MIME Type Lookup

A MIME type, officially a media type, is a label of the form type/subtype that tells software what kind of data it is handling. Web servers send it in the Content-Type header, e-mail uses it for attachments, and browsers rely on it, not on the file extension, to decide whether to show, play or download a file. Types are registered with IANA; those starting with x- or vnd. are unregistered or vendor-specific.

A wrong Content-Type causes real bugs. Browsers refuse to run scripts and stylesheets served with the wrong type when the X-Content-Type-Options: nosniff header is set, and WebAssembly only compiles quickly when served as application/wasm. Fonts with the wrong type may be blocked, SVG served as text/plain shows its code instead of the picture, and files sent as application/octet-stream are downloaded rather than displayed. If an upload form accepts files by MIME type, check the content too, because the browser's type comes only from the extension.

nginx reads types from its mime.types file; add missing ones in a types block. Apache uses AddType lines in its configuration or a .htaccess file. Cloud storage such as Amazon S3 or Cloudflare R2 stores a Content-Type for every object at upload, so set it correctly in your upload script. For text formats add charset=utf-8 so accented letters and symbols display correctly.

Many formats start with a fixed signature, sometimes called magic bytes: PNG files begin with the bytes 89 50 4E 47, PDF files with %PDF-, ZIP-based formats such as DOCX and XLSX with PK. The checker reads the first few kilobytes of the file in your browser and recognises the common image, audio, video, document and archive formats this way. Plain text formats such as CSV and JSON have no signature, so they are reported as text.

Never trust the type a browser sends with an upload: it is guessed from the file name, so anyone can upload a program renamed to photo.jpg. Servers should check the file content, store uploads outside the website folder or on a separate domain, and serve user files with the X-Content-Type-Options: nosniff header and, for anything that is not an image, a Content-Disposition: attachment header so it downloads instead of opening in the browser.