MIME Type Lookup

What a MIME type is

A MIME type, also called a media type or content type, tells software what kind of data it is handling. It has a type and a subtype separated by a slash, optionally followed by parameters:

Content-Type: text/html; charset=utf-8
              ^    ^     ^
              |    |     parameter
              |    subtype
              type: text, image, audio, video, font, application, multipart...

Types are registered with IANA under the procedures of RFC 6838. Subtypes starting with vnd. are vendor types, such as Microsoft Office formats, and x- marks old unregistered types, such as application/x-tar, that stayed in use. On the web the type travels in the Content-Type header, defined for HTTP in RFC 9110, and browsers act on it rather than on the file name in the URL.

Common MIME types

.pdf     application/pdf
.json    application/json
.js      text/javascript
.css     text/css
.html    text/html
.svg     image/svg+xml
.webp    image/webp
.woff2   font/woff2
.zip     application/zip
.csv     text/csv
.docx    application/vnd.openxmlformats-officedocument.wordprocessingml.document
.xlsx    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
.yaml    application/yaml
(unknown binary)  application/octet-stream

A few entries have a history worth knowing. JavaScript's official type is text/javascript again since RFC 9239, published in May 2022, which marked application/javascript as obsolete. YAML had no registered type until RFC 9512 registered application/yaml in February 2024. application/json defines no charset parameter, because JSON exchanged between systems must be UTF-8, so ; charset=utf-8 after it is harmless but has no effect on compliant parsers. And .ts maps to video/mp2t, an MPEG transport stream, not to TypeScript, which has no registered type; do not let an upload filter or web server treat one as the other.

multipart/form-data and form encoding

An HTML form without an enctype attribute sends its fields as application/x-www-form-urlencoded: name=Ada&city=London, with spaces and special characters percent-encoded. That format cannot carry files, so a form with a file input needs enctype="multipart/form-data" and method="post".

multipart/form-data, specified in RFC 7578, splits the body into parts separated by a boundary string that is declared in the header. Each part has its own Content-Disposition with the field name and, for files, the file name, and its own Content-Type:

Content-Type: multipart/form-data; boundary=----b7Xk2

------b7Xk2
Content-Disposition: form-data; name="title"

Quarterly report
------b7Xk2
Content-Disposition: form-data; name="file"; filename="report.pdf"
Content-Type: application/pdf

%PDF-1.7 ...
------b7Xk2--

The most common bug with it in JavaScript is setting the header by hand. When you send a FormData object with fetch, leave Content-Type out: the browser then writes multipart/form-data together with the boundary it generated. A hand-written header has no boundary, and the server cannot split the body.

const body = new FormData();
body.append('file', input.files[0]);
await fetch('/upload', { method: 'POST', body });   // no Content-Type header

Checking a file's real type

Check a file's type reads the first 16 bytes of the file you choose and shows four results side by side. By extension is the type from the table. Reported by browser is the file's File.type property. By content compares the first bytes with known signatures, often called magic bytes, and First bytes shows them in hexadecimal:

file                 by content          first bytes
favicon.png          image/png           89 50 4e 47 0d 0a 1a 0a
invoice.pdf          application/pdf     25 50 44 46 2d 31 2e 37   (%PDF-1.7)
fake.png             application/pdf     25 50 44 46 2d 31 2e 34   renamed PDF
report.docx          application/zip     50 4b 03 04 14 00 00 00   (PK)

The browser value deserves the least trust. As MDN documents, browsers do not read the file to determine File.type: it is derived from the extension and the operating system's settings, so a PNG renamed to .txt is reported as text/plain, and uncommon extensions give an empty string, which the tool shows as not reported. When the extension and the content disagree, the content is usually right.

What magic bytes can and cannot tell

The signature check recognises PDF, PNG, JPEG, GIF, WebP, WAV, MP4, gzip, ZIP, 7z, RAR, MP3 with an ID3 tag, Ogg, FLAC, WebAssembly, WebM and Matroska, WOFF and WOFF2. Three limits follow from how these formats are built:

Office files are ZIP archives. DOCX, XLSX and PPTX, like EPUB, JAR, APK and OpenDocument files, begin with the ZIP signature PK, so they are reported as application/zip. Telling them apart means opening the archive and looking at its contents, which is what libmagic, the library behind the Unix file command, does.

MP4-family files share one header. Every ISO base media file has an ftyp box at byte 4, followed by a four-character brand at byte 8, and the checker reads that brand: heic is reported as image/heic, avif as image/avif, qt as video/quicktime, M4A as audio/mp4, and generic brands such as isom as video/mp4. WebM and MKV share the Matroska (EBML) header, and the checker tells them apart by the document type string near the start of the file.

Text formats have no signature. For JSON, CSV, HTML, SVG and plain text, the By content row says that no signature matched and that the start of the file looks like text, which is as far as magic bytes can go; the extension decides the rest. An MP3 without an ID3 tag, or any binary format the checker does not know, is shown as having no known signature.

Validating uploads on the server

Never trust the Content-Type a client sends with an upload or the file name it gives; both are chosen by the client. Check the content on the server, allow only the types you need, and store files under names you generate yourself:

$ file --mime-type -b fake.png
application/pdf

// PHP (fileinfo extension)
mime_content_type($path);   // "application/vnd.openxmlformats-officedocument.wordprocessingml.document"

# Python: pip install python-magic
magic.from_file(path, mime=True)

When serving files, send the correct Content-Type together with X-Content-Type-Options: nosniff. That header stops browsers from guessing a type from the content, and makes them refuse scripts and stylesheets served with a type that is not JavaScript or text/css, which closes off attacks that upload a script disguised as an image.

Frequently asked questions

What is the MIME type for PDF?

application/pdf. PDF files also start with the bytes %PDF, which the file checker uses to recognise a PDF even when it has the wrong extension.

What is the MIME type for DOCX?

application/vnd.openxmlformats-officedocument.wordprocessingml.document. The older .doc format uses application/msword, and XLSX and PPTX have similar long vnd.openxmlformats types.

What Content-Type should I use for file uploads?

multipart/form-data, with a boundary parameter that separates the parts. When you send FormData with fetch, do not set the header yourself; the browser adds it with the correct boundary.

What is the difference between a MIME type and a content type?

They name the same value. MIME type comes from the email standard where the format was defined, media type is the official IANA term, and Content-Type is the HTTP header that carries it.

Why does my DOCX file show as application/zip?

DOCX, XLSX and PPTX files are ZIP archives and start with the same bytes as any ZIP file. The by-extension row shows the specific Office type, and server tools such as libmagic look inside the archive to confirm it.

Is my file uploaded when I check its type?

No. The browser reads only the first 16 bytes of the file locally, and nothing is sent to a server.