Overview

application/octet-stream is the generic default type meaning 'arbitrary binary data of unknown nature.' It is used when a server does not know the concrete type, or wants the browser to save the response as a file rather than render it.

Details

Defined by RFC 2046, this type effectively signals 'do not interpret; treat the bytes as-is.' Browsers receiving it usually show a download dialog instead of inline display. To force a download, send `Content-Disposition: attachment; filename="report.bin"` to set the saved filename. When the exact type (e.g. application/pdf) is known, using it yields a better user experience.

Servers emit this type as a fallback when they cannot map an extension to a type. However, some browsers ignore Content-Type and sniff the bytes (MIME sniffing), which can misinterpret content as an executable type; when re-serving user uploads, always add `X-Content-Type-Options: nosniff`.

Syntax

e.g. Content-Type: application/octet-stream

File extensions

Notes

• The attachment directive of Content-Disposition drives forced downloads. For non-ASCII filenames use the RFC 5987 form `filename*=UTF-8''%ED%95%9C%EA%B8%80.zip` alongside the ASCII fallback.
• Re-serving user-uploaded HTML without this type can let sniffing execute scripts, becoming stored XSS. The octet-stream + nosniff + attachment combination is safe.
• Overusing octet-stream when the real type is known prevents browser previews and search indexing.

Related types

Related headers