Data URLs , URLs prefixed with the data: scheme, allow content creators to embed small files inline in documents. They were formerly known as "data URIs" until that name was retired by the WHATWG.

注意 : Data URLs are treated as unique opaque origins by modern browsers, rather than inheriting the origin of the settings object responsible for the navigation.

句法

Data URLs are composed of four parts: a prefix ( data: ), a MIME type indicating the type of data, an optional base64 token if non-textual, and the data itself:

data:[<mediatype>][;base64],<data>
					

mediatype MIME type string, such as 'image/jpeg' for a JPEG image file. If omitted, defaults to text/plain;charset=US-ASCII

If the data is textual, you can simply embed the text (using the appropriate entities or escapes based on the enclosing document's type). Otherwise, you can specify base64 to embed base64-encoded binary data. You can find more info on MIME types here and here .

A few examples:

data:,Hello%2C%20World!
Simple text/plain data. Note the use of percent-encoding (URL-encoding) for the quote and space characters. Also, for CSV data (MIME type "text/csv"), percent-encoding is needed to preserve the line endings that delimit rows of the spreadsheet.
data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==

base64-encoded version of the above

data:text/html,%3Ch1%3EHello%2C%20World!%3C%2Fh1%3E
An HTML document with <h1>Hello, World!</h1>
data:text/html,<script>alert('hi');</script>

An HTML document that executes a JavaScript alert. Note that the closing script tag is required.

Encoding data into base64 format

Base64 is a group of binary-to-text encoding schemes that represent binary data in an ASCII string format by translating it into a radix-64 representation. By consisting only in ASCII characters, base64 strings are generally url-safe, and that's why they can be used to encode data in Data URLs.

Encoding in Javascript

The Web APIs have native methods to encode or decode to base64: Base64 encoding and decoding .

Encoding on a Unix system

Base64 encoding of a file or string on Linux and Mac OS X systems can be achieved using the command-line base64 (or, as an alternative, the uuencode utility with -m argument).

echo -n hello|base64
# outputs to console: aGVsbG8=
echo -n hello>a.txt
base64 a.txt
# outputs to console: aGVsbG8=
base64 a.txt>b.txt
# outputs to file b.txt: aGVsbG8=
					

Encoding on Microsoft Windows

Encoding on Windows can be done through powershell or some dedicated tool. It can even be done via bash base64 utility (see section Encoding on a Unix system) if WSL is activated.

[convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("hello"))
# outputs to console: aGVsbG8=
bash -c "echo -n hello`|base64"
# outputs to console: aGVsbG8=
# the backtick (`) is used to escape the piping (|) character here
					

Common problems

This section describes problems that commonly occur when creating and using data URLs.

data:text/html,lots of text...<p><a name%3D"bottom">bottom</a>?arg=val
					

This represents an HTML resource whose contents are:

lots of text...<p><a name="bottom">bottom</a>?arg=val
					
句法
The format for data URLs is very simple, but it's easy to forget to put a comma before the "data" segment, or to incorrectly encode the data into base64 format.
Formatting in HTML
A data URL provides a file within a file, which can potentially be very wide relative to the width of the enclosing document. As a URL, the data should be formatable with whitespace (linefeed, tab, or spaces), but there are practical issues that arise when using base64 encoding .
Length limitations
Although Firefox supports data URLs of essentially unlimited length, browsers are not required to support any particular maximum length of data. For example, the Opera 11 browser limited URLs to 65535 characters long which limits data URLs to 65529 characters (65529 characters being the length of the encoded data, not the source, if you use the plain data: , without specifying a MIME type).
Lack of error handling
Invalid parameters in media, or typos when specifying 'base64' , are ignored, but no error is provided.
No support for query strings, etc.

The data portion of a data URL is opaque, so an attempt to use a query string (page-specific parameters, with the syntax <url>?parameter-data ) with a data URL will just include the query string in the data the URL represents.

