MIME Types (Content-Type) Reference

Structure of a MIME type

A media type is type/subtype, optionally followed by parameters: text/html; charset=utf-8. The top-level types you'll meet are text, image, audio, video, font, application (anything that doesn't fit elsewhere) and the composite multipart and message. Subtypes carry structure hints via suffixes — +json, +xml, +zip — so a parser that knows JSON can handle application/ld+json without knowing JSON-LD. Prefixes signal registration trees: vnd. for vendor types (like the Office formats above) and the legacy x- for unregistered types that stuck around.

The charset parameter

For text/* types, charset tells the receiver how bytes map to characters: Content-Type: text/html; charset=utf-8. Omit it and clients guess — historically defaulting to Latin-1, which is where "é" instead of "é" comes from. Always send charset=utf-8 on HTML, CSS, plain text and CSV. JSON doesn't need it: application/json is defined as UTF-8 (RFC 8259), and the parameter has no meaning there — though sending it is harmless.

Multipart types

multipart/* types bundle several bodies into one message, separated by a boundary string declared in the header: Content-Type: multipart/form-data; boundary=----abc123. Each part has its own headers, including its own Content-Type. multipart/form-data is how browsers upload files; multipart/mixed and multipart/alternative structure email (attachments; plain-text + HTML versions); multipart/byteranges answers multi-range requests. When using fetch with a FormData body, don't set Content-Type yourself — the browser must generate the boundary, and a hand-written header without it breaks parsing.

application/octet-stream — the fallback

application/octet-stream means "arbitrary bytes, no promises" — the correct type when you genuinely don't know what a file is. Browsers respond by downloading instead of rendering, which also makes it a deliberate choice for forcing downloads (usually paired with Content-Disposition: attachment). But it's a bug when it leaks onto known types: images won't display inline, PDFs download instead of opening, and WebAssembly won't compile. If your server sends octet-stream for a known extension, its MIME map needs an entry.

Common Content-Type mistakes

Related: send X-Content-Type-Options: nosniff so browsers never second-guess your declared types — without it, MIME sniffing can turn a mislabeled upload into executed script.