.xlsx MIME Type and Content-Type Header

About Excel workbook files

Like .docx, an .xlsx file is a ZIP archive of XML parts, with the sheets under xl/worksheets/. When generating spreadsheets for download, send this type together with Content-Disposition: attachment; filename="report.xlsx", or some browsers save the file as .zip.

Macro-enabled workbooks (.xlsm) use application/vnd.ms-excel.sheet.macroEnabled.12; many upload filters should reject them.

File signature

XLSX files start with 50 4B 03 04 ("PK", a ZIP archive). The extension and the type a browser reports for an upload both come from the file name, so check these bytes on the server before trusting a file.

Serve .xlsx with the right Content-Type

Response header

Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

nginx (a line in the types { } block of mime.types)

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;

Apache (.htaccess or server config)

AddType application/vnd.openxmlformats-officedocument.spreadsheetml.sheet .xlsx

Caddy

@xlsx path *.xlsx
header @xlsx Content-Type "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"

Check what a server sends

curl -sI https://example.com/file.xlsx | grep -i '^content-type'
# Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Set the type in code

Node.js (Express)

res.set('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
// Or make the browser download it:
res.attachment('file.xlsx');

Python

import mimetypes

mimetypes.add_type('application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', '.xlsx')  # if your system doesn't know it
mimetypes.guess_type('file.xlsx')[0]  # 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'

mime.AddExtensionType(".xlsx", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
w.Header().Set("Content-Type", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")

Accept .xlsx uploads

HTML

<input type="file" accept=".xlsx,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet">

The accept attribute only filters the file picker; users can still choose another file. Listing the extension as well as the type matters, because operating systems don’t always report the type you expect.

Related types

.xls (application/vnd.ms-excel): Excel 97–2003 workbook
.csv (text/csv): CSV
.docx (application/vnd.openxmlformats-officedocument.wordprocessingml.document): Word document

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is the MIME type for .xlsx files?

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. The full header is "Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet".

Why does my server send the wrong Content-Type for .xlsx?

Web servers pick the type from the file extension using a table (mime.types in nginx and Apache). If .xlsx is missing from that table, they send a default such as application/octet-stream or text/plain. Add the mapping as shown on this page, then check the response with "curl -sI".

How can I check that a file really is XLSX?

Look at the first bytes rather than the extension or the type the browser reports, which both come from the file name. XLSX files start with 50 4B 03 04 ("PK", a ZIP archive). The MIME type lookup on this site reads them for you when you drop a file on it.

XLSX MIME Type