Security issues
A number of security issues (e.g. phishing) have been associated with data URLs, and navigating to them in the browser's top level. To mitigate such issues, top-level navigation to data:// URLs has been blocked in Firefox 59+ (release version, Nightly/Beta from 58), and we hope to see other browsers follow suit soon. See Blocking Top-Level Navigations to data URLs for Firefox 58 了解更多细节。

规范

规范 Title
RFC 2397 The "data" URL scheme

浏览器兼容性

更新 GitHub 上的兼容性数据
Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari Android webview Chrome for Android Firefox for Android Opera for Android Safari on iOS Samsung Internet
data URL scheme Chrome 完整支持 Yes Edge 完整支持 12 注意事项
完整支持 12 注意事项
注意事项 The maximum size supported is 4GB
Firefox 完整支持 Yes IE 完整支持 8 注意事项
完整支持 8 注意事项
注意事项 The maximum size supported is 32kB
Opera 完整支持 7.2 Safari 完整支持 Yes WebView Android 完整支持 Yes Chrome Android 完整支持 Yes Firefox Android 完整支持 Yes Opera Android 完整支持 Yes Safari iOS 完整支持 Yes Samsung Internet Android 完整支持 Yes
CSS files Chrome 完整支持 Yes Edge 完整支持 12 注意事项
完整支持 12 注意事项
注意事项 The maximum size supported is 4GB
Firefox 完整支持 Yes IE 完整支持 8 注意事项
完整支持 8 注意事项
注意事项 The maximum size supported is 32kB
完整支持 9 注意事项
注意事项 The maximum size supported is 4GB
Opera 完整支持 7.2 Safari 完整支持 Yes WebView Android 完整支持 Yes Chrome Android 完整支持 Yes Firefox Android 完整支持 Yes Opera Android 完整支持 Yes Safari iOS 完整支持 Yes Samsung Internet Android 完整支持 Yes
HTML files Chrome 完整支持 Yes Edge 完整支持 79 Firefox 完整支持 Yes IE 不支持 No Opera 完整支持 Yes Safari 完整支持 Yes WebView Android 完整支持 Yes Chrome Android 完整支持 Yes Firefox Android 完整支持 Yes Opera Android 完整支持 Yes Safari iOS 完整支持 Yes Samsung Internet Android 完整支持 Yes
JavaScript files Chrome 完整支持 Yes Edge 完整支持 12 注意事项
完整支持 12 注意事项
注意事项 The maximum size supported is 4GB
Firefox 完整支持 Yes IE 完整支持 9 注意事项
完整支持 9 注意事项
注意事项 The maximum size supported is 4GB
Opera 完整支持 7.2 Safari 完整支持 Yes WebView Android 完整支持 Yes Chrome Android 完整支持 Yes Firefox Android 完整支持 Yes Opera Android 完整支持 Yes Safari iOS 完整支持 Yes Samsung Internet Android 完整支持 Yes
Top-level navigation blocked to data:// URIs Chrome 完整支持 60 Edge 完整支持 ≤79 Firefox 完整支持 59 IE 不支持 No Opera 完整支持 47 Safari ? WebView Android 不支持 No Chrome Android 完整支持 60 Firefox Android 完整支持 59 Opera Android 完整支持 44 Safari iOS ? Samsung Internet Android 完整支持 8.0

图例

完整支持

完整支持

不支持

不支持

兼容性未知 ?

