MIME Type Reference

MIME type categories

MIME types are grouped into eight top-level categories, and each one describes a different class of content that a browser or client knows how to interpret.¹ The category prefix in a MIME string tells you, at a glance, whether you are dealing with data, media, text, or a composite message.

Media and document types

application/ is the largest category, covering structured data, executables, archives, and API payload formats ranging from JSON and PDF to ZIP archives and WebAssembly. By contrast, audio/ and video/ cover time-based media: audio/mpeg, Opus, AAC, FLAC, and WAV are the most common audio containers, while MP4 with H.264 remains the most compatible web video format and WebM serves as the open alternative.

image/ covers still images and vector graphics, where AVIF and WebP offer the best compression for modern browsers and SVG (image/svg+xml) is the standard for scalable vector artwork. Because the image category spans both raster and vector formats, choosing the right MIME string matters when you are configuring server caching headers or setting up content negotiation for responsive image delivery. Serving an AVIF file as image/jpeg, for instance, causes some browsers to reject the decode entirely.

Fonts, models, text, and composites

For downloadable fonts, font/ is the category to check: WOFF2 (font/woff2) is the preferred format because it uses Brotli compression and is supported by all modern browsers,² while the older EOT format (application/vnd.ms-fontobject) is deprecated. Older registrations like application/font-woff and application/font-sfnt have also been moved into the font/ top-level type under RFC 8081, which reorganized font media types into their own category to avoid mixing them with generic application/ types.

The remaining categories serve more specialized roles. model/ covers 3D scene and geometry formats such as glTF, GLB, STL, and USDZ, while text/ groups human-readable formats with specific syntax like HTML, CSS, CSV, and Markdown. Finally, multipart/ covers composite messages: multipart/form-data is required for HTML file uploads,³ and multipart/byteranges appears in 206 Partial Content responses.⁴

Server configuration

Web servers ship with a built-in MIME type table that covers most common types, but you still need to add explicit configuration when serving newer formats such as WebAssembly, modern image formats like AVIF and WebP, WOFF2 fonts, and 3D assets like glTF. Without those entries, the server falls back to a generic Content-Type and the browser may refuse to handle the file correctly.

Nginx and Apache

In Nginx, you add or override entries with a types block placed inside http {} or server {}, and the snippet format shown in each detail panel is the exact directive to paste into that block.⁵ In Apache, the equivalent is the AddType directive, which works in httpd.conf, a virtual host config, or a per-directory .htaccess file.⁶ Both servers merge custom entries with their built-in table, so you only need to declare the types that are missing or that you want to override.

A concrete mapping ties the abstract rule to a real config line. The .wasm extension maps to application/wasm, the type IANA registers for WebAssembly binaries. Adding it to an Nginx types block looks like types { application/wasm wasm; } placed inside the http {} or server {} block covering your site. Apache's equivalent is a single line, AddType application/wasm .wasm, dropped into httpd.conf, a virtual host block, or a per-directory .htaccess file.

Caddy

For Caddy v1, the mime directive maps an extension to a MIME type directly inside the Caddyfile, which keeps the rule visible alongside the rest of your site configuration. The snippets shown for Caddy use this exact format,⁷ so you can paste them in without renaming variables or adjusting paths. Caddy v2 handles MIME types differently through its HTTP app configuration, but the snippets provided here target the v1 directive syntax that many existing deployments still rely on.

Deprecated types

Several MIME types have been formally superseded or aligned with newer registrations as the web platform has evolved. The most common cases you will encounter are application/javascript and application/ecmascript being replaced by text/javascript under RFC 9239,⁸ text/xml aligned as an alias for application/xml under RFC 7303,⁹ and image/x-icon replaced by image/vnd.microsoft.icon for favicon requests.

EOT fonts (application/vnd.ms-fontobject) are another deprecated family, and all browsers that once supported EOT now support WOFF2, so serving EOT adds no value for any modern user agent. Deprecated entries in this reference are marked with a yellow warning banner in the detail panel, and each one links to the spec that documents the recommended replacement so you can update your server configuration with confidence and avoid serving stale types to modern browsers.

MIME types and browser security

Browsers treat MIME types as part of their security model. WebAssembly binaries must arrive as application/wasm or the browser refuses to compile them, producing a hard error with no fallback.¹⁰ Web fonts loaded from a different origin require a matching MIME type together with a permissive Cross-Origin-Resource-Sharing header, or the browser silently rejects them and the page falls back to system fonts. Each of these restrictions exists to prevent content-type confusion attacks, where a file with one declared type is treated as another by the browser.¹¹ Scripts served without a recognized JavaScript MIME type will not execute when a strict Content Security Policy is in place.¹²

The X-Content-Type-Options: nosniff response header reinforces your declared MIME type. Without it, a browser may detect executable content inside a file and act on that detection regardless of what Content-Type says. Setting nosniff tells the browser to trust your declared type exactly. Combining a correct Content-Type with nosniff closes the gap between what you declare and what the browser assumes. CapyToolkit's server config snippets already include nosniff in the recommended directives for file types where this protection matters most.¹³