WASM MIME Type – Free, Online, Private

What .wasm is

A WebAssembly module starts with the magic bytes 00 61 73 6D, which are a null byte and asm, then a version, currently 01 00 00 00. Sections follow: types, imports, functions, code, and optionally a name section. The registered type is application/wasm. WebAssembly.instantiateStreaming and compileStreaming require that exact type and reject the module if the server sends application/octet-stream or text/plain. The non-streaming APIs will compile a buffer you already fetched, which hides the bug until you switch to streaming. There is no charset. The module is binary. The text form, WAT, is a different file and is not this type.

IANA registers application/wasm. The media type is application/wasm. Extensions that use it on this page: .wasm. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/wasm

What sends application/wasm: Send application/wasm for a .wasm file. If the module is loaded cross-origin, you also need CORS headers or the streaming compile cannot read the body. Cross-origin isolation for threads is a separate pair of headers, COOP and COEP, on the document. The module type does not grant shared memory. Cache a fingerprinted module for a long time. Do not cache a module URL that changes contents without changing the path, or clients will run the old code and the type will still be correct. The file on disk is still .wasm. Once the response exists, a client trusts application/wasm, not the filename. Compile on the server or in CI. A response that generates wasm by calling a compiler on every request will time out and return an HTML error page with the wrong type. Put the bytes on disk and serve them.

Content-Type for .wasm

Send application/wasm and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/wasm

nginx, Apache, and Express

These snippets map .wasm to application/wasm. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .wasm so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/wasm            wasm;

ApacheAddType application/wasm .wasm

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".wasm")) {
      res.setHeader("Content-Type", "application/wasm");
    }
  },
}));

Pitfalls for application/wasm

Pitfalls that show up for application/wasm, and not for a neighboring type with a similar extension: The incident is a new static host with no wasm mapping. The file downloads or the streaming compile throws a type error. Add the mapping. A second incident is a CDN that compresses the module and stores it without Content-Encoding, so the magic is no longer at byte zero. Brotli or gzip is fine with the encoding header set and the type left as application/wasm. A third is serving a WAT text file as application/wasm. It starts with a parenthesis, not 00 61 73 6D. A fourth is an HTML fallback, text/html, on a missing module URL. The streaming API rejects it. Your logs should show the 200 HTML as the bug, not a bad module.

• application/wasm is required for instantiateStreaming. application/octet-stream is not a polite alias.
• The magic is 00 61 73 6D. A UTF-8 BOM in front of it breaks the check.
• A .wasm file of JavaScript is a misnamed file. Do not send this type for source text.
• Shared-memory modules need the right document headers. The media type does not enable them.