This MIME type lookup cheat sheet covers 24 common registered media types and shows how to find the right base value by extension, format family, full MIME string, or plain-English description.
Use the reference when a response header, upload rule, test fixture, or configuration needs a precise media type. The interactive MIME Type Lookup keeps the format description, extension aliases, and registered value together so you can copy one exact string.
How to read a media type
A media type describes the nature and format of bytes. It normally contains a top-level type and subtype separated by a slash, such as image/png or application/json. The registered base value is distinct from any parameters added later in an HTTP header.
A filename extension is only an association, not proof of the content. A file named picture.png can contain bytes that are not PNG, and a browser-provided File.type can be empty, outdated, or based on the operating system’s extension mapping. The lookup can identify a registered value associated with a common format; it cannot establish what the bytes actually contain.
Common media types at a glance
This table highlights familiar mappings represented by the source-checked reference. It is a practical subset, not a complete list of every registered media type.
| Format | Common extension hints | Registered base type | Typical use |
|---|---|---|---|
| HTML | .html, .htm | text/html | HTML documents |
| CSS | .css | text/css | Stylesheets |
| JavaScript | .js, .mjs | text/javascript | Current web JavaScript |
| JSON | .json | application/json | JSON data |
| PNG | .png | image/png | PNG images |
| JPEG | .jpg, .jpeg | image/jpeg | JPEG images |
| SVG | .svg | image/svg+xml | SVG graphics |
| WOFF2 | .woff2 | font/woff2 | WOFF2 web fonts |
| XML | .xml | application/xml | General XML; specialized formats may differ |
| Gzip | .gz | application/gzip | Gzip-compressed data |
| Unknown binary | No extension assigned | application/octet-stream | Generic binary fallback |
The extension column provides quick recognition cues rather than guarantees. The complete lookup contains 24 curated entries and retains the available aliases beside each result. application/octet-stream is intentionally presented as a generic fallback without an invented extension.
Find and copy the exact base media type
- Open the MIME Type Lookup and enter an extension such as .json, a family such as image, a full base value such as font/woff2, or a format description.
- Review the matching plain-English description and extension aliases. Confirm that the format description fits the file or response instead of selecting an entry only because its name looks similar.
- Copy the exact base media type. The copy action includes only the media type, allowing it to be pasted directly into a Content-Type header, allowlist, test fixture, or configuration file.
- Validate the value against the real content, then test the actual response or upload path. The lookup does not open or inspect a file, so content validation must happen outside the reference.
Everything in the page runs locally. Search text is filtered in memory, copying uses the browser clipboard after a click, and no file is opened or uploaded. This makes the reference suitable for quickly finding a value without transferring a potentially sensitive file to a remote service.
Keep base types and HTTP parameters separate
A header may add parameters after the base type, such as Content-Type: text/html; charset=utf-8. The MIME Type Lookup intentionally returns only the registered base type. It does not construct the complete header or decide which parameters apply.
Charset declarations, multipart boundary parameters, codec parameters, content disposition, compression, transfer encoding, and content negotiation are separate concerns. Adding charset=utf-8 automatically is not a harmless universal default because the appropriate declaration depends on the format and the surrounding protocol.
Copy the base value first, then add only parameters required by your format or protocol contract. For multipart data, boundary construction belongs to the implementation that creates the body; it is outside this lookup’s scope.
Match the media type to its use case
The same media type can serve several development tasks, but the validation required after copying differs by context.
| Scenario | What the lookup provides | Check required afterward |
|---|---|---|
| Web response | The common registered base value for a format | Inspect the deployed response and apply parameters only when the relevant contract calls for them. |
| Upload allowlist | A candidate value for the formats you explicitly accept | Inspect the bytes and enforce size, parsing, storage, isolation, and authorization controls. |
| Test fixture | A copyable base type for a controlled test | Keep the fixture’s bytes and expected media type aligned. |
| Generated or proxied response | A verified candidate or controlled upstream value | Preserve the upstream type only when the upstream is controlled and verify the final response. |
A correct Content-Type helps browsers interpret responses and allows protections such as nosniff to work as intended. A wrong value can stop modules, stylesheets, fonts, media, or downloads from loading, and it can create unsafe content-sniffing behavior. Validate the header on the real deployed response rather than assuming a framework setting survived proxying, compression, or response generation.
Validate the bytes instead of trusting the extension
The lookup and a request header are reference signals, not security decisions. Secure upload handling must inspect the content and apply controls beyond media-type matching.
- Inspect the uploaded bytes to confirm their actual format.
- Enforce explicit size and format limits.
- Decode the content with a safe, maintained parser.
- Rename stored objects rather than preserving an untrusted filename as the object identity.
- Isolate stored content from execution.
- Apply authorization to every read, write, and download action.
Treat unknown content as untrusted binary data, and prefer an explicit allowlist over accepting every type in the lookup. application/octet-stream can describe generic binary data, but it does not reveal whether that data is safe to parse or execute.
Handle contextual mappings deliberately
JavaScript uses text/javascript
Current web specifications and IANA registration use text/javascript. Older values such as application or x-prefixed JavaScript types remain historical compatibility artifacts, so the current common mapping is the appropriate starting point for modern web delivery.
XML can have specialized subtypes
General XML may be served as application/xml, while specialized XML formats can have dedicated +xml subtypes. The correct value depends on the actual format and protocol contract rather than only on the .xml extension.
Gzip has a registered and a legacy label
A .gz file may be labeled with the registered application/gzip value or with a platform’s nonstandard x-gzip value. The reference presents application/gzip as one current common mapping instead of claiming that every server, desktop, registry, or historical browser uses the same label.
Know the reference’s scope and source trail
The registered names are based on the IANA Media Types Registry, with MDN’s common media types guidance used to cross-check practical filename associations. Eight independent fixtures lock familiar anchors including HTML, CSS, JavaScript, JSON, PNG, JPEG, SVG, and WOFF2.
This is deliberately a bounded reference rather than a mirror of the entire IANA registry. Vendor-specific office formats, multipart boundary construction, email transfer encodings, codec parameters, and obscure registered subtypes are outside its scope. Consult IANA when a required format is absent or when a protocol contract depends on the newest registration.
For a reliable result, locate the desired format, confirm that the content truly matches it, copy the registered base value, and test the final response or upload path. Registrations and implementation guidance can evolve independently, so recheck the primary registry for standards-sensitive work.
If you're weighing options, PX to REM Cheat Sheet: Formulas, Root Size, Examples covers this in detail.
If you're weighing options, Regex Cheat Sheet: Command Line vs Online covers this in detail.