What is the correct MIME type for a CSV file?

text/csv. Excel often labels CSV exports as application/vnd.ms-excel instead, so an importer that only accepts text/csv will reject a perfectly valid file.

Is image/jpg a valid MIME type?

No. The registered type is image/jpeg. image/jpg does not exist, but some stacks silently accept it and others reject it, which makes it a common source of inconsistent bugs.

What does X-Content-Type-Options: nosniff change?

It stops the browser guessing a file type from its content. With nosniff set, a stylesheet served as text/plain is rejected outright instead of quietly working, and scripts with the wrong type are blocked.

Why is serving user-uploaded SVG dangerous?

SVG is XML and can contain a script element. Serving a user-supplied SVG as image/svg+xml from your own origin executes that script in your origin, which is stored cross-site scripting.

What is the difference between application/gzip and Content-Encoding: gzip?

application/gzip describes the content itself, a .gz file. Content-Encoding: gzip says the response was compressed in transit and the client should decompress it. Setting both makes the client decompress once too often.

Learning & reference

MIME types: the right Content-Type for every file

The Content-Type header decides whether a browser renders a file, downloads it, or refuses it outright. Here is the correct type for every common extension, and the mistakes that quietly break things.

What a MIME type actually controls

The Content-Type header decides whether the browser renders a file, downloads it, or refuses it. Get it wrong and a stylesheet is ignored, a script is blocked, or a PDF downloads instead of opening.

Render vs. download

application/octet-stream (or Content-Disposition: attachment) forces a download. A known type like application/pdf renders inline.

nosniff changes everything

With X-Content-Type-Options: nosniff the browser stops guessing. A stylesheet served as text/plain is then rejected outright rather than silently working.

It is client-supplied on upload

The Content-Type on a multipart upload comes from the browser and can be set to anything. Validate with a signature check, not this header.

Common types by extension

Extension	MIME type	Notes
`.txt`	`text/plain`	Add `; charset=utf-8` or browsers guess the encoding.
`.html .htm`	`text/html`
`.css`	`text/css`	Served as anything else, browsers refuse to apply it.
`.js .mjs`	`text/javascript`	The standard type. `application/javascript` is obsolete but still accepted.
`.json`	`application/json`	No charset parameter - JSON is always UTF-8.
`.xml`	`application/xml`	`text/xml` is legacy and treats it as text.
`.csv`	`text/csv`	Excel often mislabels these as `application/vnd.ms-excel`.
`.pdf`	`application/pdf`
`.png`	`image/png`
`.jpg .jpeg`	`image/jpeg`	Note: not `image/jpg` - that type does not exist.
`.gif`	`image/gif`
`.webp`	`image/webp`
`.svg`	`image/svg+xml`	Can contain scripts - never serve user SVG from your main origin.
`.ico`	`image/x-icon`	`image/vnd.microsoft.icon` is the registered name.
`.zip`	`application/zip`
`.gz`	`application/gzip`	Not `Content-Encoding: gzip` - that is a different thing.
`.tar`	`application/x-tar`
`.7z`	`application/x-7z-compressed`
`.mp3`	`audio/mpeg`	Not `audio/mp3`.
`.wav`	`audio/wav`
`.mp4`	`video/mp4`
`.webm`	`video/webm`
`.woff`	`font/woff`	Modern types are `font/*`; older ones used `application/font-woff`.
`.woff2`	`font/woff2`
`.ttf`	`font/ttf`
`.otf`	`font/otf`
`.docx`	`application/vnd.openxmlformats-officedocument.wordprocessingml.document`	The long OOXML types are a classic source of typos.
`.xlsx`	`application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`
`.pptx`	`application/vnd.openxmlformats-officedocument.presentationml.presentation`
`.doc`	`application/msword`	Legacy binary Office.
`.xls`	`application/vnd.ms-excel`
`.odt`	`application/vnd.oasis.opendocument.text`
`.epub`	`application/epub+zip`
`.wasm`	`application/wasm`	Must be exact or streaming compilation fails.
`(unknown)`	`application/octet-stream`	The safe default. Triggers a download rather than inline display.

The mistakes that bite

`image/jpg`

Does not exist. The registered type is image/jpeg; image/jpg is silently accepted by some stacks and rejected by others.

Missing charset

text/html without ; charset=utf-8 leaves the encoding to the browser - accented characters turn into mojibake.

gzip confusion

A .gz file is application/gzip content. Content-Encoding: gzip means "this response was compressed in transit" - set both and the client decompresses once too often.

SVG is executable

SVG can carry <script>. Serving user-uploaded SVG as image/svg+xml from your own origin is stored XSS.

CSV vs Excel

Excel labels CSV exports application/vnd.ms-excel. An importer that only accepts text/csv rejects a perfectly valid file.

OOXML typos

The Office types are ~70 characters long. One wrong character and the download is treated as an unknown binary.

See it live

The generator echoes any content type you ask for, so you can watch how a browser reacts.

Open the generator File signatures →

More from Learning

Guides and references for test data, file handling and AI evals. All free, no sign-up. See the full hub.

Synthetic data for AI evalsWhat you can download, what you build RAG test corpusDocuments with extraction traps JSONL for evalsThe format, and ten ways it breaks Mock API for agentsRecords, pagination, failures on demand Safe test dataReserved domains, IPs, numbers & cards Synthetic PIIFake people that reach nobody Test card numbersEvery brand, declines, 3D Secure Test phone numbersReserved US, UK and Australian ranges Reserved IP addressesDocumentation ranges and SSRF cases Example domains.test, .invalid, example.com, and traps QA test stringsUnicode, emoji, injection & edge cases Filename compatibilityWhat breaks across Windows, Mac & Linux File systemsPOSIX, NTFS, APFS, ext4, SMB, NFS, NAS File signaturesMagic numbers that identify every format Character encodingsUTF-8, UTF-16, BOM & normalization Upload validationThe checklist, with a file for each check HTTP status codesEvery code and when you actually see it Dates & timesISO 8601, epoch, Excel serials, DST HTTP headersContent-Type, Disposition, Range, CORS Regex cheat sheetSyntax, flags and ready-made patterns Generate files (CLI)Make test files on any OS Crypto & certificatesSSL/PEM, hashing, encryption Web app testingWhat to test, with a file for each case Desktop app testingPaths, names, encodings and saving Mobile app testingPickers, photos, flaky networks CLI testingArguments, pipes and exit codes Large file upload testingDefault limits, 413s and exact sizes 1 GB test file1 GB and 2 GB, with SHA-256 10 GB test fileMake one locally in seconds Download speed test files10 MB to 2 GB of random data