HTML document
Also seen as application/xhtml+xml
Serve with charset=utf-8. Without it the browser guesses, and a page of UTF-8 renders as mojibake.
HTML document
Cascading style sheet
JavaScript
Also seen as application/javascript · application/x-javascript
text/javascript is what the WHATWG specification requires. The application/ forms are historical and still widely seen.
JavaScript module
JSON
No charset parameter. JSON is defined as UTF-8, so adding one is redundant and technically invalid.
JSON-LD
Structured data. Must NOT be served as application/json if you want it treated as linked data.
XML
Also seen as text/xml
text/xml defaults to US-ASCII when no charset is given, which is almost never what is meant. Prefer application/xml.
Comma-separated values
Plain text
Markdown
SVG vector image
An image and a document at once. It can carry script, so never serve an uploaded SVG from your own origin.
PNG image
JPEG image
The type is image/jpeg for both .jpg and .jpeg. There is no image/jpg.
JPEG image
GIF image
WebP image
AVIF image
Icon
Also seen as image/vnd.microsoft.icon
image/x-icon carries a deprecated x- prefix and is nonetheless what every browser expects.
Bitmap image
TIFF image
HEIC image
What an iPhone produces by default. Browser support is still thin.
MP3 audio
audio/mpeg, not audio/mp3 — which is not a registered type.
WAV audio
Ogg audio
MPEG-4 audio
MPEG-4 video
WebM video
QuickTime video
AVI video
PDF document
Word document (legacy)
Word document
The long Office types are correct and are routinely truncated by hand. Copy them rather than typing them.
Excel workbook (legacy)
Excel workbook
PowerPoint (legacy)
PowerPoint
Rich text
WOFF font
WOFF2 font
font/woff2, not application/font-woff2. The font/ tree was registered in RFC 8081 and supersedes the older forms.
TrueType font
OpenType font
ZIP archive
Gzip archive
Tar archive
7-Zip archive
RAR archive
Arbitrary binary
The fallback for anything unknown. Browsers download it rather than trying to render it, which is usually the safe choice.
WebAssembly module
Must be served with this exact type — streaming compilation refuses anything else.
One thing causes most of the trouble: a missing charset. text/html with no charset leaves the browser to guess the encoding — and its guess is often not UTF-8. That is where accented characters and the peso sign turn into rubbish.
But not everything needs one. JSON is defined as UTF-8 by its own specification, so adding a charset there is redundant. This page marks which types need one rather than telling you to always add it.
And the reverse lookup is not a function. Extension to type has one right answer — but image/jpeg is .jpg and .jpeg. This returns all of them rather than picking one and appearing authoritative about it.
Almost certainly a missing charset. text/html with no charset parameter leaves the browser to guess the encoding, and its guess is often not UTF-8 — so accented characters and the peso sign come out as mojibake. Serve text/html; charset=utf-8. The same applies to text/css, text/csv and text/plain.
No. JSON is defined as UTF-8 by its own specification, so a charset parameter is redundant and technically not permitted on that type. The rule is not “always add a charset” — it is “add one where the type would otherwise be ambiguous”, which is why this page marks the types that need it.
image/jpeg, always — for both the .jpg and .jpeg extensions. There is no registered type called image/jpg, though it is written by hand constantly. The same trap catches audio: it is audio/mpeg, not audio/mp3.
Because the mapping is not a function in that direction. image/jpeg is both .jpg and .jpeg; image/tiff is .tif and .tiff. Going from an extension to a type has one right answer, but going back has several, so this page returns all of them rather than picking one and appearing authoritative about it.
application/octet-stream. Browsers download it rather than trying to render it, which is the safe default — the dangerous failure is serving unknown content as something a browser will execute or display. Never guess a type from user-supplied input.
Because an SVG is a document as well as an image. It can carry script, and if it is served from your own origin that script runs with your site’s privileges. Serve user-supplied SVGs from a separate origin, or convert them to a raster format. This site has no upload path at all, which is the simplest version of the same answer.
RFC 6648 deprecated it in 2012 — the idea that experimental types should be marked turned out to cause more churn than it prevented. A few x- types are now permanently fixed in other specifications and will never change, notably application/x-www-form-urlencoded, which is written into HTML itself. Those are listed here as the canonical form, because correcting them to something no server accepts would be worse than useless.
The first two are written by hand every day and were never registered.
Serve application/octet-stream. Browsers download it rather than trying to render it, which is the safe default. The dangerous failure is serving unknown content as something a browser will execute or display — so never guess a type from user-supplied input.
Based on the IANA media types registry and the mappings browsers and web servers actually use. Where the registry and common practice differ, the form browsers require is listed as canonical and the other as an alias. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
