, and it is a security problem.

The attack: a user uploads a file named avatar.jpg whose contents are HTML containing a script. Your server stores it and serves it back with a generic or incorrect type. The browser sniffs the content, decides it is HTML, and executes the script — as your origin, with access to your cookies.

Two defences, and you want both. Send X-Content-Type-Options: nosniff on every response, which tells the browser to trust the declared type and never sniff. And serve user-uploaded files from a separate origin, so even a successful injection has no access to your session.

Do not trust the Content-Type a client sends on upload either — it is attacker-controlled. Determine the type server-side from the file's magic bytes, and validate it against an allow-list rather than a deny-list.

About

The MIME Types Reference lists all common IANA media types and their associated file extensions. Use it to find the correct Content-Type header for your API responses, file uploads, or web server configuration. Filter by category (Text, Application, Image, Audio, Video, Font) for quick lookup.

How to use

1 Search by file extension (e.g. ".pdf") or MIME type (e.g. "application/json").
2 Filter by category using the chip buttons at the top.
3 Click any row to copy the MIME type string.

What is a MIME type and where is it used?: A MIME type (Multipurpose Internet Mail Extensions) is a standard identifier that describes the format of a file or data stream. It is sent in the HTTP Content-Type header so browsers and clients know how to handle a response — whether to display it as HTML, parse it as JSON, play it as audio, or prompt a download. For example, application/json tells the client the body is JSON.
What MIME type should I use for a JSON API response?: Use application/json. This is the correct and universally expected Content-Type for JSON API responses. Some older APIs use text/plain or text/javascript, but these are incorrect — modern REST APIs and any API client expecting JSON should send and accept application/json.
What is the difference between application/octet-stream and a specific MIME type?: application/octet-stream is a generic binary type meaning "unknown file format." Browsers typically prompt a download for this type. Use a specific MIME type whenever possible (e.g. application/pdf for PDFs, image/png for PNGs) so browsers can handle the content appropriately. Use application/octet-stream only as a fallback when no specific type applies.

More in Reference & Data

HTTP Status Codes Every status code with its meaning, the RFC that defines it, and notes on when to use each rather than a near neighbour.HTML Entities Named and numeric character references with a live preview of each rendered glyph.Port Numbers Well-known and registered TCP/UDP ports with the service on each and its transport protocol.Unicode Explorer Search by code point, name or character, with the UTF-8, UTF-16 and HTML encodings of each shown.ASCII Table All 128 ASCII characters in decimal, hex, octal and binary, including the control characters.Regex Cheat Sheet Every metacharacter, quantifier, class and assertion with a worked example for each.

See all reference & data.