PDF MIME Type – Free, Online, Private

What .pdf is

A PDF file starts with the bytes 25 50 44 46, which is %PDF-, followed by a version such as 1.7 or 2.0. The trailer and cross-reference table sit at the end, so a proxy that truncates the body produces a file viewers reject even though the header looked right. PDF is a binary container. It can hold text, fonts, images, and, in the full format, JavaScript actions. The media type does not say which PDF features are inside. RFC 8118 is the registration. There is no charset.

IANA registers application/pdf in RFC 8118. The media type is application/pdf. Extensions that use it on this page: .pdf. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/pdf

What sends application/pdf: Send application/pdf for a report, an invoice, or a static file. Browsers that have a viewer will render the body inline when Content-Disposition is inline or absent. Content-Disposition: attachment; filename="report.pdf" asks the browser to download it instead. Set the filename if the URL does not end in .pdf, because the viewer and the save dialog both use it. Do not send text/pdf or application/x-pdf. Those are not the registered type, and a strict client will download a file it could have shown. The file on disk is still .pdf. Once the response exists, a client trusts application/pdf, not the filename. nginx serves files ending in .pdf as application/pdf from the stock mime.types. A dynamic handler that streams a generated PDF must set the header itself. Put Content-Length on the response when you know the size so the viewer can show progress. If you generate the PDF on the way out, do not also run a middleware that sniffs the body and replaces the type.

Content-Type for .pdf

Send application/pdf and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/pdf

nginx, Apache, and Express

These snippets map .pdf to application/pdf. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .pdf so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/pdf             pdf;

ApacheAddType application/pdf .pdf

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".pdf")) {
      res.setHeader("Content-Type", "application/pdf");
    }
  },
}));

Pitfalls for application/pdf

Pitfalls that show up for application/pdf, and not for a neighboring type with a similar extension: Untrusted PDF is not a harmless preview. The format has a history of parser bugs, and some documents run JavaScript inside the viewer. If a user uploaded the file, prefer Content-Disposition: attachment and serve it from a host that does not share cookies with your application origin. A second failure is gzip. Content-Encoding: gzip is fine and the type stays application/pdf. Labeling the already-compressed file as application/gzip makes the viewer open a gzip archive. A third failure is caching a private invoice as a public static file because the extension looked static.

• Linearized PDF is still application/pdf. The type does not change because the file was arranged for byte-range reads.
• Range requests need Accept-Ranges: bytes and a 206 that is a slice, not a second full file. Viewers use ranges to jump inside a large PDF.
• A missing %PDF- header means the bytes are not a PDF, whatever the extension says. Check the magic before you set the type.
• application/octet-stream forces a download in most browsers. Use it only when you intend a download of an unknown file, not for a PDF you want shown.