Common MIME types
Servers and upload forms rely on these strings; a wrong type can break previews, downloads, or your Content Security Policy.
| Kind | MIME type | Typical ext |
|---|---|---|
| HTML | text/html | .html |
| CSS | text/css | .css |
| JavaScript | text/javascript | .js |
| JSON | application/json | .json |
| XML | application/xml | .xml |
| Plain text | text/plain | .txt |
| CSV | text/csv | .csv |
| application/pdf | ||
| ZIP | application/zip | .zip |
| PNG | image/png | .png |
| JPEG | image/jpeg | .jpg |
| GIF | image/gif | .gif |
| WebP | image/webp | .webp |
| SVG | image/svg+xml | .svg |
| ICO | image/x-icon | .ico |
| MP3 | audio/mpeg | .mp3 |
| WAV | audio/wav | .wav |
| MP4 | video/mp4 | .mp4 |
| WebM | video/webm | .webm |
| WOFF2 | font/woff2 | .woff2 |
| Form URL-encoded | application/x-www-form-urlencoded | — |
| Multipart form | multipart/form-data | — |
Notes
- Some browsers sniff content; still send the correct type from your server.
- Official JS type is text/javascript (application/javascript is obsolete).
What the MIME type actually controls
A MIME type is the label a server attaches to a response telling the browser what the bytes are. text/html renders a page, application/pdf opens a reader, image/svg+xml can be drawn inline, and application/octet-stream triggers a download prompt. Two files that look identical can behave completely differently based on this one header. Browsers, upload forms, email clients and content-security rules all read it, so getting it wrong is a common cause of broken previews, forced downloads and blocked scripts.
Where text/ and application/ apply today
Older advice said JavaScript was application/javascript; the current standard is text/javascript and application/javascript is obsolete. CSS is text/css, HTML is text/html, plain text is text/plain and CSV is text/csv — all text/* because they were designed to be human-readable. Structured formats are application/*: application/json, application/xml, application/pdf, application/zip. The notable exception is SVG, which is XML but must be served as image/svg+xml so browsers render it rather than download it.
Wrong types break uploads and security
A mislabelled upload is a classic source of bugs: a JSON file served as text/plain may be refused by an API client, an image returned as octet-stream downloads instead of displaying, and a script served as text/html is blocked by the browser. Strict Content-Security-Policy rules key on MIME type, so a stylesheet served with the wrong type can be refused outright. When a preview or download behaves strangely, checking the response's Content-Type is usually the fastest diagnosis.
Charset and content sniffing
For text types, pair the MIME type with a charset — text/html; charset=utf-8 and application/json; charset=utf-8 are the safe defaults for anything multilingual. Older browsers used content sniffing to guess a type from the file's bytes, which attackers exploited; sending X-Content-Type-Options: nosniff tells browsers to trust the declared type instead. Always send an explicit, correct Content-Type rather than relying on the file extension, which the browser never sees.
Setting types on the server and in forms
Where the type comes from matters. Static hosts map extensions automatically, but web frameworks often need it set explicitly — in Express with res.type('json'), in Nginx through the types block, and on Cloudflare Pages via headers or the file extension. HTML forms use enctype to control upload encoding: multipart/form-data for files and application/x-www-form-urlencoded for plain fields, while an API expecting JSON sends application/json. Sending the wrong one is a quiet source of 415 Unsupported Media Type and 400 responses that look mysterious until you inspect the request header.
Other families worth recognising
Beyond the everyday web formats, a few families are worth recognising. Fonts use font/woff2 and font/ttf. Images split by format — image/jpeg, image/png, image/webp, image/avif, image/gif — while audio and video use audio/mpeg, audio/ogg, video/mp4 and video/webm. Archives and binary blobs are application/zip, application/gzip and application/octet-stream. When an API returns a file it cannot identify, octet-stream is the honest answer: it forces the client to download rather than guess, which is exactly the behaviour you want when the contents are unknown.
Frequently asked questions
- What MIME type should I use for a .json file?
- Use application/json for JSON files and API responses. It is the standard type and should be served with charset UTF-8 where possible.
- What is the MIME type for .js files?
- The official type for JavaScript is text/javascript. The older application/javascript is obsolete and should no longer be used.
- What MIME type does an SVG image use?
- SVG files use image/svg+xml. Make sure you serve them as SVG, not as image/xml, or browsers will not render them inline.