file-type 和 mime-types 都用于处理文件类型信息,但工作原理完全不同。file-type 通过读取文件内容的“魔法数字”(magic numbers)来识别文件的真实格式,不依赖文件扩展名,适合安全验证场景。mime-types 则是一个查找表,根据文件扩展名映射到标准的 MIME 类型字符串,主要用于设置 HTTP 响应头或静态资源服务。两者常配合使用,但解决的是不同层面的问题。
file-type 和 mime-types 都是 Node.js 生态中处理文件类型的常用工具,但它们的底层逻辑和适用场景截然不同。file-type 关注文件“实际上是什么”,而 mime-types 关注文件“名义上应该是什么”。理解这一区别对于构建安全的文件上传服务和正确的 HTTP 响应至关重要。
file-type 读取文件头部的二进制数据(魔法数字)。
.jpg 改名为 .txt,它仍能识别出是图片。// file-type: 基于内容检测
import { fileTypeFromFile } from 'file-type';
const type = await fileTypeFromFile('photo.jpg');
console.log(type);
// 输出: { ext: 'jpg', mime: 'image/jpeg' }
mime-types 查询内置的扩展名映射数据库。
// mime-types: 基于扩展名查找
import mime from 'mime-types';
const type = mime.lookup('photo.jpg');
console.log(type);
// 输出: 'image/jpeg'
file-type 提供更高的安全信任度。
// file-type: 验证上传文件安全性
import { fileTypeFromBuffer } from 'file-type';
async function validateUpload(buffer) {
const type = await fileTypeFromBuffer(buffer);
if (type?.mime !== 'image/png') {
throw new Error('Invalid file type');
}
}
mime-types 仅作为类型提示,不可用于安全验证。
// mime-types: 设置响应头(不可信用于安全验证)
import mime from 'mime-types';
import fs from 'fs';
function serveFile(res, filePath) {
const contentType = mime.lookup(filePath) || 'application/octet-stream';
res.setHeader('Content-Type', contentType);
fs.createReadStream(filePath).pipe(res);
}
file-type 需要读取文件片段。
// file-type: 涉及异步 IO 操作
const type = await fileTypeFromFile('/path/to/large_video.mp4');
// 需要等待文件系统读取头部数据
mime-types 纯内存同步操作。
// mime-types: 同步内存查找
const ext = mime.extension('text/html');
// 立即返回 'html',无 IO 等待
file-type 支持 Node.js 和现代浏览器。
Blob 或 ArrayBuffer 使用。// file-type: 浏览器环境示例
import { fileTypeFromBuffer } from 'file-type';
async function checkFileInput(input) {
const arrayBuffer = await input.files[0].arrayBuffer();
const type = await fileTypeFromBuffer(arrayBuffer);
return type;
}
mime-types 主要为 Node.js 设计。
path 模块逻辑。// mime-types: Node.js 环境示例
import mime from 'mime-types';
// 通常在服务器端使用
if (process.platform === 'win32') {
// 处理路径分隔符等 Node 特定逻辑
}
虽然用途不同,这两个库在文件处理流程中经常一起出现,且有一些共同点。
image/png)。// file-type 输出
// { ext: 'png', mime: 'image/png' }
// mime-types 输出
// 'image/png'
// 组合使用示例
import mime from 'mime-types';
import { fileTypeFromFile } from 'file-type';
// 先用 file-type 验证安全,再用 mime-types 设置头(或直接用车 type 的结果)
// 两者都能识别常见格式
// image/jpeg, application/pdf, video/mp4 等
| 特性 | file-type | mime-types |
|---|---|---|
| 识别依据 | 🕵️ 文件内容(魔法数字) | 🏷️ 文件扩展名 |
| 安全性 | 🔒 高(防欺骗) | ⚠️ 低(仅推测) |
| 性能 | 🐢 异步 IO,稍慢 | 🚀 同步内存,极快 |
| 主要用途 | 上传验证、内容审计 | HTTP 头设置、静态服务 |
| 环境 | 🌐 Node.js + 浏览器 | 🖥️ 主要 Node.js |
file-type 是你的安全网关 🛡️ — 当文件来自不可信的用户上传时,必须用它来确认文件真实身份。不要相信用户提供的扩展名。
mime-types 是你的通信协议员 📮 — 当文件已经确认为安全,需要告诉浏览器如何显示或下载时,用它来设置正确的 Content-Type。
最佳实践:在生产环境中,通常先使用 file-type 验证上传内容的真实性,验证通过后,可以使用 file-type 返回的 MIME 类型,或者继续使用 mime-types 根据标准扩展名设置响应头。两者互补,而非互斥。
选择 file-type 当你需要验证用户上传文件的真实格式,防止通过修改扩展名进行欺骗。它适合处理未知来源的文件、无扩展名文件,或需要确保文件内容与声明类型一致的安全敏感场景。
选择 mime-types 当你需要根据文件扩展名设置 HTTP 响应头(Content-Type),或在静态文件服务器中映射资源类型。它适合处理已知扩展名的文件,且对性能要求较高、不需要深度内容检查的场景。
Detect the file type of a file, stream, or data
The file type is detected by checking the magic number of the buffer.