兼容性未知

见实现注意事项。

见实现注意事项。

另请参阅

元数据

  • 最后修改:
  1. HTTP
  2. Guides:
  3. Resources and URIs
    1. Identifying resources on the Web
    2. Data URIs
    3. Introduction to MIME Types
    4. Complete list of MIME Types
    5. Choosing between www and non-www URLs
  4. HTTP guide
    1. Basics of HTTP
    2. HTTP 概述
    3. Evolution of HTTP
    4. HTTP Messages
    5. A typical HTTP session
    6. Connection management in HTTP/1.x
    7. Protocol upgrade mechanism
  5. HTTP 安全性
    1. Content Security Policy (CSP)
    2. HTTP Public Key Pinning (HPKP)
    3. HTTP Strict Transport Security (HSTS)
    4. Cookie security
    5. X-Content-Type-Options
    6. X-Frame-Options
    7. X-XSS-Protection
    8. Mozilla web security guidelines
    9. Mozilla Observatory
  6. HTTP access control (CORS)
  7. HTTP authentication
  8. HTTP caching
  9. HTTP compression
  10. HTTP conditional requests
  11. HTTP content negotiation
  12. HTTP cookies
  13. HTTP range requests
  14. HTTP redirects
  15. HTTP specifications
  16. Feature policy
  17. 参考:
  18. HTTP 头
    1. Accept
    2. Accept-CH
    3. Accept-CH-Lifetime
    4. Accept-Charset
    5. Accept-Encoding
    6. Accept-Language
    7. Accept-Patch
    8. Accept-Ranges
    9. Access-Control-Allow-Credentials
    10. Access-Control-Allow-Headers
    11. Access-Control-Allow-Methods
    12. Access-Control-Allow-Origin
    13. Access-Control-Expose-Headers
    14. Access-Control-Max-Age
    15. Access-Control-Request-Headers
    16. Access-Control-Request-Method
    17. Age
    18. Allow
    19. Alt-Svc
    20. Authorization
    21. Cache-Control
    22. Clear-Site-Data
    23. Connection
    24. Content-Disposition
    25. Content-Encoding
    26. Content-Language
    27. Content-Length
    28. Content-Location
    29. Content-Range
    30. Content-Security-Policy
    31. Content-Security-Policy-Report-Only
    32. Content-Type
    33. Cookie
    34. Cookie2
    35. Cross-Origin-Embedder-Policy
    36. Cross-Origin-Opener-Policy
    37. Cross-Origin-Resource-Policy
    38. DNT
    39. DPR
    40. Date
    41. Device-Memory
    42. Digest
    43. ETag
    44. Early-Data
    45. Expect
    46. Expect-CT
    47. Expires
    48. Feature-Policy
    49. Forwarded
    50. From
    51. Host
    52. If-Match
    53. If-Modified-Since
    54. If-None-Match
    55. If-Range
    56. If-Unmodified-Since
    57. 索引
    58. Keep-Alive
    59. Large-Allocation
    60. Last-Modified
    61. Link
    62. Location
    63. NEL
    64. Origin
    65. Pragma
    66. Proxy-Authenticate
    67. Proxy-Authorization
    68. Public-Key-Pins
    69. Public-Key-Pins-Report-Only
    70. Range
    71. Referer
    72. Referrer-Policy
    73. Retry-After
    74. Save-Data
    75. Sec-Fetch-Dest
    76. Sec-Fetch-Mode
    77. Sec-Fetch-Site
    78. Sec-Fetch-User
    79. Sec-WebSocket-Accept
    80. Server
    81. Server-Timing
    82. Set-Cookie
    83. Set-Cookie2
    84. SourceMap
    85. Strict-Transport-Security
    86. TE
    87. Timing-Allow-Origin
    88. Tk
    89. Trailer
    90. Transfer-Encoding
    91. Upgrade-Insecure-Requests
    92. User-Agent
    93. Vary
    94. Via
    95. WWW-Authenticate
    96. Want-Digest
    97. 警告
    98. X-Content-Type-Options
    99. X-DNS-Prefetch-Control
    100. X-Forwarded-For
    101. X-Forwarded-Host
    102. X-Forwarded-Proto
    103. X-Frame-Options
    104. X-XSS-Protection
  19. HTTP 请求方法
    1. CONNECT
    2. DELETE
    3. GET
    4. HEAD
    5. OPTIONS
    6. PATCH
    7. POST
    8. PUT
    9. TRACE
  20. HTTP 响应状态码
    1. 100 Continue
    2. 101 Switching Protocols
    3. 103 Early Hints
    4. 200 OK
    5. 201 Created
    6. 202 Accepted
    7. 203 Non-Authoritative Information
    8. 204 No Content
    9. 205 Reset Content
    10. 206 Partial Content
    11. 300 Multiple Choices
    12. 301 Moved Permanently
    13. 302 Found
    14. 303 See Other
    15. 304 Not Modified
    16. 307 Temporary Redirect
    17. 308 Permanent Redirect
