What Is a MIME Type? Media Types Explained

A MIME type (also called a media type) is a standardized two-part label such as text/html or application/json that tells software what kind of data a file or byte stream contains, so a program knows how to interpret, render, or process it. MIME types are the vocabulary the web uses to negotiate content: browsers, servers, email clients, and APIs all rely on them to decide whether a payload is a web page, an image, a script, or downloadable binary. The registry of official types is maintained by IANA, and understanding how they are structured saves you from a surprising number of rendering, upload, and security bugs.

Key takeaways

• A MIME type has the form type/subtype, optionally followed by parameters like ; charset=utf-8.
• Over HTTP the type travels in the Content-Type response header, and the client trusts that header over the file extension.
• Top-level types include text, image, audio, video, application, font, model, multipart, and message.
• Structured suffixes like +json and +xml describe the underlying syntax of a specialized type.
• Sending the wrong type causes downloads instead of rendering, broken scripts, or security holes; X-Content-Type-Options: nosniff hardens type handling.
• Use application/json (no charset) for JSON and application/octet-stream only as a last-resort binary fallback.

What does a MIME type look like?

Every MIME type is composed of a top-level type and a subtype joined by a forward slash. The type is a broad category; the subtype names the specific format within it.

type/subtype
text/html
image/png
application/json
application/vnd.ms-excel

An optional list of parameters can follow the subtype, each introduced by a semicolon and written as name=value. The most common parameter is charset, and structured payloads such as form uploads carry a boundary.

text/html; charset=utf-8
multipart/form-data; boundary=----WebKitFormBoundary7MA4

Type and subtype names are case-insensitive by convention, though lowercase is standard. Parameter values may be quoted when they contain special characters.

What are the top-level MIME types?

There is a small, fixed set of top-level types. The application type is the general bucket for any format that is not plain human-readable text, audio, video, or an image.

Where are MIME types actually used?

MIME types appear anywhere data crosses a boundary between systems:

• HTTP responses declare their body format with the Content-Type header, and requests use the same header to describe their body.
• Email, the original home of MIME, uses them to distinguish plain text parts, HTML parts, and attachments.
• HTML references them in attributes such as a stylesheet’s or script’s type, and in the accept attribute of file inputs.
• Content negotiation lets a client send an Accept header listing the types it prefers, so the server can return the best match.

Because the server chooses the Content-Type it sends, a correct HTTP client trusts the header rather than guessing from the URL’s extension.

What is the charset parameter and when do I need it?

The charset parameter names the character encoding of a text payload. It matters for any text/* type because bytes alone do not reveal how to decode characters.

Always specify charset=utf-8 for HTML, CSS, and plain text served over HTTP; omitting it can cause browsers to fall back to a legacy encoding and mangle non-ASCII characters. A frequent mistake is adding charset to application/json. JSON is defined as Unicode text and is expected to be UTF-8, so the charset parameter is unnecessary and technically not registered for that type.

What do the +json and +xml suffixes mean?

A structured syntax suffix, written after a plus sign, tells you the concrete syntax a specialized subtype is built on. This lets a generic parser handle a family of formats.

• application/ld+json is JSON-LD, which is parsed as JSON.
• application/vnd.api+json is the JSON:API format, still valid JSON.
• image/svg+xml is SVG, which is XML.

You may also see the vnd. tree for vendor-specific formats and the historical x- prefix for unregistered experimental types. New unregistered types are now discouraged in favor of the vnd. and prs. trees.

How does MIME sniffing work and why is nosniff important?

When a server sends a vague or missing Content-Type, browsers historically inspected the first bytes of the body to guess the real type. This behavior, called MIME sniffing, is a security risk: an attacker who can upload a file that a server serves as text/plain might get the browser to treat it as HTML or JavaScript and run it.

Send the header below on responses to disable sniffing so the browser honors your declared type exactly:

X-Content-Type-Options: nosniff

Combine this with an accurate Content-Type on every response, especially for user-uploaded content, which should be served with a safe, specific type and never with a guessed one.

What are the common MIME types I should memorize?

How do I set the right MIME type on a server?

Most web servers map file extensions to types using a configuration file, and static-file handlers set the header automatically. The pitfalls to watch for are:

1. Serving JavaScript or CSS as text/plain, which makes browsers refuse to execute or apply them.
2. Falling back to application/octet-stream for known formats, which triggers a download prompt.
3. Forgetting charset=utf-8 on text responses, corrupting non-ASCII characters.
4. Trusting a client-supplied type on uploads; always validate the bytes server-side rather than believing the declared type.

When you build an API, set the type explicitly for every response body so clients never have to guess. Correct, specific MIME types are one of the cheapest reliability and security wins available.

Frequently asked questions

Is MIME type the same as media type?

Yes. The term was originally coined for email (Multipurpose Internet Mail Extensions), but the modern registry maintained by IANA calls them media types. Developers use both names for the same type/subtype labels.

What MIME type should I use for JSON?

Use application/json. It has no charset parameter because JSON is always Unicode (UTF-8 by default per RFC 8259). Do not use text/json, which was never registered.

Why does my browser download a file instead of displaying it?

The server most likely sent an incorrect or generic MIME type such as application/octet-stream, or a Content-Disposition: attachment header. Fix the server’s Content-Type mapping for that file extension.

What is application/octet-stream?

It is the default catch-all type for arbitrary binary data when no more specific type is known. Browsers typically offer to download such responses rather than render them.

Does the file extension determine the MIME type?

Not over HTTP. The server chooses the Content-Type it sends; the extension is only a hint the server or OS uses to look up a type. Clients should trust the header, not the extension.

What does the nosniff header do?

X-Content-Type-Options: nosniff tells browsers to trust the declared Content-Type and not guess by inspecting the bytes, which blocks a class of content-type confusion attacks.

Can a MIME type have parameters?

Yes. Parameters follow the subtype after a semicolon, such as text/html; charset=utf-8 or multipart/form-data; boundary=xyz. They refine how the payload is interpreted.