SVG is refused. An SVG document can contain scripts, and this page will not treat it as a picture. A string that decodes to something other than those three formats is an error, not a blank image.
How to use
- Paste base64, or a data URL that starts with data:image.
- Press Decode and read the format line before you trust the picture.
- The picture appears under the report when the bytes are a PNG, JPEG or GIF. Reset clears both.
Formula / how it works
What is read. Spaces in the base64 are removed. A data URL is split into the declared type and the payload. The payload is decoded to bytes. PNG is recognised by its signature and the width and height are taken from the IHDR chunk. GIF width and height are the little-endian fields in the header. JPEG is scanned for a start-of-frame marker. The byte count is the decoded length, not the length of the base64 text, which is longer. The sample payload is a one-pixel PNG, 70 bytes, 1 by 1.
What is shown. When the report starts with a format line, the page points an image element at a data URL built from those bytes. The image element does not run scripts. SVG is not given that treatment, even though an SVG data URL is sometimes used as a picture, because this page does not try to tell a safe SVG from one with a script. The base64 encoder turns bytes into text. This page goes the other way, and only for three picture formats.
Declared type versus sniffed type. A data URL may say image/png while the bytes are a JPEG. The report prints both the sniffed format and the declared type. If there is no data URL, the declared type is none. Trust the sniffed format. The declared type is what the sender claimed.
Limits. Half a megabyte of text. No animation timeline, no colour profile, no EXIF story. A truncated file that still has a header may report a size and then fail to draw. The size line is from the header. The drawing is the browser’s job. If the header parses and the picture does not appear, the bytes are incomplete.
Privacy. The decode happens in the browser. The bytes are not uploaded. Do not paste a picture you would not leave in an open tab.
Base64 padding. The alphabet is checked before decode. A character outside it, other than whitespace, is rejected. Padding equals signs are allowed at the end. A data URL with a charset parameter or a non-base64 encoding is rejected by the pattern this page accepts, which is the simple form data:type;base64,payload. If your URL is more complicated, strip it to the payload and paste that. The declared type will then say none, and the sniffed format still tells you what the bytes are.
One pixel. The sample is deliberately tiny so the report is about the header, not about a photograph. A 1 by 1 PNG is a valid file. If your payload reports a huge width from a tiny byte count, the header and the body disagree and you should not trust the picture
Worked examples
A one-pixel PNG
Inputs: Base64: iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==
Paste the sample base64, which is iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==, and press Decode. The header says PNG, 1 by 1, 70 bytes, with no declared type.
Result: Format: PNG
Width: 1
Height: 1
Bytes: 70
Declared type: none
The picture can be shown from this base64 in the page. SVG is refused because a document can carry scripts.
The same PNG as a data URL
Inputs: Base64: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==
Paste data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg== and press Decode. The declared type is image/png and the pixels are still 1 by 1.
Result: Format: PNG
Width: 1
Height: 1
Bytes: 70
Declared type: image/png
The picture can be shown from this base64 in the page. SVG is refused because a document can carry scripts.
Use cases
- Checking a data URL before you drop it into a stylesheet.
- Seeing that a payload is 1 by 1 rather than the size you expected.
- Refusing SVG instead of rendering a document.
- Comparing the declared type with the bytes.
Tips & limitations
- Trust the sniffed format over the declared type.
- Do not paste SVG here.
- The byte count is the decoded file, not the base64 length.
- A header can parse even when the rest of the file is cut off.
FAQ
Why is SVG refused?
An SVG document can contain a script. This page only accepts PNG, JPEG and GIF.
What does Width 1 and Height 1 mean?
The sample file is a single pixel. The numbers come from the PNG header, not from a guess.
Does the declared type have to match?
No. Both are printed. If they disagree, the bytes are what the file is.
Will a huge photo be decoded?
Only up to about half a megabyte of base64 text. Larger files are refused.
Is the picture uploaded?
No. Decoding and the image element stay in the browser.
Can this recover a picture from a hash?
No. It needs the base64 of the file itself, not a checksum.
Runs entirely in your browser; nothing is uploaded. Check the output before you rely on it in production code, data or security decisions.