# Data URI Key: `technology.internet.data_uri` Inline data URI scheme embedding content directly in a string. Format: data:\[mediatype\]\[;base64\],data. Used for embedding small files in HTML, CSS, and API responses. Page: Samples: `data:text/plain;base64,SGVsbG8gV29ybGQ=`, `data:image/png;base64,iVBORw0KGgoAAAANSUhEUg==`, `data:application/json,{"key":"value"}`, `data:text/html,%3Ch1%3EHello%3C%2Fh1%3E` ## Background ### Origin The data URL scheme is defined in RFC 2397, The "data" URL scheme, published in August 1998.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 was written by L. Masinter of Xerox Corporation.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 says the scheme exists because some applications that use URLs need to embed small media type data directly inline.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 describes the scheme as working like 'immediate addressing'.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 records that the idea was originally proposed in August 1995.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 says some versions of the data URL scheme have been used in the definition of VRML.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 notes that quoted-printable was dropped as an encoding because it would not easily yield valid URLs without additional %xx encoding.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 gives the form data:\[\\]\[;base64\],\.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) Under RFC 2397, an omitted media type defaults to text/plain;charset=US-ASCII.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 says the ;base64 extension is told apart from a content-type parameter by having no following = sign.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) RFC 2397 says the data URL scheme is only useful for short values.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) The Fetch Standard from the WHATWG states that its data: URL section replaces RFC 2397's normative processing requirements, to be compatible with deployed content.[[2]](https://fetch.spec.whatwg.org/) MDN says data URLs were formerly known as data URIs until that name was retired by the WHATWG.[[3]](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data) ### Use MDN describes data URLs as allowing content creators to embed small files inline in documents.[[3]](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data) The CSS url() function accepts a data URL as its parameter, according to MDN.[[4]](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Values/url_function) RFC 2397 shows a data URL used as the SRC of an HTML IMG element to carry a small inline GIF image.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) Wikipedia notes that Base64-encoded data is approximately 33% larger than the original data.[[5]](https://en.wikipedia.org/wiki/Data_URI_scheme) Without ;base64, RFC 2397 says octets outside the range of safe URL characters are written with the standard %xx hex encoding of URLs.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) Wikipedia notes that Base64-encoded data URIs use the standard Base64 character set, with + and /, rather than the URL-safe Base64 alphabet.[[5]](https://en.wikipedia.org/wiki/Data_URI_scheme) MDN warns that invalid parameters in the media type, or typos in base64, are ignored without any error.[[3]](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data) The Fetch Standard's processor falls back to text/plain;charset=US-ASCII when the media type cannot be parsed.[[2]](https://fetch.spec.whatwg.org/) MDN reports that Chromium and Firefox limit data URLs to 512MB, and Safari (WebKit) limits them to 2048MB.[[3]](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data) MDN reports that top-level navigation to data: URLs is blocked in all modern browsers, because of security issues such as phishing.[[3]](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data) RFC 2397 says interpreting a data URL carries the same security considerations as any implementation of its media type.[[1]](https://www.rfc-editor.org/rfc/rfc2397.txt) Treat a decoded data URI as an untrusted file of the type it claims, and check the decoded bytes rather than trusting the declared media type. (Meridian's view) ## Sources 1. [The "data" URL scheme](https://www.rfc-editor.org/rfc/rfc2397.txt) — standard 2. [Fetch Standard](https://fetch.spec.whatwg.org/) — standard 3. [data: URLs - URIs \| MDN](https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/data) — documentation 4. [url() CSS function - CSS \| MDN](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Values/url_function) — documentation 5. [data URI scheme - Wikipedia](https://en.wikipedia.org/wiki/Data_URI_scheme) — secondary source