Portable Network Graphics (PNG)
PNG is the default lossless image format on the web — screenshots, UI assets, icons with transparency, and OCR-friendly graphics. Chunk structure matters for metadata stripping and security review.
What It Defines
Lossless raster image format. Fixed 8-byte signature (`\x89PNG\r\n\x1a\n`) followed by length-type-data-CRC chunks (IHDR, IDAT, IEND, etc.). Supports alpha channel, gamma, color profiles, and ancillary metadata chunks. MIME type: `image/png`.
Canonical (Normative)
Convenient (Practical)
Related References
Publishes web platform specs including CSS, accessibility, security policies, Service Workers, Web App Manifest, and many browser APIs. Also maintains some versioned HTML/DOM specs.
Related Specs
Every upload, download, attachment, and asset pipeline crosses these layers. Misunderstanding header vs envelope causes MIME spoofing bugs, parser differentials, and broken file validation. Start here before diving into individual format specs.
Extension spoofing (`virus.exe` → `photo.jpg`) and MIME spoofing are common attack vectors. Magic-byte detection is the first line of defense in upload validation, antivirus, and content sniffing.
Correct Content-Type headers drive content negotiation, browser rendering, and API behavior. Wrong types cause security and parsing bugs.
JPEG dominates photo storage and delivery. EXIF metadata (GPS, camera, orientation) lives in APP1 markers — relevant for privacy, image processing, and upload pipelines.
WebP delivers smaller files than JPEG/PNG for equivalent quality — widely used for web delivery via `<picture>`, CDN transforms, and Next.js image optimization.
AVIF is the next-generation web image format — `<picture>` fallbacks, CDN support, and browser adoption make it worth knowing for asset pipelines and performance work.