ZIP MIME Type

About ZIP archive files

Windows browsers often report ZIP uploads as application/x-zip-compressed, so accept both. Many other formats are ZIP files underneath: .docx, .xlsx, .pptx, .odt, .epub, .jar and .apk all start with the same PK bytes, so a signature check alone can’t tell them apart.

• When extracting uploaded ZIPs on a server, check every entry’s path for ../ (“zip slip”) and limit the total uncompressed size to guard against zip bombs.

Other types seen for these files: application/x-zip-compressed , application/x-zip . Accept them when reading uploads, but send application/zip yourself.

File signature

ZIP files start with 50 4B 03 04 ("PK"); 50 4B 05 06 for an empty archive. The extension and the type a browser reports for an upload both come from the file name, so check these bytes on the server before trusting a file.

Serve .zip with the right Content-Type

Content-Type: application/zip

application/zip zip;

AddType application/zip .zip

@zip path *.zip
header @zip Content-Type "application/zip"

curl -sI https://example.com/file.zip | grep -i '^content-type'
# Content-Type: application/zip

Set the type in code

res.set('Content-Type', 'application/zip');
// Or make the browser download it:
res.attachment('file.zip');

import mimetypes

mimetypes.add_type('application/zip', '.zip')  # if your system doesn't know it
mimetypes.guess_type('file.zip')[0]  # 'application/zip'

mime.AddExtensionType(".zip", "application/zip")
w.Header().Set("Content-Type", "application/zip")

Accept .zip uploads

<input type="file" accept=".zip,application/zip">

The accept attribute only filters the file picker; users can still choose another file. Listing the extension as well as the type matters, because operating systems don’t always report the type you expect.

Related types

• .gz (application/gzip): Gzip file
• .7z (application/x-7z-compressed): 7-Zip archive
• .rar (application/vnd.rar): RAR archive
• .tar (application/x-tar): Tar archive

Sources

• IANA registration: application/zip
• MDN: Common media types

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions