Data URI Inspector

Decode a data: URI, find out what it actually contains, and check it for script markers — without opening it.

Runs on your deviceSecurity & PrivacyWorkingNo account needed

What this tool does

A data: URI — a data URL, in the spelling browsers use — packs a whole file into a single string: a media type, optional parameters such as charset, an optional base64 marker, a comma, and then the payload. Data URI Inspector splits that header apart, decodes the payload back to bytes, and describes what came out, rather than handing the string to the browser and letting it decide what to do with it.

The decoded bytes are then matched against twelve file signatures: PNG, JPEG, GIF, PDF, ZIP, WebP, BMP, gzip, WOFF, WOFF2, and the MZ and ELF headers that begin Windows and Linux executables. Where the sniffed type disagrees with the declared one, the report says so, because a media type is only a claim made by whoever wrote the string, and an executable announced as image/png is a well-worn disguise. Twelve signatures is a short list, so plenty of legitimate payloads come back as no known signature — that is an absence of evidence, not a clean bill of health.

The risk assessment is a marker scan and nothing more. It flags media types that execute or can carry code, the sniff mismatch above, a missing media type, and — when the payload decodes to text — a <script> tag, inline event handlers such as onerror=, a javascript: URL, an embedded iframe, object or embed element, further data: URIs nested inside, and external http(s) references in HTML or SVG. Those are the patterns a hostile payload usually shows in the clear. Obfuscated or minified script that spells none of them out passes without a word, so a report with no warnings means no marker matched, not that the payload is harmless.

Everything happens in this browser tab, so the string you paste is not transmitted anywhere and the tool works with the network disconnected. Two deliberate limits follow from the same caution: the payload is never rendered or executed, so a decoded image or PDF is described by type, size and its first 32 bytes in hex rather than shown, and one URI is inspected per run, since every character after the first comma is treated as that single payload.

How to use it

  1. Paste one data: URI. The whole string, from data: through the comma to the end of the payload. Load sample drops in an HTML payload carrying a script tag, if you want to see what a flagged result looks like.
  2. Read the header table. Media type, any parameters, whether the payload is base64 or percent-encoded, encoded size against decoded size with the base64 overhead, the sniffed type, and the first 32 bytes in hex.
  3. Work through the risk assessment. Each warning names one finding: a risky media type, a sniffed type that contradicts the declared one, no media type at all, or a script marker found in the decoded text.
  4. Set the preview length, or keep the file. Text preview runs from 200 to 20,000 characters and starts at 2,000. Leave the download option on to save the decoded payload with an extension taken from its type.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Examining a suspicious link before opening it

A phishing link written as data:text/html,… has no host to block or look up. Decoding it shows the markup, and the markers in it, without a page ever being loaded.

Finding out why an inline image will not display

A truncated payload, a wrong media type or an unexpected sniff result all show up in the table, which is quicker than guessing at a string thousands of characters long.

Auditing an asset inlined into CSS or a bundle

Someone embedded a file to save a request. This reports what it really is and what it costs, since base64 adds roughly a third to the byte count it replaces.

Getting the payload back out as a file

Save the decoded bytes with a sensible extension, then open, hash or diff them in whatever tool you would normally trust with that format.

Questions

Is the URI I paste sent anywhere?
No. Parsing, decoding and sniffing all run in this tab, so nothing is transmitted, logged or stored, and the page keeps working with the network switched off.
Does it display the decoded image or document?
No, and that is the point. Nothing is rendered or executed here. Binary payloads are reported as type, size and a hex dump of the first 32 bytes; download the file if you want to view it in an application of your choosing.
Does no warnings mean the payload is safe?
No. It means no marker matched. The scan looks at the declared and sniffed media types and at obvious script patterns in decoded text; it is not a malware scanner, and deliberately obfuscated code will not announce itself.
Which payload encodings does it accept?
Both base64 and percent-encoded text. Whitespace inside base64 is ignored, the URL-safe alphabet using - and _ is accepted, and missing padding is restored. Any other character stops the decode, and the error names it and its offset once the whitespace has been stripped.
Why does it report text/plain when I declared no type?
Because that is the default the specification sets: data:,Hello is text/plain with charset US-ASCII. It is listed as a warning, since the software eventually consuming the URI may assume something else entirely.
What happens with an unusual charset?
The text is decoded using the declared charset where the browser supports it. Where it does not, decoding falls back to UTF-8 and the report names the charset it could not honour, so an odd-looking preview has an explanation.
Can I inspect several URIs at once?
One per run only. Everything after the first comma counts as the payload, so a second URI pasted below the first is swallowed into the first one and decoded as part of it.

Related tools

  • Protect PDF — Add a password and set permissions on a PDF.
  • Sign PDF — Draw, type or upload a signature and place it on the page.
  • Hash Generator — Compute MD5, SHA-1, SHA-256 and SHA-512 digests.
  • Password Generator — Generate strong passwords with rules you control.
  • Redact PDF — Permanently remove sensitive content, not just cover it.
  • Remove PDF Metadata — Strip identifying metadata before you share a file.