WebAssembly MIME Type

What does application/wasm mean?

The application/wasm media type identifies a WebAssembly binary module. A .wasm file contains portable low-level instructions, types, functions, imports, exports, memory declarations, and optional custom sections. It is compiled output rather than source code, even though browsers and developer tools can often map it back to a readable representation.¹

Every ordinary WebAssembly module starts with the four bytes 00 61 73 6D. The last three bytes spell asm in ASCII. The next four bytes are the binary-format version, currently 01 00 00 00 for version 1 of the encoding.²

How the format and MIME type became standards

WebAssembly was developed openly by browser-engine teams and the W3C WebAssembly Community Group. In February 2017, representatives of Chrome, Edge, Firefox, and WebKit agreed that the initial API and binary format were ready for browsers to ship by default.⁴

The W3C published WebAssembly Core Specification 1.0 as a Recommendation on December 5, 2019. It defines a portable virtual instruction set, validation rules, execution semantics, and binary and text representations.⁵ IANA registered application/wasm on April 20, 2021, with no required or optional parameters, .wasm as the extension, and 00 61 73 6D as the magic number.¹

The format continues to evolve through compatible standard releases. A module can also depend on host conventions that the core format does not define, such as browser-supplied JavaScript imports or WebAssembly System Interface (WASI) functions.

Why the HTTP Content-Type matters

Browsers do not render a .wasm file as a page. Web applications fetch the bytes and compile or instantiate the module through the WebAssembly JavaScript API. Current Chrome, Edge, Firefox, Opera, and Safari releases implement that core workflow.

For the streaming APIs, configure the server to send:

Content-Type: application/wasm

WebAssembly.instantiateStreaming() compiles and instantiates while the response arrives. MDN notes that the server must return .wasm resources as application/wasm for this optimized path.⁶ A generic type such as application/octet-stream can force application code to fall back to downloading the complete response and then passing its bytes to WebAssembly.instantiate().

How to inspect or run a .wasm file

A normal text editor will show binary data. Use a WebAssembly-aware runtime or tool instead:

• WABT provides wasm-validate for validation, wasm-objdump for section information, and wasm2wat for a readable text representation.⁷
• Wasmtime runs modules outside the browser. wasmtime foo.wasm compiles, instantiates, and runs a compatible module, while modules with non-WASI imports need the expected host environment.⁸
• Browser developer tools can debug modules loaded by a web application, especially when source maps or debug information are available.

Do not rename .wasm to .wat to convert it. Use wasm2wat module.wasm -o module.wat. The reverse operation uses wat2wasm.

Disassembly is not source recovery. A generated .wat file exposes WebAssembly instructions and structure, but original variable names, comments, types, and high-level control flow may be absent unless separate debugging data preserves some of them.

Support in Poly

Poly recognizes both the application/wasm identifier and the .wasm extension. It classifies the file as an unknown binary media category, stores it, syncs it, and makes it searchable by filename and ordinary file properties.

Poly does not execute the module, validate its bytecode, disassemble it, extract imports or exports, generate a preview, or index its compiled instructions. Opening it therefore does not provide a code view. Download the file and use WABT, Wasmtime, or the toolchain that produced it. The Poly agent also cannot inspect the binary contents.

This distinction matters because Poly itself uses WebAssembly internally in parts of its web client. That runtime implementation does not mean uploaded .wasm files are executed or understood.

Security and deployment considerations

The WebAssembly specification gives modules memory-safe, sandboxed execution semantics, and core modules have no ambient access to files, networks, or operating-system calls. A module reaches the outside world only through capabilities supplied by its embedder as imports.⁹

That sandbox is a boundary, not a statement that every module is trustworthy. A host can expose powerful imports, a module can consume excessive CPU or memory, and hardware side channels remain an embedder concern. Review the import surface, set resource limits, and treat an untrusted module like other untrusted executable content.

The IANA registration also notes that the format provides no built-in integrity or privacy protection.¹ Use HTTPS for transport. When a particular module must be pinned, use an authenticated deployment mechanism or verify a trusted cryptographic digest before execution.

Is application/wasm the same as application/octet-stream?

No. application/octet-stream is the generic media type for arbitrary binary data. application/wasm says specifically that the payload is a WebAssembly binary module, enables correct content handling, and is required for the browser streaming APIs' optimized path.

IANA lists no deprecated aliases for application/wasm.¹ If a server sends a .wasm file as application/octet-stream, the bytes may still be a valid module, but the response has lost useful format information and streaming compilation may fail.