Local encode and decode
SVG to Data URI
Paste or upload an SVG and copy a data:image/svg+xml URI, or paste a URI and get the SVG back. Both directions run in this tab.
The default output is the sanitized SVG. Warnings list anything the sanitizer removed. A file with a javascript: URL or an external reference is rejected, and the page does not download the original markup.
Data URI
Runs in your browser. Your SVG is not uploaded.
Waiting for an SVG
Mode
Encoding
UTF-8 writes data:image/svg+xml,… and Base64 writes data:image/svg+xml;base64,…. The default is UTF-8. Output is the sanitized SVG.
Limit 500 KB and 10,000 elements. javascript: URLs and external references are rejected. The download is the sanitized data URI, not the original file.
Data URI
The data URI will appear here.
UTF-8 and base64
The UTF-8 form starts with data:image/svg+xml, and percent-encodes the sanitized SVG. The base64 form starts with data:image/svg+xml;base64,. Hash references such as url(#id) are encoded so the fragment stays part of the SVG. The byte counts are the sanitized SVG and the data URI. The URI is larger than the SVG.
Decode accepts those prefixes and an optional charset=utf-8 parameter. A javascript: URL, an HTML data URI, a PNG data URI, or any other scheme is rejected before it is treated as an SVG.
What is encoded
The sanitizer runs first. Scripts, event handlers, and embedded HTML are removed, and the page lists those warnings. javascript: URLs, vbscript: URLs, and external href, src, and CSS url() references are rejected instead of being silently stripped into a download. Malformed XML, a document type, or an entity declaration is rejected, and the page shows that error instead of a file.
Need a React component instead? Use the converter, the JSX page, or the TSX page. The optimizer and PNG export are separate tools.
Limits
- 500 KB per SVG. Larger files are rejected before encoding.
- 10,000 elements. A larger tree is rejected.
- javascript: URLs, vbscript: URLs, and external references are rejected.
- Malformed XML, a document type, or an entity declaration is rejected.
- The copy and download actions use the sanitized result. The original input is not offered as a file.
Questions
Is my SVG uploaded?
No. Encoding and decoding run in this browser tab. The SVG is not sent to a server, saved in a database, or sent to analytics. Copy and download stay on your device. Closing the tab discards the file.
Which data URI forms are supported?
Encode writes a UTF-8 data:image/svg+xml,… URI or a base64 data:image/svg+xml;base64,… URI. UTF-8 is the default. Decode accepts those forms, including an optional charset=utf-8 parameter. Other schemes and media types are rejected.
What is rejected?
Files over 500 KB are rejected before encoding. javascript: and vbscript: URLs, external references, malformed XML, a document type, and a non-svg root are rejected. The page does not offer that input as a download.
Do scripts stay in the data URI?
No. The same sanitizer as the converter runs before encoding and before a decoded SVG is shown. Scripts, event handlers, and embedded HTML are removed. Warnings list what was removed. The copy and download buttons use that sanitized result, not the original file.