This package is for detecting binary-based file formats, not text-based formats like .txt, .csv, .svg, etc.
We accept contributions for commonly used modern file formats, not historical or obscure ones. Open an issue first for discussion.
npm install file-type
This package is an ESM package. Your project needs to be ESM too. Read more. For TypeScript + CommonJS, see load-esm. If you use it with Webpack, you need the latest Webpack version and ensure you configure it correctly for ESM.
[!IMPORTANT] File type detection is based on binary signatures (magic numbers) and is a best-effort hint. It does not guarantee the file is actually of that type or that the file is valid/not malformed.
Robustness against malformed input is best-effort. When processing untrusted files on a server, enforce a reasonable file size limit and use a worker thread with a timeout (e.g.,
make-asynchronous). These are not considered security issues in this package.
Determine file type from a file:
import {fileTypeFromFile} from 'file-type';
console.log(await fileTypeFromFile('Unicorn.png'));
//=> {ext: 'png', mime: 'image/png'}
Determine file type from a Uint8Array/ArrayBuffer, which may be a portion of the beginning of a file:
import {fileTypeFromBuffer} from 'file-type';
import {readChunk} from 'read-chunk';
const buffer = await readChunk('Unicorn.png', {length: 4100});
console.log(await fileTypeFromBuffer(buffer));
//=> {ext: 'png', mime: 'image/png'}
Determine file type from a stream:
import {fileTypeFromStream} from 'file-type';
const url = 'https://upload.wikimedia.org/wikipedia/en/a/a9/Example.jpg';
const response = await fetch(url);
const fileType = await fileTypeFromStream(response.body);
console.log(fileType);
//=> {ext: 'jpg', mime: 'image/jpeg'}
Detect the file type of a Uint8Array or ArrayBuffer.
The file type is detected by checking the magic number of the buffer.
If file access is available, it is recommended to use fileTypeFromFile() instead.
Returns a Promise for an object with the detected file type:
ext - One of the supported file typesmime - The MIME typeOr undefined when there is no match.
Type: Uint8Array | ArrayBuffer
A buffer representing file data. It works best if the buffer contains the entire file. It may work with a smaller portion as well.
Detect the file type of a file path.
Only available in environments where node:fs is available, such as Node.js. To read from a File, see fileTypeFromBlob().
The file type is detected by checking the magic number of the file.
Returns a Promise for an object with the detected file type:
ext - One of the supported file typesmime - The MIME typeOr undefined when there is no match.
Type: string
The file path to parse.
Detect the file type of a web ReadableStream.
The file type is detected by checking the magic number of the buffer.
Returns a Promise for an object with the detected file type:
ext - One of the supported file typesmime - The MIME typeOr undefined when there is no match.
Type: Web ReadableStream
A readable stream representing file data.
[!TIP] If you have a Node.js
stream.Readable, convert it withReadable.toWeb().
Detect the file type of a Blob.
