How do you use this tool?
- Use the search field — enter an extension (`.webp`), a MIME (`image/webp`), or a keyword.
- Drag a file onto the drop zone — the first 32 bytes are read locally and matched against the magic-byte table.
- If filename and bytes disagree, a mismatch warning appears — bytes are authoritative.
- Category pills filter by application/image/audio/video/font/model/text. IANA and modern toggles narrow further.
- Copy the server config for your stack — Apache `mime.types`, nginx `types { }`, IIS `web.config`, Express middleware, or Cloudflare Worker.
What does the MIME type finder do?
The finder is a bidirectional lookup tool plus magic-byte detector for MIME types.
You search for a file extension (.webp, .heic, .wasm) and get the canonical MIME plus alias list,
or you enter a MIME (image/webp, application/wasm) and see the associated extensions with a “canonical
first” marker. Both directions live in one search field because the most common question is one of
those two: “what Content-Type for .webp?” or “which extension comes out of audio/ogg?”.
Per entry the tool shows: IANA status (registered or deprecated alias), canonical and alternate extensions, a one-sentence format description, optional browser support for modern codecs (AVIF, HEIC, JXL, WOFF2, WebAssembly), and the magic-byte signature used for detection.
How does magic-byte detection work?
Drag a file onto the drop zone — the first 32 to 64 bytes are read locally via FileReader
and matched against the signature table. JPEG identifies itself with FF D8 FF at byte 0, PNG with
89 50 4E 47 0D 0A 1A 0A, PDF with 25 50 44 46 (ASCII “%PDF”), WebAssembly with 00 61 73 6D.
Container formats like HEIC, AVIF, and MP4 use ISO Base Media boxes with the ftyp marker at byte 4 —
the brand string after it (heic, avif, isom, mp42) decides which concrete variant is present.
The drop is authoritative: if the filename says .jpg but the bytes say 89 50 4E 47, a mismatch
warning appears. Bytes never lie — a file can be renamed at any time. This is the only reliable way to
check a MIME type for upload validation when the User-Agent headers are not trustworthy.
What’s the difference between IANA-registered and x- aliases?
IANA-registered MIME types live in the official Media Types Registry
and are formally standardised via RFC 6838. The vnd. prefix
marks vendor-specific codes (e.g. application/vnd.ms-excel for .xls) that map to a specific vendor.
The x- prefix used to mean “experimental” but was declared an anti-pattern in 2012 by RFC 6648:
new codes should be registered directly, not introduced as x-.
In practice some duplicates remain in 2026: image/x-icon (legacy, browser-tolerated) vs
image/vnd.microsoft.icon (IANA-registered since 2003), or application/x-rar-compressed (deprecated)
vs application/vnd.rar (IANA since 2014). The tool’s IANA-registered only toggle hides the x-
aliases so new server configs use the modern codes. Existing servers should accept both — browsers
historically often send the legacy prefix.
Which modern formats does the finder cover in 2026?
The database knows the important new codecs of the last few years, including browser support data sourced from Can I Use:
- Image: AVIF (
image/avif, AV1-based, Chrome 85+/Firefox 93+/Safari 16+), HEIC (image/heic, HEVC-based, Safari 17+), JXL (image/jxl, royalty-free, Firefox 111+/Safari 17+), WebP (image/webp, ubiquitous). - Audio: Opus (
audio/opus, low-latency, RFC 6716), FLAC (audio/flac). - Video: AV1 (
video/av1, royalty-free, Chrome 70+/Firefox 67+/Safari 17+), WebM container. - Font: WOFF2 (
font/woff2, Brotli-compressed, the canonical web font since 2018). - Application: WebAssembly (
application/wasm, mandatory for streaming compilation), Web App Manifest (application/manifest+json, mandatory for PWA install banners), JSON-LD (application/ld+json, schema.org structured data), Zstandard (application/zstd, IANA 2018). - 3D model: glTF binary (
model/gltf-binary, single-file 3D asset for WebGL/three.js).
The “modern formats only” toggle filters down to these 2018-2026 additions — useful when wiring up a modern static-asset server that doesn’t need to know about the older DCT/RGB/indexed formats.
Which server configs can the finder export?
Five targets, all generated from the current filter selection:
- Apache
mime.types— one-MIME-per-line format with space-separated extensions. Drop directly into the server config. - nginx
types { }— block forhttp {}orserver {}context with correct semicolons. - IIS
web.config—<staticContent>XML with<mimeMap>elements for each extension/MIME pair. - Express/Koa middleware — JavaScript snippet with a
MIME_BY_EXTmap and asetHeadersfunction that plugs intoexpress.staticoptions. - Cloudflare Worker — default
fetchhandler that rewrites theContent-Typeresponse header based on the URL extension — useful when the origin emits the wrong MIME.
Workflow: set category + IANA + modern filters, then pick an export tab. The tool shows the snippet
live, the copy button puts it on the clipboard, the download button saves it with the server-typical
filename (mime.types, web.config, mime.types.conf, .js).
Which magic-byte signatures does the finder recognise?
More than 40 format signatures, grouped by complexity:
- Trivial (1-4 bytes at offset 0): JPEG (
FF D8 FF), PNG (89 50 4E 47 0D 0A 1A 0A), GIF (47 49 46 38 37 61or…39 61), PDF (25 50 44 46), ZIP/OOXML (50 4B 03 04), 7z (37 7A BC AF 27 1C), Gzip (1F 8B), bzip2 (42 5A 68), Zstandard (28 B5 2F FD). - RIFF containers (with wildcard bytes for size): WebP (
RIFF????WEBP), WAV (RIFF????WAVE), AVI (RIFF????AVI). - ISO Base Media boxes (at offset 4 after size prefix): MP4 (
ftypisom,ftypMSNV,ftypmp42), HEIC (ftypheic,ftypheix,ftypmif1), AVIF (ftypavif), QuickTime (ftypqt), 3GPP (ftyp3gp4). - WebAssembly:
00 61 73 6Dplus a 4-byte version field. - Font containers: WOFF (
wOFF), WOFF2 (wOF2), TrueType (00 01 00 00), OpenType (OTTO), font collection (ttcf). - Legacy Office: OLE Compound (
D0 CF 11 E0 A1 B1 1A E1) for.doc/.xls/.ppt/.msi. - Archives: RAR v4 (
52 61 72 21 1A 07 00), RAR v5 (52 61 72 21 1A 07 01 00), Debian (!<arch>), RPM (ED AB EE DB).
The wildcard syntax ?? lets variable bytes sit inside a signature — for RIFF containers that’s
the 4-byte size field that differs per file. Same notation as in the PHP finfo magic database
and the Unix file(1) tool.
How private is the byte detection?
Pure-client from start to finish. The complete MIME database is embedded in the JavaScript bundle
(under 50 KB minified), search and filter logic runs on the main thread. On file drop the
FileReader API reads the first 32-64
bytes into a Uint8Array in RAM — the file itself is not further touched, reading happens client-side,
no bytes leave the browser. To verify: open F12, the Network tab, drop a file — no additional requests
appear.
The server config export is also pure-JS: selected entries are formatted into string snippets, the copy button uses the Clipboard API, the download button creates a Blob object URL. No backend, no login, no telemetry pixel.
Last updated: