RAR MIME Type – Free, Online, Private

What .rar is

RAR is a proprietary archive format. Version 5 files start with the eight bytes 52 61 72 21 1A 07 01 00. Version 4 files start with 52 61 72 21 1A 07 00. Both are Rar! followed by a control byte. IANA registers application/vnd.rar. application/x-rar-compressed is the unofficial value older servers sent. A multi-volume set is several files. The first volume uses this type, and the later volumes are parts of the same archive with their own URLs. The type does not say which volume you are holding. The signature and the volume header do.

IANA registers application/vnd.rar. The media type is application/vnd.rar. Extensions that use it on this page: .rar. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/vnd.rar

What sends application/vnd.rar: Send application/vnd.rar for a .rar download. Prefer this over the x- alias in new configuration. Set a filename. If you publish a multi-volume set, name the parts in a stable order and do not pretend each part is a complete archive. A client that receives part 2 with this type still needs part 1. Do not add a charset. Do not gzip the response and drop Content-Encoding. The archive is already compressed, and a missing encoding header corrupts it. The file on disk is still .rar. Once the response exists, a client trusts application/vnd.rar, not the filename. If you do not need RAR's features, ship ZIP or 7z for new downloads. ZIP is application/zip and is the format every client already opens. Keep application/vnd.rar for archives a publisher actually produced as RAR, not as a default.

Content-Type for .rar

Send application/vnd.rar and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/vnd.rar

nginx, Apache, and Express

These snippets map .rar to application/vnd.rar. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .rar so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/vnd.rar         rar;

ApacheAddType application/vnd.rar .rar

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".rar")) {
      res.setHeader("Content-Type", "application/vnd.rar");
    }
  },
}));

Pitfalls for application/vnd.rar

Pitfalls that show up for application/vnd.rar, and not for a neighboring type with a similar extension: Sending application/zip for a RAR file because your download route has one hard-coded type is the support ticket. Check the signature. Another trap is an old mime.types that sends application/x-rar-compressed while a new client allow-lists only application/vnd.rar. Update the server. Another is a RAR with an encrypted file list, which a scanner cannot inspect. If you accept uploads, decide whether you allow that before you store the bytes. Another is a volume named .rar that is actually part 3 and starts with the right signature. The user still cannot extract it alone.

• application/vnd.rar is the registered type. application/x-rar-compressed is unofficial.
• RAR 4 and RAR 5 share the type and not the full signature. Branch on the byte after 1A 07.
• A renamed RAR is still RAR. A renamed ZIP is not. Look at PK versus Rar!.
• The format is not an open specification you should implement badly. Call a maintained library to list members.