[!TIP] A
Fileobject is aBloband can be passed in here.
It will stream the underlying Blob.
The file type is detected by checking the magic number of the blob.
Returns a Promise for an object with the detected file type:
ext - One of the supported file typesmime - The MIME typeOr undefined when there is no match.
import {fileTypeFromBlob} from 'file-type';
const blob = new Blob(['<?xml version="1.0" encoding="ISO-8859-1" ?>'], {
type: 'text/plain',
endings: 'native'
});
console.log(await fileTypeFromBlob(blob));
//=> {ext: 'xml', mime: 'application/xml'}
Type: Blob
Detect the file type from an ITokenizer source.
This method is used internally, but can also be used for a special "tokenizer" reader.
A tokenizer propagates the internal read functions, allowing alternative transport mechanisms, to access files, to be implemented and used.
Returns a Promise for an object with the detected file type:
ext - One of the supported file typesmime - The MIME typeOr undefined when there is no match.
An example is @tokenizer/http, which requests data using HTTP-range-requests. A difference with a conventional stream and the tokenizer, is that it can ignore (seek, fast-forward) in the stream. For example, you may only need and read the first 6 bytes, and the last 128 bytes, which may be an advantage in case reading the entire file would take longer.
import {makeTokenizer} from '@tokenizer/http';
import {fileTypeFromTokenizer} from 'file-type';
const audioTrackUrl = 'https://test-audio.netlify.com/Various%20Artists%20-%202009%20-%20netBloc%20Vol%2024_%20tiuqottigeloot%20%5BMP3-V2%5D/01%20-%20Diablo%20Swing%20Orchestra%20-%20Heroines.mp3';
const httpTokenizer = await makeTokenizer(audioTrackUrl);
const fileType = await fileTypeFromTokenizer(httpTokenizer);
console.log(fileType);
//=> {ext: 'mp3', mime: 'audio/mpeg'}
Or use @tokenizer/s3 to determine the file type of a file stored on Amazon S3:
import {S3Client} from '@aws-sdk/client-s3';
import {makeChunkedTokenizerFromS3} from '@tokenizer/s3';
import {fileTypeFromTokenizer} from 'file-type';
// Initialize S3 client
const s3 = new S3Client();
// Initialize the S3 tokenizer.
const s3Tokenizer = await makeChunkedTokenizerFromS3(s3, {
Bucket: 'affectlab',
Key: '1min_35sec.mp4'
});
// Figure out what kind of file it is.
const fileType = await fileTypeFromTokenizer(s3Tokenizer);
console.log(fileType);
Note that only the minimum amount of data required to determine the file type is read (okay, just a bit extra to prevent too many fragmented reads).
Type: ITokenizer
A file source implementing the tokenizer interface.
Returns a Promise which resolves to the original readable stream argument, but with an added fileType property, which is an object like the one returned from fileTypeFromFile().
This method can be handy to put in a stream pipeline, but it comes with a price.
Internally stream() builds up a buffer of sampleSize bytes, used as a sample, to determine the file type.
The sample size impacts the file detection resolution.
A smaller sample size will result in lower probability of the best file type detection.
Type: Web ReadableStream
The input stream.
Type: object
Supports the following options in addition to the general options:
Type: number
Default: 4100
The sample size in bytes.
import {fileTypeStream} from 'file-type';
const url = 'https://upload.wikimedia.org/wikipedia/en/a/a9/Example.jpg';
const response = await fetch(url);
const stream = await fileTypeStream(response.body, {sampleSize: 1024});
if (stream.fileType?.mime === 'image/jpeg') {
// stream can be used to stream the JPEG image (from the very beginning of the stream)
}
Returns a Set<string> of file extensions that can be detected.
Returns a Set<string> of MIME types that can be detected.
Array of custom file type detectors to run before default detectors.
For example:
import {fileTypeFromFile} from 'file-type';
import {detectXml} from '@file-type/xml';
const fileType = await fileTypeFromFile('sample.kml', {customDetectors: [detectXml]});
console.log(fileType);
Type: number
Default: Infinity
Maximum size in bytes of an individual buffer allocated to read file content, or a stream lookahead request.
Must be a positive safe integer or Infinity.
File content can determine how much data a detector requests, for example through a field specifying the length of a metadata entry.
This opt-in limit bounds the memory allocations needed to fulfill those reads, including reads made by custom detectors.
Setting a finite cap can help prevent excessive read-buffer allocations driven by untrusted file content (CWE-789: Memory Allocation with Excessive Size Value).
Built-in reads already have format-specific bounds; choose a finite cap to suit your application.
An oversized request rejects detection with strtok3.BufferSizeError, which exposes requestedSize and maxBufferSize.
During gzip content probing, this error is suppressed and detection falls back to gz; the cap still prevents the oversized allocation.
const fileType = await fileTypeFromFile('sample.bin', {maxBufferSize: 64 * 1024 * 1024});
This is not a total memory limit.
It does not cover buffers allocated directly by detectors or fileTypeStream() sampling.
When using fileTypeFromTokenizer(), configure maxBufferSize on the input reader itself; this option does not override that reader’s limits.
The built-in format-specific limits, including ZIP text-entry limits, apply independently of this option.
For FileTypeParser.toDetectionStream(), configure detection options such as maxBufferSize through the parser constructor.
The method only accepts stream options such as sampleSize.
Default: 0
Specifies the byte tolerance for locating the first MPEG audio frame (e.g. .mp1, .mp2, .mp3, .aac).
Allows detection to handle slight sync offsets between the expected and actual frame start. Common in malformed or incorrectly muxed files, which, while technically invalid, do occur in the wild.
A tolerance of 10 bytes covers most cases.
Custom file type detectors are plugins designed to extend the default detection capabilities. They allow support for uncommon file types, non-binary formats, or customized detection behavior.
Detectors can be added via the constructor options or by directly modifying FileTypeParser#detectors.
Detectors provided through the constructor are executed before the default ones.
[!NOTE] Not safe for concurrent use. Create a new instance per call if you need concurrency.
import {FileTypeParser} from 'file-type';
import {detectXml} from '@file-type/xml';
const parser = new FileTypeParser({customDetectors: [detectXml]});
const fileType = await parser.fromFile('sample.kml');
console.log(fileType);
.msi.If a detector returns undefined, the following rules apply:
tokenizer.position is advanced), no further detectors are executed. In this case, the file type remains undefined, as subsequent detectors cannot evaluate the content. This is an exceptional scenario, as it prevents any other detectors from determining the file type.Below is an example of a custom detector. This can be passed to the FileTypeParser via the customDetectors option.
import {FileTypeParser} from 'file-type';
const unicornDetector = {
id: 'unicorn', // May be used to recognize the detector in the detector list
async detect(tokenizer) {
const unicornHeader = [85, 78, 73, 67, 79, 82, 78]; // "UNICORN" in ASCII decimal
const buffer = new Uint8Array(unicornHeader.length);
await tokenizer.peekBuffer(buffer, {length: unicornHeader.length, mayBeLess: true});
if (unicornHeader.every((value, index) => value === buffer[index])) {
return {ext: 'unicorn', mime: 'application/unicorn'};
}
return undefined;
}
}
const buffer = new Uint8Array([85, 78, 73, 67, 79, 82, 78]);
const parser = new FileTypeParser({customDetectors: [unicornDetector]});
const fileType = await parser.fromBuffer(buffer);
console.log(fileType); // {ext: 'unicorn', mime: 'application/unicorn'}
/**
@param tokenizer - The [tokenizer](https://github.com/Borewit/strtok3#tokenizer) used to read file content.
@param fileType - The file type detected by standard or previous custom detectors, or `undefined` if no match is found.
@returns The detected file type, or `undefined` if no match is found.
*/
export type Detector = {
id: string;
detect: (tokenizer: ITokenizer, fileType?: FileTypeResult) => Promise<FileTypeResult | undefined>;
};
Some async operations can be aborted by passing an AbortSignal to the FileTypeParser constructor.
import {FileTypeParser} from 'file-type';
const abortController = new AbortController();
const parser = new FileTypeParser({signal: abortController.signal});
const promise = parser.fromStream(blob.stream());
abortController.abort(); // Abort file-type reading from the Blob stream.
