EXE MIME Type – Free, Online, Private

What .exe is

A Windows executable or DLL in the portable executable family starts with the letters MZ. A DOS stub follows, then the PE header at an offset given in the stub. IANA registers application/vnd.microsoft.portable-executable. Browsers do not execute this type. They download it. That is the behavior you want. application/octet-stream also downloads, and it loses the information that this is a PE file rather than an arbitrary blob. application/x-msdownload is an unofficial alias still found in old maps. Send the registered type for a .exe you intend someone to download. A .dll you serve for a diagnostic dump can use the same type because it is the same container.

IANA registers application/vnd.microsoft.portable-executable. The media type is application/vnd.microsoft.portable-executable. Extensions that use it on this page: .exe. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/vnd.microsoft.portable-executable

What sends application/vnd.microsoft.portable-executable: Send application/vnd.microsoft.portable-executable with Content-Disposition: attachment and a filename. Serve it only over HTTPS, from a host you intend people to trust, with a checksum published on a page you control. The media type is not a signature. Authenticode is inside the file and a verifier has to check it. Do not add a charset. Do not open the file in the browser. There is no useful inline rendering. If the URL is guessable, a download is still a download of whatever bytes you put there. Put the version in the path. The file on disk is still .exe. Once the response exists, a client trusts application/vnd.microsoft.portable-executable, not the filename. Publish a hash next to the link. The Content-Type will be the same for a build you shipped and a build someone swapped in if your storage is writable. The hash, and a signature, are the checks. This page only gets the header right.

Content-Type for .exe

Send application/vnd.microsoft.portable-executable and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/vnd.microsoft.portable-executable

nginx, Apache, and Express

These snippets map .exe to application/vnd.microsoft.portable-executable. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .exe so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/vnd.microsoft.portable-executable  exe;

ApacheAddType application/vnd.microsoft.portable-executable .exe

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".exe")) {
      res.setHeader("Content-Type", "application/vnd.microsoft.portable-executable");
    }
  },
}));

Pitfalls for application/vnd.microsoft.portable-executable

Pitfalls that show up for application/vnd.microsoft.portable-executable, and not for a neighboring type with a similar extension: The dangerous configuration is an upload form that stores a user PE and serves it from your origin with a type a browser will save and a filename of a tool people already trust. Host untrusted binaries somewhere else, or do not host them. Another bug is a CDN that sniffs MZ and blocks the response, which is a policy choice, while your installer URL silently 403s. Watch the status. Another is a truncated PE that starts with MZ and has a PE offset past the end of the body. Another is sending text/html for a 'download page' at the URL your installer documentation called the file URL. The file URL has to return the bytes.

• The registered type is application/vnd.microsoft.portable-executable. application/x-msdownload is unofficial.
• MZ is the signature. A file that starts with PK is a ZIP, even if it is named .exe. Self-extracting archives exist and need a decision, not a guess.
• Content-Disposition: attachment asks for a download. The type already implies one in browsers.
• A DLL and an EXE share the PE container. The extension is how you tell humans which it is.