By · Updated

Data URI Decoder

Decode Data URLs and Check the Real File Type, SHA-256 Hash and Hidden Scripts

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the Data URI Decoder works

This data URI decoder shows what is really inside a data: link. Paste the URI from a stylesheet, an email or a phishing page and it decodes the payload, identifies the file from its bytes and warns when the content does not match what it claims to be.

How the data URI decoder inspects a payload

A data URI packs a whole file into a link, in the form data:[type][;charset=...][;base64],payload. The decoder reads the declared type and encoding, then decodes the payload with Base64 or percent decoding as appropriate. You can also paste a CSS url(...) value.

The real type is detected from magic bytes, the signature at the start of every file: PNG, JPEG, GIF, WebP, PDF, ZIP, gzip, WebAssembly, Windows and Linux executables, fonts, audio and more. Text payloads are checked for SVG, HTML, JSON and XML.

Warnings appear when the declared and detected types differ, when the content contains script tags, javascript: links or event handlers, when HTML has forms or iframes, and when the payload is executable. Phishing pages often arrive as a data:text/html link that hides a fake login form.

Text payloads are shown in full. Binary ones are shown as a hex dump of the first 512 bytes. The overhead shows how much larger the URI is than the file itself.

FAQ

Why do browsers block some data URIs?

Modern browsers refuse to open data:text/html links typed or clicked from another page because they were widely used for phishing. Images and fonts inside a data URI still load normally in CSS and HTML.

Why is my data URI a third larger than the image?

Base64 turns every three bytes into four characters, so the payload grows by about 33 percent, plus the header. For large images a normal file is usually faster because it can be cached separately.

Is the SHA-256 hash of the URI or the file?

Of the decoded file bytes. That makes it match the hash of the same file saved to disk, so you can look it up on malware databases or compare it with a known good copy.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

Image To Data URI

Base64-encode an image as a data URI for CSS or HTML.

SVG Data URI Encoder

Encode SVG into a compact, quote-safe CSS data URI.

Base64 Encoder / Decoder

Encode and decode Base64, standard or URL-safe.

Hex Dump Viewer

View any file as hex and ASCII, with type detection and entropy.

Multi Decoder

Detect and unwrap nested Base64, URL, hex and entity encodings automatically.