MIME media subtypes prefixed with x-ft- are custom and defined by us. They are neither formally registered with IANA nor based on any informal conventions.
3g2 - Multimedia container format defined by the 3GPP2 for 3G CDMA2000 multimedia services3gp - Multimedia container format defined by the Third Generation Partnership Project (3GPP) for 3G UMTS multimedia services3mf - 3D Manufacturing Format7z - 7-Zip archiveZ - Unix Compressed Fileaac - Advanced Audio Codingac3 - ATSC A/52 Audio Fileace - ACE archiveaif - Audio Interchange filealias - macOS Alias fileamr - Adaptive Multi-Rate audio codecape - Monkey's Audioapk - Android package formatapng - Animated Portable Network Graphicsar - Archive filearj - Archive filearrow - Columnar format for tables of dataarw - Sony Alpha Raw image fileasar - Archive format primarily used to enclose Electron applicationsasf - Advanced Systems Formatavi - Audio Video Interleave fileavif - AV1 Image File Formatavro - Object container file developed by Apache Avroblend - Blender projectbmp - Bitmap image filebpg - Better Portable Graphics filebz2 - Archive filecab - Cabinet filecaf - Apple Core Audio Formatcfb - Compound File Binary Formatchm - Microsoft Compiled HTML Helpclass - Java class filecpio - Cpio archivecr2 - Canon Raw image file (v2)cr3 - Canon Raw image file (v3)crx - Google Chrome extensioncur - Icon filedat - Windows registry hive filedcm - DICOM Image Filedeb - Debian packagedff - Direct Stream Digital Interchange File Format (DSDIFF)dmg - Apple Disk Imagedng - Adobe Digital Negative image filedocm - Microsoft Word macro-enabled documentdocx - Microsoft Word documentdotm - Microsoft Word macro-enabled templatedotx - Microsoft Word templatedrc - Google's Draco 3D Data Compressiondsf - Sony DSD Stream File (DSF)dwg - Autodesk CAD fileelf - Unix Executable and Linkable Formateot - Embedded OpenType fonteps - Encapsulated PostScriptepub - E-book fileexe - Executable filef4a - Audio-only ISO base media file format used by Adobe Flash Playerf4b - Audiobook and podcast ISO base media file format used by Adobe Flash Playerf4p - ISO base media file format protected by Adobe Access DRM used by Adobe Flash Playerf4v - ISO base media file format used by Adobe Flash Playerfbx - Filmbox is a proprietary file format used to provide interoperability between digital content creation apps.flac - Free Lossless Audio Codecflif - Free Lossless Image Formatflv - Flash videogif - Graphics Interchange Formatglb - GL Transmission Formatgz - Archive fileheic - High Efficiency Image File Formaticc - ICC Profileicns - Apple Icon imageico - Windows icon fileics - iCalendarindd - Adobe InDesign documentiso - ISO 9660 disc imageit - Audio module format: Impulse Trackerj2c - JPEG 2000jar - Java archivejls - Lossless/near-lossless compression standard for continuous-tone imagesjmp - JMP data file format by SAS Institutejp2 - JPEG 2000jpg - Joint Photographic Experts Group imagejpm - JPEG 2000jpx - JPEG 2000jxl - JPEG XL image formatjxr - Joint Photographic Experts Group extended rangekey - Apple Keynote presentationktx - OpenGL and OpenGL ES textureslnk - Microsoft Windows file shortcutlz - Archive filelz4 - Compressed archive created by one of a variety of LZ4 compression utilitieslzh - LZH archivem4a - Audio-only MPEG-4 filesm4b - Audiobook and podcast MPEG-4 files, which also contain metadata including chapter markers, images, and hyperlinksm4p - MPEG-4 files with audio streams encrypted by FairPlay Digital Rights Management as were sold through the iTunes Storem4v - Video container format developed by Apple, which is very similar to the MP4 formatmacho - Mach-O binary formatmid - Musical Instrument Digital Interface filemie - Dedicated meta information format which supports storage of binary as well as textual meta informationmj2 - Motion JPEG 2000mkv - Matroska video filemobi - Mobipocketmov - QuickTime video filemp1 - MPEG-1 Audio Layer Imp2 - MPEG-1 Audio Layer IImp3 - Audio filemp4 - MPEG-4 Part 14 video filempc - Musepack (SV7 & SV8)mpg - MPEG-1 filemts - MPEG-2 Transport Stream, both raw and Blu-ray Disc Audio-Video (BDAV) versionsmxf - Material Exchange Formatnef - Nikon Electronic Format image filenes - Nintendo NES ROMnumbers - Apple Numbers spreadsheetodg - OpenDocument for drawingodp - OpenDocument for presentationsods - OpenDocument for spreadsheetsodt - OpenDocument for word processingoga - Audio fileogg - Audio fileogm - Audio fileogv - Audio fileogx - Audio fileopus - Audio fileorf - Olympus Raw image fileotf - OpenType fontotg - OpenDocument template for drawingotp - OpenDocument template for presentationsots - OpenDocument template for spreadsheetsott - OpenDocument template for word processingpages - Apple Pages documentparquet - Apache Parquetpcap - Libpcap File Formatpdf - Portable Document Formatpgp - Pretty Good Privacypng - Portable Network Graphicspotm - Microsoft PowerPoint macro-enabled templatepotx - Microsoft PowerPoint templateppsm - Office PowerPoint 2007 macro-enabled slide showppsx - Office PowerPoint 2007 slide showpptm - Microsoft PowerPoint macro-enabled documentpptx - Microsoft PowerPoint documentps - PostScriptpsd - Adobe Photoshop documentpst - Personal Storage Table fileqcp - Tagged and chunked dataraf - Fujifilm RAW image filerar - Archive filereg - Windows registry (entries) file formatrm - RealMediarpm - Red Hat Package Manager filertf - Rich Text Formatrw2 - Panasonic RAW image files3m - Audio module format: ScreamTracker 3sav - SPSS Statistical Data Fileshp - Geospatial vector data formatskp - SketchUpspx - Audio filesqlite - SQLite filestl - Standard Tessellated Geometry File Format (ASCII only)swf - Adobe Flash Player filetar - Tape archive or tarballtar.gz - Gzipped tape archive (tarball)tif - Tagged Image filettc - TrueType Collection fontttf - TrueType fontvcf - vCardvoc - Creative Voice Filevsdx - Microsoft Visio Filevtt - WebVTT File (for video captions)wasm - WebAssembly intermediate compiled formatwav - Waveform Audio filewebm - Web video filewebp - Web Picture formatwoff - Web Open Font Formatwoff2 - Web Open Font Formatwv - WavPackxcf - eXperimental Computing Facilityxlsm - Microsoft Excel macro-enabled documentxlsx - Microsoft Excel documentxltm - Microsoft Excel macro-enabled templatexltx - Microsoft Excel templatexm - Audio module format: FastTracker 2xml - eXtensible Markup Languagexpi - XPInstall filexz - Compressed filezip - Archive filezst - Archive fileISO 9660 requires random-access input or fileTypeStream() with sampleSize >= 32_774; fileTypeFromStream() is unsupported.
When [Content_Types].xml cannot be reached — it may trail the content entries, and only so much of what precedes it is scanned — the type is guessed from the archive's directory names: word/, xl/ and ppt/ are reported as docx, xlsx and pptx. Macro-enabled and template variants are therefore reported as their base type, and a non-OOXML archive containing one of those directories is reported as OOXML.
Pull requests are welcome for additional commonly used file types.
The following file types will not be accepted, but most of them are supported by third-party detectors.
.doc - Microsoft Word 97-2003 Document.xls - Microsoft Excel 97-2003 Document.ppt - Microsoft PowerPoint 97-2003 Document.msi - Microsoft Windows Installer.csv - Reason..svg