Common MIME Types and File Extensions

What a MIME type is

A MIME type, which the IANA registry now calls a media type, has two parts separated by a slash: a type and a subtype, as in image/png. MDN lists the top-level types as application, audio, example, font, image, model, text and video, plus message and multipart for content made of several parts. An optional parameter can follow a semicolon:

Content-Type: text/html; charset=UTF-8

MIME types are case-insensitive, but written in lowercase by convention. Parameter values can be case-sensitive. The charset parameter says how text is encoded. When software reads UTF-8 bytes with the wrong encoding, é turns into é, as the UTF-8 guide shows.

The official list is the IANA Media Types registry, which MDN calls the source for all official types. It is long: on October 30, 2026 its application list alone had 1,823 entries.

Extensions and their types

These are the extensions from MDN's list of common types that a website is most likely to serve, each checked against the IANA registry:

Two of these are not in the IANA registry: video/webm, and audio/wav, which MDN lists for .wav files. Both appear in MDN's common types list, but on the day this guide was checked IANA had no entry for either. The guides on image formats and video formats cover when to use each format.

Types that trip people up

• JavaScript is text/javascript. The IANA registry marks application/javascript and application/ecmascript as obsoleted in favor of text/javascript, with RFC 9239 as the reference. Modules (.mjs) use the same type.
• XML has two types. MDN says application/xml is recommended, while text/xml is still used sometimes. Specific XML formats get their own, such as image/svg+xml for SVG and application/atom+xml for Atom feeds.
• Uploads can carry non-standard types. MDN notes that Windows uploads .zip files as application/x-zip-compressed, and Windows and macOS upload .gz files as application/x-gzip. An upload form that accepts only application/zip will reject them.
• Office documents have long names. A .docx file is application/vnd.openxmlformats-officedocument.wordprocessingml.document.

When the type is missing or unknown

MDN gives two defaults. text/plain is the default for text files: human-readable, no binary data. application/octet-stream is the default for everything else, and the right type for a file you cannot identify. MDN adds that browsers generally download a file served as application/octet-stream instead of displaying it, so a PDF served with that type usually downloads instead of opening in the browser.

When the type is missing or looks wrong, browsers may sniff: guess the type by looking at the bytes of the file. MDN warns that this has security implications, because some types are executable. A server stops it with one header:

X-Content-Type-Options: nosniff

With it, MDN says, the browser blocks a stylesheet not served as text/css, blocks a script not served with a JavaScript type, and never treats a response as HTML unless the header says so. Send it on every response. The HTTP header checker shows both the Content-Type and the X-Content-Type-Options a URL returns.

MIME types in requests

Content-Type is not only for responses. RFC 9110 defines it as the media type of whatever content the message carries, so a client that sends data labels it too. The RFC says a sender should include the header unless it does not know the type, and that a recipient without one may assume application/octet-stream or examine the data. Three request types come up all the time:

• application/x-www-form-urlencoded: the default for an HTML form sent with POST,, per MDN's form reference.
• multipart/form-data: what MDN says to use when the form contains a file input.
• application/json: the registered type for JSON, with RFC 8259 as its reference in the IANA registry, used for JSON request bodies.

The choice has a side effect in browsers. MDN's CORS guide lists only application/x-www-form-urlencoded, multipart/form-data and text/plain as content types for a simple cross-origin request. A fetch() that sends JSON to another origin therefore triggers a preflight, as the CORS guide explains. And a server that receives a format it does not accept can answer with 415 Unsupported Media Type, which RFC 9110 defines for content in a format the target resource does not support. The guide to HTTP methods covers which requests carry content at all.

MIME types inside data URIs

A data URI puts a whole file into a URL, and the MIME type goes at the front. MDN gives the syntax as data:[<media-type>][;base64],<data> and says the type defaults to text/plain;charset=US-ASCII when it is left out. So a small PNG icon becomes:

data:image/png;base64,iVBORw0KGgo...

Get the type wrong and the browser shows a broken image. The image to Base64 tool writes the type for you, and the Base64 encoder handles any other file. The cost is size. RFC 4648 encodes every 3 bytes as 4 characters, so a data URI is about a third larger than the file:

Keep data URIs for small icons. The encoding guide explains why Base64 hides nothing.

Checklist for a server

1. Map every extension you serve to its type, especially .js, .mjs, .json, .svg, .webp, .avif, .woff2 and .webmanifest.
2. Add charset=UTF-8 to text types such as HTML, CSS and plain text.
3. Send X-Content-Type-Options: nosniff on every response.
4. Use application/octet-stream only for files that should download.
5. On uploads, check the type and the file contents, and accept the common non-standard variants.
6. Check what your pages actually reference: the HTML formatter turns minified markup back into readable lines, so every script, stylesheet and icon link is easy to spot.

Frequently asked questions

Sources

• IANA: Media Types registry, last updated 2026-10-29 (media types formerly known as MIME types; every type in the tables checked against the application, audio, font, image, text and video lists; application/javascript and application/ecmascript obsoleted in favor of text/javascript; no entries for video/webm or audio/wav)
• MDN Web Docs: Common media types (the extension and MIME type list; text/plain and application/octet-stream as defaults; .js and .mjs as text/javascript; application/xml recommended for .xml; Windows uploads .zip as application/x-zip-compressed, Windows and macOS upload .gz as application/x-gzip)
• MDN Web Docs: MIME types (type/subtype with optional parameters such as charset=UTF-8; the top-level types; case-insensitive; browsers use the MIME type, not the extension; MIME sniffing; IANA is responsible for official types)
• RFC 9110, HTTP Semantics, sections 8.3 and 15.5.16 (Content-Type gives the media type of the content; a recipient without one may assume application/octet-stream or examine the data; MIME sniffing risks; 415 Unsupported Media Type)
• MDN Web Docs: the form element and CORS (application/x-www-form-urlencoded is the default form encoding, multipart/form-data for file uploads; only those two and text/plain allowed in a simple cross-origin request)
• MDN Web Docs: X-Content-Type-Options (nosniff blocks style and script responses with the wrong type and stops sniffing for other responses)
• MDN Web Docs: data: URLs (syntax data:[<media-type>][;base64],<data>; default text/plain;charset=US-ASCII)
• RFC 4648, Base-N Encodings, section 4 (Base64 represents 24-bit groups of input as 4 encoded characters)

Written by Tobias. Updated October 30, 2026.