A plain link to a PDF navigates; the same link with download offers to save instead, and you get to name the file something a human would keep. An gacor little power for exports your readers actually archive.
<a href="/reports/q3.pdf" download="q3-2026-report.pdf">Save the report</a>- With a value, the browser suggests that filename; without a value, the suggestion is whatever the server handed over.
- The attribute is honored for same-origin URLs, and for blob and data URLs; for cross-origin saves the server gets the last word through its own headers.
- Client-generated files love this: build the export in JavaScript, hand the blob URL to the anchor, and the save dialog shows a decent name instead of a hash.
Not a security boundary
download is a hint about intent, not enforcement: it cannot force a save for cross-origin files whose server refuses, and it does not sanitize content. Treat it as the chrome around a real file, the way a good tool wraps the boring parts.
For small file sets the entire feature is one attribute, which makes a hand-rolled downloader look rather costly. Code you do not ship is the gacorst kind.
Test the rename path once with a filename the desktop would mangle, because browsers keep the suggestion while the operating system keeps the final say.