text/plaintext/plain is the media type for plain text with no structure or formatting. It is used for logs, READMEs, simple API responses, and debug output — plain text read as-is by humans — and browsers display it verbatim without escaping.
A browser does not interpret text/plain as markup, so `<b>` or `<script>` appear on screen as literal tag characters. This makes it handy for safely echoing user input, but there is a catch: some browsers ignore Content-Type and sniff the content, rendering it as HTML. If the first bytes match a pattern like `<html>`, content sent as text/plain can execute as HTML and become XSS, so send `X-Content-Type-Options: nosniff` alongside it.
The charset parameter matters. Historically text/* types defaulted to US-ASCII when charset was unspecified (RFC 2046), but modern HTML standards and browsers have converged on assuming UTF-8. Plain text containing Korean or emoji must declare `charset=utf-8` to be safe.
e.g. Content-Type: text/plain; charset=utf-8