What is a MIME type?
A MIME type — formally a media type — is the label a server attaches to a response so the recipient knows how to handle the bytes. It travels in the Content-Type header as a type/subtype pair like text/html or image/webp. It matters more than it looks: browsers refuse to apply a stylesheet that is not sent as text/css, refuse to run a module that is not JavaScript, and will download rather than display anything labelled application/octet-stream. Because the label is the server's claim rather than something derived from the file, a mismatch between the extension and the header is a common and confusing source of bugs.
How to use this tool
- 1 Search by extension (webp), by type (application/json) or by keyword (font).
- 2 Filter by kind to browse just images, fonts, documents or archives.
- 3 Click the copy button to grab the exact type string — the Office ones are too long to retype safely.
- 4 Read the notes column for the traps, like .jpg being image/jpeg and .mp3 being audio/mpeg.
Frequently asked questions
Why is my CSS or JavaScript not loading?
Almost always the Content-Type. Browsers enforce strict MIME checking: a stylesheet served as text/plain is ignored, and a module script served as anything other than a JavaScript type is refused outright. Check the response header in DevTools rather than trusting the file extension.
Is the type for .js still application/javascript?
text/javascript is now the standard per the HTML spec, and it is what you should send. application/javascript is obsolete but still universally accepted, so existing configs are not broken — there is just no reason to prefer it in new ones.
What is application/octet-stream for?
It is the deliberate "unknown binary" fallback. Browsers never try to display it, so it always triggers a download. That makes it useful for forcing downloads, but a bad default for anything you want rendered — serving an image as octet-stream means it will never appear in an img tag.
Do I need a charset parameter?
For textual types, yes — text/html without charset=utf-8 leaves the browser guessing the encoding, which produces mojibake. JSON is the exception: application/json is defined as UTF-8, so adding a charset is meaningless and some parsers complain about it.
Why does my SVG upload get flagged as a security risk?
SVG is XML and can contain script elements and event handlers. When rendered inline it executes in your page's origin, so a user-uploaded SVG is a stored XSS vector. Either sanitise it server-side or serve it from a separate origin and only ever reference it via an img tag, which does not execute scripts.