    18. 400 Bad Request
    19. 401 Unauthorized
    20. 402 Payment Required
    21. 403 Forbidden
    22. 404 Not Found
    23. 405 Method Not Allowed
    24. 406 Not Acceptable
    25. 407 Proxy Authentication Required
    26. 408 Request Timeout
    27. 409 Conflict
    28. 410 Gone
    29. 411 Length Required
    30. 412 Precondition Failed
    31. 413 Payload Too Large
    32. 414 URI Too Long
    33. 415 Unsupported Media Type
    34. 416 Range Not Satisfiable
    35. 417 Expectation Failed
    36. 418 I'm a teapot
    37. 422 Unprocessable Entity
    38. 425 Too Early
    39. 426 Upgrade Required
    40. 428 Precondition Required
    41. 429 Too Many Requests
    42. 431 Request Header Fields Too Large
    43. 451 Unavailable For Legal Reasons
    44. 500 Internal Server Error
    45. 501 Not Implemented
    46. 502 Bad Gateway
    47. 503 Service Unavailable
    48. 504 Gateway Timeout
    49. 505 HTTP Version Not Supported
    50. 506 Variant Also Negotiates
    51. 507 Insufficient Storage
    52. 508 Loop Detected
    53. 510 Not Extended
    54. 511 Network Authentication Required
  21. CSP directives
    1. CSP: base-uri
    2. CSP: block-all-mixed-content
    3. CSP: child-src
    4. CSP: connect-src
    5. CSP: default-src
    6. CSP: font-src
    7. CSP: form-action
    8. CSP: frame-ancestors
    9. CSP: frame-src
    10. CSP: img-src
    11. CSP: manifest-src
    12. CSP: media-src
    13. CSP: navigate-to
    14. CSP: object-src
    15. CSP: plugin-types
    16. CSP: prefetch-src
    17. CSP: referrer
    18. CSP: report-to
    19. CSP: report-uri
    20. CSP: require-sri-for
    21. CSP: sandbox
    22. CSP: script-src
    23. CSP: script-src-attr
    24. CSP: script-src-elem
    25. CSP: style-src
    26. CSP: style-src-attr
    27. CSP: style-src-elem
    28. CSP: trusted-types
    29. CSP: upgrade-insecure-requests
    30. CSP: worker-src
  22. CORS errors
    1. Reason: CORS disabled
    2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
    3. Reason: CORS header 'Access-Control-Allow-Origin' missing
    4. Reason: CORS header ‘Origin’ cannot be added
    5. Reason: CORS preflight channel did not succeed
    6. Reason: CORS request did not succeed
    7. Reason: CORS request external redirect not allowed
    8. Reason: CORS request not HTTP
    9. Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’
    10. Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’
    11. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
    12. Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’
    13. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’
    14. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Methods’
    15. Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel
  23. Feature-Policy directives
    1. Feature-Policy: accelerometer
    2. Feature-Policy: ambient-light-sensor
    3. Feature-Policy: autoplay
    4. Feature-Policy: battery
    5. Feature-Policy: camera
    6. Feature-Policy: display-capture
    7. Feature-Policy: document-domain
    8. Feature-Policy: encrypted-media
    9. Feature-Policy: fullscreen
    10. Feature-Policy: geolocation
    11. Feature-Policy: gyroscope
    12. Feature-Policy: layout-animations
    13. Feature-Policy: legacy-image-formats
    14. Feature-Policy: magnetometer
    15. Feature-Policy: microphone
    16. Feature-Policy: midi
    17. Feature-Policy: oversized-images
    18. Feature-Policy: payment
    19. Feature-Policy: picture-in-picture
    20. Feature-Policy: publickey-credentials-get
    21. Feature-Policy: screen-wake-lock
    22. Feature-Policy: sync-xhr
    23. Feature-Policy: unoptimized-images
    24. Feature-Policy: unsized-media
    25. Feature-Policy: usb
    26. Feature-Policy: vibrate
    27. Feature-Policy: vr
    28. Feature-Policy: wake-lock
    29. Feature-Policy: xr
    30. Feature-Policy: xr-spatial-tracking
    31. web-share

Copyright  © 2014-2026 乐数软件    

工业和信息化部: 粤ICP备14079481号-1