Developer Tools8 min readUpdated: 2026-10-12

MIME Type (Media Type)

Definition

A MIME Type (Multipurpose Internet Mail Extensions), officially designated as a Media Type under RFC 6838, is a standardized two-part identifier sent in HTTP headers (Content-Type) that informs web browsers and operating systems how to interpret and render a file's binary contents.

MIME Type (Media Type): Technical Breakdown

Originally created in 1992 under RFC 1341 to extend email protocols beyond basic ASCII text to support binary file attachments, audio, and images, MIME types became the bedrock foundation of the World Wide Web. When a web server delivers an asset to a client over HTTP/HTTPS, it transmits a Content-Type header containing the MIME identifier (such as `image/webp` or `application/json`). Unlike traditional desktop operating systems (like Microsoft Windows) that rely heavily on file extensions (`.html`, `.jpg`, `.pdf`) to determine which application executes a file, web browsers rely strictly on the server's declared MIME type. Misconfigured MIME types cause browsers to display raw code instead of rendering pages or prompt unnecessary file download dialogs.

Key Technical Specifications

Governing Standard: IETF RFC 6838, RFC 2045, RFC 2046, managed by the Internet Assigned Numbers Authority (IANA).
Syntax Structure: `type/subtype; parameter=value` (e.g., `text/html; charset=UTF-8`).
Top-Level Media Types: Nine registered primary categories: `application`, `audio`, `font`, `example`, `image`, `message`, `model`, `multipart`, `text`, and `video`.
MIME Sniffing Vulnerability: Browsers historically attempted to guess types from binary file magic numbers ('sniffing'), introducing Cross-Site Scripting (XSS) risks mitigated today by `X-Content-Type-Options: nosniff`.
Default Character Set: Modern text subtypes default to UTF-8 encoding.

1. The Structural Anatomy of a Media Type

A MIME type is composed of three structural segments: ```http Content-Type: type / subtype ; parameter=value ``` 1. Top-Level Type: Represents the broad general category of data: • `text`: Human-readable text or source code (`text/html`, `text/css`, `text/plain`). • `image`: Visual bitmap or vector graphics (`image/jpeg`, `image/png`, `image/webp`, `image/svg+xml`). • `audio` / `video`: Audio or audiovisual multimedia streams (`audio/mpeg`, `video/mp4`). • `application`: Binary data or structured data interchange requiring programmatic parsing (`application/json`, `application/pdf`, `application/octet-stream`). • `multipart`: Messages composed of multiple distinct body parts (`multipart/form-data`). 2. Specific Subtype: The exact technical file format specification registered with IANA. 3. Optional Parameters: Additional metadata, most commonly character set declarations (`; charset=UTF-8`) or boundary delimiters.

2. Master Production MIME Type Reference Matrix

Standard MIME types encountered across modern web development stacks:

File Extension	Official IANA MIME Type	Top-Level Category	Gzip / Brotli Compressible	Primary Usage
.html / .htm	text/html	Text	Yes (Ultra high)	Web document markup
.css	text/css	Text	Yes (High)	Cascading style sheets
.js / .mjs	text/javascript	Text	Yes (High)	Client-side ECMAScript logic
.json	application/json	Application	Yes (High)	REST API payloads & config
.webp	image/webp	Image	No (Already compressed)	Modern web photographic graphics
.png	image/png	Image	No (Already compressed)	Lossless graphics with transparency
.jpg / .jpeg	image/jpeg	Image	No (Already compressed)	Standard photographic imagery
.svg	image/svg+xml	Image	Yes (XML text)	Scalable vector graphics & icons
.pdf	application/pdf	Application	Minimal	Electronic document delivery
.bin / raw	application/octet-stream	Application	Varies	Arbitrary unknown binary stream

3. Hardening Server Security Against MIME Sniffing

When a web server serves user-uploaded files with ambiguous or incorrect MIME types, malicious actors can upload an HTML/JavaScript payload masked as an image (e.g., `avatar.jpg`). If the browser 'sniffs' the payload and executes it as HTML, an attacker achieves Cross-Site Scripting (XSS). To prevent this attack, production servers MUST send the `X-Content-Type-Options` security header: ```http X-Content-Type-Options: nosniff ``` Example Cloudflare Workers / Next.js Edge Middleware implementation: ```typescript export function applySecurityHeaders(response: Response): Response { response.headers.set('X-Content-Type-Options', 'nosniff'); response.headers.set('X-Frame-Options', 'DENY'); response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin'); return response; } ```

MIME Type (Media Type) Misconceptions

❌ Myth: “Web browsers determine how to display a file based on its file extension (.jpg or .html).”

✅ Reality: False. Browsers prioritize the HTTP Content-Type response header. If a web server serves an HTML file with Content-Type: text/plain, the browser will display raw HTML tags instead of rendering the page.

❌ Myth: “JavaScript files should use application/javascript.”

✅ Reality: Outdated. While application/javascript was widely used historically, RFC 9239 officially designated text/javascript as the standard MIME type for JavaScript source code.

❌ Myth: “All image formats are binary and cannot be compressed with Gzip or Brotli.”

✅ Reality: Partially false. Raster images (JPEG, PNG, WebP) are already internally compressed. However, SVG images are image/svg+xml—plain text XML that benefits dramatically from Gzip or Brotli compression.

Tools for MIME Type (Media Type)

Apply this concept directly using our free client-side browser utilities:

Base64 Encoder / Decoder

Encode and decode text and data to/from Base64 safely.

URL Encoder / Decoder

Encode and decode URI strings and query parameters.

JSON Formatter & Validator

Beautify, validate, format, and minify JSON data with error detection.

WebP Converter

Convert images to lightweight modern WebP format.

MIME Type (Media Type) FAQs

What does application/octet-stream mean?

application/octet-stream is the default fallback MIME type for arbitrary binary data. It indicates that the server does not know the specific file type, prompting web browsers to download the file to the user's local disk rather than attempting to display it.

How do client file inputs (<input type='file'>) use MIME types?

The HTML accept attribute allows developers to filter selectable files using MIME types (e.g., accept='image/png, image/jpeg, image/webp'). The browser validates the file's type during operating system file picker selection.

Where are official MIME types registered?

Official media types are reviewed and cataloged by the Internet Assigned Numbers Authority (IANA). Organizations can also use unofficial vendor prefixes (vnd.) or experimental prefixes (x-) for custom proprietary formats.

Concepts for MIME Type (Media Type)

Base64 JSON URL WebP PNG

Guides for MIME Type (Media Type)

Guide