ZIP MIME Type – Free, Online, Private

What .zip is

A ZIP file is a sequence of local file headers and a central directory at the end. The local header magic is PK, the bytes 50 4B 03 04. An empty archive can start with PK 05 06. The central directory is what makes a ZIP seekable. A tool that only reads the local headers will still extract, and a tool that was handed a truncated body will fail when the directory is missing. The registered type is application/zip. JAR, DOCX, XLSX, PPTX, EPUB, and APK are ZIP containers with their own media types. If you know the more specific type, send it. application/zip is for a generic archive.

IANA registers application/zip. The media type is application/zip. Extensions that use it on this page: .zip. A client compares the type, not the filename, once the response has arrived. The filename still matters on disk and in Content-Disposition, which is why a wrong extension and a wrong header are two different bugs.

What sends application/zip

What sends application/zip: Send application/zip for a .zip download. Set a filename in Content-Disposition. Do not also set Content-Encoding: gzip unless you really compressed the ZIP again, which is usually pointless because the members are already compressed. A double-compressed response that loses the Content-Encoding header downloads as a corrupt ZIP. Range requests let a client fetch the central directory at the end without the whole file. Enable them for large archives. Do not add a charset. The file on disk is still .zip. Once the response exists, a client trusts application/zip, not the filename. If you generate a ZIP on the fly, you can write the local headers as you go and the central directory at the end, which means you may not know Content-Length until you finish. Chunked transfer is fine. The type is application/zip from the first byte. Do not buffer a multi-gigabyte archive in memory just to set the length.

Content-Type for .zip

Send application/zip and do not add a charset parameter. The body is binary. A charset tells a text decoder to reinterpret bytes that are not text, which corrupts a download and does not help a browser sniff the format.

Content-TypeContent-Type: application/zip

nginx, Apache, and Express

These snippets map .zip to application/zip. nginx reads the types block when it picks a type from the URL's extension. A location that sets default_type, or an application that sets the header itself, overrides that map. Apache AddType applies in the directory context where you put it. The Express static example writes the header for files ending in .zip so a stale mime database in the framework cannot disagree with the type on this page.

nginx# /etc/nginx/mime.types, inside the types { } block
application/zip             zip;

ApacheAddType application/zip .zip

Expressimport express from "express";

const app = express();
app.use(express.static("public", {
  setHeaders(res, filePath) {
    if (filePath.endsWith(".zip")) {
      res.setHeader("Content-Type", "application/zip");
    }
  },
}));

Pitfalls for application/zip

Pitfalls that show up for application/zip, and not for a neighboring type with a similar extension: The specific-type bug is serving a .docx as application/zip. The bytes extract, and Word may refuse the file or a browser may unzip it instead of opening the word processor. Use the Office type. The reverse bug is serving a generic ZIP as application/vnd.openxmlformats-officedocument.wordprocessingml.document because the route was copied from a document handler. Another trap is a ZIP built with backslashes in entry names, which extracts as a flat file on one OS and a path on another. Another is a ZIP that contains an absolute path or .. segments. Reject those on extract. The Content-Type will not sanitize paths.

• PK at the start is shared with DOCX, JAR, EPUB, and APK. The type has to follow the format, not only the magic.
• application/x-zip-compressed is an old unofficial value. Send application/zip.
• A spanned ZIP is more than one file. This type describes one response.
• Encrypting the members does not change the media type. It does change whether a client can extract without a password.