# .xz MIME Type: application/x-xz

> LZMA2-compressed files — the .tar.xz archives used by the Linux kernel and many distributions.

- MIME type: `application/x-xz`
- Extensions: .xz
- Content-Type header: `application/x-xz`
- Compress in transit: no (already compressed)
- File signature: `FD 37 7A 58 5A 00`

## Good to know

- Compresses better than gzip and bzip2 at the cost of slow compression; decompression is fast.
- The 2024 xz-utils backdoor (CVE-2024-3094) was a compromise of the library's release tarballs, not a flaw in the format.

## Server configuration

### nginx (inside the types block in mime.types)

```
application/x-xz xz;
```

### Apache (.htaccess or server config)

```
AddType application/x-xz .xz
```

### Express

```
res.set("Content-Type", "application/x-xz");
```

### Python

```
import mimetypes

mimetypes.add_type("application/x-xz", ".xz")
```

### HTML file input

```
<input type="file" accept=".xz,application/x-xz">
```

## FAQ

### What is the MIME type for .xz files?

`application/x-xz`.

### What Content-Type header should a .xz file be served with?

`Content-Type: application/x-xz`. It's already compressed, so servers shouldn't gzip it.

### How can I tell if a file is really a .xz?

Check its bytes rather than the extension: XZ files start with `FD 37 7A 58 5A 00` (`.7zXZ.`). On the command line, `file --mime-type name.xz` does this for you.

## Related types

- [.gz — application/gzip](https://www.devkult.com/mime/gz.md)
- [.zst — application/zstd](https://www.devkult.com/mime/zst.md)
- [.bz2 — application/x-bzip2](https://www.devkult.com/mime/bz2.md)
- [.tar — application/x-tar](https://www.devkult.com/mime/tar.md)
- [.7z — application/x-7z-compressed](https://www.devkult.com/mime/7z.md)

Open the interactive page: https://www.devkult.com/mime/xz