Base64 to Image

Nearly always the string rather than the decoder. Truncation is commonest: Base64 carries no length, so a copy that missed the final line or a log that cut the entry short looks intact and stops mid-file. Next is Base64URL, the variant used in JWTs, which swaps plus and slash for minus and underscore and is refused by a standard decoder. The two failures read differently here — a complaint about invalid Base64 points at the opening characters, while a message about it not being a valid image means the text decoded and nothing could be drawn from it.

The shape is data:, then a media type, then optional parameters, then a comma, then the payload. It is defined by RFC 2397 and works anywhere a URL does: an img src, a CSS background, an anchor href. The base64 word before the comma tells the browser the payload is encoded rather than percent-escaped text, which is why some SVG data URIs carry readable markup and no base64 marker. The media type is a declaration, not a check — nothing verifies the bytes match it. Paste a bare payload with no prefix here and the type is worked out from the leading characters instead.

No, and treating it as one is a real source of leaks. It is an encoding: a reversible mapping of arbitrary bytes onto sixty-four printable characters, so binary data can cross channels that only handle text, such as email bodies, JSON strings and HTML attributes. There is no key and no secret. Anyone holding the string can turn it back into the original file in seconds, which is what this page does. Base64 in a URL, a cookie or a config file protects nothing; it only stops someone skimming from reading it. Encrypt first if it matters, then encode the ciphertext.

The string never leaves your browser here. There is no upload and no request carrying it: once the text is checked it is handed to an image element on the page as a data URI, and the browser's own decoder draws it. The download link points at that same data URI, so saving writes bytes your machine already holds. That matters, because what people decode tends to be scanned documents, signatures and screenshots from private systems. The string itself still deserves care — it is the whole file, so any ticket you pasted it into holds a copy.

For very small assets, sometimes. Encoding costs roughly a third in size on top of the raw bytes, and an inlined image cannot be cached on its own, so every page load carries it again. That is tolerable for an icon that would otherwise cost a round trip, and it stops paying quickly above a few kilobytes. It is also why inlining fell out of favour once connection reuse made extra requests cheap. Email pulls the other way, since many clients block remote images, but data URI support there is patchy enough to test first.

Take the value of the field and nothing else — no surrounding quotation marks, no trailing comma. JSON allows a forward slash to be written escaped, and Base64 is full of forward slashes, so a payload lifted from a raw response often arrives peppered with stray backslashes that have to come out. Line breaks are harmless here, since whitespace is stripped before anything else, which covers strings wrapped at seventy-six characters by a mail encoder. Watch instead for an ellipsis inserted by a log viewer that abbreviates long values: that is corruption in the middle, and it is invisible.

They are the same format, and every viewer opens both — jpg exists because old filesystems allowed only three letters. It matters here because the saved extension comes from the media type, and the registered type for a JPEG is image/jpeg, so that is the name you get. Rename it if a form insists on three letters. Renaming is where people come unstuck, though: calling a PNG .jpg does not convert anything, it mislabels the bytes, and strict software rejects it. Real conversion means decoding and re-encoding, with the trade attached — JPEG discards detail and holds no transparency.

Treat it more carefully than a bitmap. An SVG is XML rather than pixels, and it can carry script, external references and fonts. Loaded through an image element, as a preview is, script does not run and remote references are not fetched — a restriction browsers apply to images generally. The saved file is another matter: opening an .svg directly in a browser loads it as a document, where everything inside is live. Read the markup as text first if the source is not one you control. Being XML, the encoded string begins from an opening tag rather than a binary header.