Data URI Parser

How to parse a data URI

1. Paste the URI into the box. It can also sit inside code: a CSS rule with url("data:..."), an <img src="data:..."> tag or a Markdown image. The first data: URI is extracted, and the status line says so.
2. Read the result: MIME, Parameters, Encoding (Base64 or percent-encoded), Data part length in characters, Decoded size and what the Content looks like.
3. Below, the payload is previewed with its SHA-256 and a hex dump: images, SVG, PDF, audio, video, fonts, text, JSON, ZIP archives and more.
4. Use Output encoding to keep the URI as it is or convert it to Base64 or URL-encoded, pick an Output format such as CSS url() or an HTML tag, and copy the result. Download file saves the payload.

What the parser accepts

The parser follows the data URL rules of the Fetch standard, which browsers implement and which are more lenient than the original RFC 2397, so it accepts what a browser accepts:

Line breaks and tabs inside the URI are removed before parsing, as browsers do, so a URI wrapped across several lines in a stylesheet still parses. ;base64 is case-insensitive, quoted parameter values are unquoted, and URL-safe Base64 is accepted. Percent escapes are decoded to bytes first, so even a Base64 body written as %2B%2F works.

Declared type versus actual content

The MIME type in a data URI is just a label. The parser checks the decoded bytes against known file signatures and warns when they disagree:

• data:image/jpeg;base64,iVBORw0KGgo... gives “Declared image/jpeg, but the content looks like PNG.” Browsers sniff raster images, so this often still displays, but stricter software rejects it.
• A type that is not a valid MIME type, such as image png with a space, gives a separate warning.

To fix a label, decode the file with Download file and build a clean URI on the Data URI Generator, or paste the Base64 part into Base64 to File, which offers the correct extension and MIME type.

Inspecting suspicious data: links

data:text/html URIs have been used for phishing because the whole fake page travels inside the link, with no server behind it that could be blocked. Chrome and Firefox now refuse to navigate a tab to them from a link, but they still appear in emails, QR codes, documents and chat messages.

Pasting such a link here is a safe way to see what it would show. A complete HTML document is rendered in a sandboxed frame that blocks scripts, forms and external resources, with the full source below it. Any other HTML or script is shown only as text. SVG payloads are drawn as images, which do not run scripts, and their markup is listed so you can look for <script> elements or on... handlers. The page’s Content Security Policy lets scripts connect only to Cloudflare’s page-view count and loads images only from the site itself or from data: and blob: URLs, so a tracking pixel or remote script in the payload is never fetched.

Re-encoding and converting

Output encoding turns a URI into the other encoding without touching the payload:

• Keep as is returns the URI with line breaks removed.
• Base64 suits binary data and contexts where special characters cause trouble.
• URL-encoded is shorter for plain ASCII text and SVG, and readable in the source.

Payload, URI length and Overhead under the output show which encoding is shorter for your data. For SVG specifically, SVG to Data URI also offers an optimized encoding and compares all three, gzip included.

FAQ