Header desk / media types
The Content-Type header decides what the browser does next.
111 media types with the parts a lookup table leaves out: whether the type executes in the page, whether a charset parameter belongs on it, whether compressing it helps, and the response headers that follow from all three.
Paste a header, not a guess
Drop an Accept header into the finder and it runs the RFC 9110 negotiation for you — every acceptable type, ranked by the weight that actually applies. Paste a Content-Type instead and it validates the parameters.
text/html,application/xml;q=0.9,*/*;q=0.8
What the browser does with the bytes
derived verdictExecutes in the page
Runs script in the origin that serves it. Never serve untrusted uploads under these types from an origin that holds sessions.
Renders inertly
Rendered in the tab but inert — the browser draws it without giving it access to the page.
Downloads
No browser renderer exists, so it saves to disk even when served inline. The quiet, safe default.
The registry by family
coverageApplication
52Text
12Image
13Audio
8Video
11Font
5Multipart
4Message
23D model
4How the names are structured
RFC 6838Standards tree
85Vendor tree
14Personal tree
0Unregistered tree
12A media type reads type/[tree.]subtype[+suffix]. The tree prefix says who owns the name — vnd. for a vendor, x- for something never registered. The suffix after a plus names the underlying serialisation, which is why any JSON parser can read application/problem+json without knowing what a problem document is. 14 types here carry one.
Every media type
type · extensionsApplication
The catch-all family: structured data, archives, documents, executables, and anything without a family of its own.
52Text
Human-readable payloads. Every one of them needs a charset parameter, and several execute in the browser.
12Image
Raster and vector graphics. All but one render inertly — SVG is the exception, and it matters.
13Audio
Sound, in containers that almost always compress internally already.
8Video
Moving pictures, where range requests and container layout decide whether playback feels instant.
11Font
Webfont and desktop font resources, fetched in CORS mode even from your own origin.
5Multipart
Bodies made of several parts, each with its own headers — form uploads and email.
4Message
A complete message carried as a payload, such as an email or an HTTP exchange.
23D model
Three-dimensional geometry and scenes.
4A Content-Type is a claim, not a fact
The header says how to interpret the bytes; it does not prove what they are. On an upload the value is supplied by the client and can say anything, which is why validation has to read the file signature instead. On a response the value is chosen by your server, and getting it wrong is how a stylesheet stops applying, a module script gets blocked, or an uploaded SVG runs script in your origin.
5 of the types here execute in the page. 49 are worth compressing in transit and the rest already compress internally. 14 have no file extension at all — they exist only as headers, so no server mime.types mapping will ever produce them. 3 are obsolete and named here so you can recognise them in old configuration.