ICO MIME Type – Free, Online, Private

What .ico is

A classic ICO file starts with the reserved word 00 00, the type 01 00, and a count of images. Each directory entry points at a bitmap, and modern ICO files embed PNG payloads for the larger sizes. A favicon can also be a plain PNG served with a different type. This page is the .ico container. Browsers have accepted image/x-icon for favicons for decades. The registered type is image/vnd.microsoft.icon. Sending either works in current browsers for a favicon link. Sending image/vnd.microsoft.icon is the value that matches the registry.

IANA registers image/vnd.microsoft.icon. image/x-icon is the legacy value servers still send. The media type is image/vnd.microsoft.icon. Extensions that use it on this page: .ico. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends image/vnd.microsoft.icon

What sends image/vnd.microsoft.icon: The historical URL /favicon.ico is fetched by browsers whether or not the HTML asks for it. That response should be image/vnd.microsoft.icon or image/x-icon, with a long cache lifetime, because the browser will request it on every origin it visits. A link rel=icon can point at a PNG instead, and that response is image/png. Do not label the PNG as an icon type. Do not label the ICO as image/png, or a strict decoder walks into the ICO directory thinking it is a PNG signature. The file on disk is still .ico. Once the response exists, a client trusts image/vnd.microsoft.icon, not the filename. Put the icon on the same origin as the page. A cross-origin favicon is a privacy and reliability problem, and some browsers simply do not show it. The type does not change because of the origin. The request does. If you also ship a web app manifest, the manifest icons are PNG or SVG with their own types. The manifest itself is application/manifest+json.

Content-Type for .ico

Send image/vnd.microsoft.icon and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: image/vnd.microsoft.icon

nginx, Apache, and Express

These snippets map .ico to image/vnd.microsoft.icon. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .ico so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
image/vnd.microsoft.icon    ico;

ApacheAddType image/vnd.microsoft.icon .ico

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".ico")) {
      res.setHeader("Content-Type", "image/vnd.microsoft.icon");
    }
  },
}));

Pitfalls for image/vnd.microsoft.icon

Pitfalls that show up for image/vnd.microsoft.icon, and not for a neighboring type with a similar extension: A framework that mounts a SPA fallback on every unknown path returns index.html, as text/html, for /favicon.ico. The tab icon breaks and the HTML document gets cached as the icon. Exclude that path from the fallback. A second trap is a 200-byte empty ICO that is valid enough to cache and wrong enough to look blank. Ship at least a 16 and a 32 pixel image. A third is blocking the path in a security rule that denies unknown extensions, which produces a 403 that browsers cache stubbornly.

• CUR files are a sibling of ICO with type 02 00 in the header. They are not what you want for a favicon.
• image/x-icon is widely tolerated and is not the IANA registration. Prefer image/vnd.microsoft.icon for new configuration.
• An ICO that only contains a 256-pixel PNG still needs the ICO directory. A bare PNG is a different file.
• Do not gzip-encode and then forget Content-Encoding. A favicon parser is not a general HTTP stack in every client.