Content-Type Validator

Server assisted Web

Parse a Content-Type header (type, subtype, charset, boundary), verify it against IANA media types, and optionally fetch a public URL to confirm the body matches (JSON that parses, HTML that looks like HTML, etc.).

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

How to use Content-Type Validator

  1. Paste a Content-Type value, optionally with a body to compare, and click Validate.
  2. Or enter a public URL to fetch its actual headers and body.
  3. Read the parsed fields, parameter table and issues; the body check tells you whether the payload matches the declaration.

Content-Type Validator features

  • Parses type, subtype, structured suffix (+json, +xml) and all parameters including quoted values
  • Checks the top-level type against the IANA registry and the full type against a 200-entry media type table
  • Charset sanity checks (missing on text types, redundant on JSON, misspelled utf8) and multipart boundary validation
  • Body sniffing: JSON that parses, HTML/XML markup, form bodies, JavaScript, CSS, binary — compared with the declared family
  • Optional fetch of a public URL through the relay to validate the real response header and body
  • Advice on obsolete types (application/javascript, text/xml, text/json)

Content-Type Validator example

A JSON response declared as HTML

Input:

Content-Type: text/html; charset=utf-8
Body: {"ok":true}

Output:

Media type: text/html · Charset: utf-8 · Body family: html
Body check: detected json — No, the body does not look like the declared type.
Warning: Declared text/html but the body looks like json.

Frequently asked questions about Content-Type Validator

Does application/json need charset=utf-8?

No. RFC 8259 defines JSON as UTF-8 and the charset parameter has no effect; the tool notes it as redundant. Text types (text/html, text/plain, text/css) should always declare a charset.

What does the body check do?

It sniffs the body the way a browser would: does it parse as JSON, start with an HTML doctype or tag, an XML declaration, look like a form body, or contain binary bytes? The detected family is compared with the declared media type.

What happens when I enter a URL?

The relay fetches the public URL (following redirects), reads its Content-Type header and body, and validates both. Nothing is stored. Local or private addresses cannot be fetched.

Why does the tool flag text/javascript vs application/javascript?

RFC 9239 (2022) made text/javascript the only recommended type and marked application/javascript obsolete. Browsers accept both, but new services should use text/javascript.

Technical notes

Parameter parsing follows RFC 9110 §8.3 (case-insensitive names, optional quoted-string values, semicolons inside quotes preserved). Body detection reads the first 2 KB and applies conservative heuristics similar to the MIME Sniffing Standard; it never executes content.