
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
Yet another Base64 transcoder.
$ npm install --save js-base64
Locally…
<script src="base64.js"></script>
… or Directly from CDN. In which case you don't even need to install.
<script src="https://cdn.jsdelivr.net/npm/js-base64@3.7.8/base64.min.js"></script>
This good old way loads Base64 in the global context (window). Though Base64.noConflict() is made available, you should consider using ES6 Module to avoid tainting window.
locally…
import { Base64 } from 'js-base64';
// or if you prefer no Base64 namespace
import { encode, decode } from 'js-base64';
or even remotely.
<script type="module">
// note jsdelivr.net does not automatically minify .mjs
import { Base64 } from 'https://cdn.jsdelivr.net/npm/js-base64@3.7.8/base64.mjs';
</script>
<script type="module">
// or if you prefer no Base64 namespace
import { encode, decode } from 'https://cdn.jsdelivr.net/npm/js-base64@3.7.8/base64.mjs';
</script>
const {Base64} = require('js-base64');
Unlike the case above, the global context is no longer modified.
You can also use esm to import instead of require.
require=require('esm')(module);
import {Base64} from 'js-base64';
let latin = 'dankogai';
let utf8 = '小飼弾'
let u8s = new Uint8Array([100,97,110,107,111,103,97,105]);
Base64.encode(latin); // ZGFua29nYWk=
Base64.encode(latin, true); // ZGFua29nYWk skips padding
Base64.encodeURI(latin); // ZGFua29nYWk
Base64.btoa(latin); // ZGFua29nYWk=
Base64.btoa(utf8); // raises exception
Base64.fromUint8Array(u8s); // ZGFua29nYWk=
Base64.fromUint8Array(u8s, true); // ZGFua29nYW which is URI safe
Base64.encode(utf8); // 5bCP6aO85by+
Base64.encode(utf8, true) // 5bCP6aO85by-
Base64.encodeURI(utf8); // 5bCP6aO85by-
Base64.decode( 'ZGFua29nYWk=');// dankogai
Base64.decode( 'ZGFua29nYWk'); // dankogai
Base64.atob( 'ZGFua29nYWk=');// dankogai
Base64.atob( '5bCP6aO85by+');// 'å°é£¼å¼¾' which is nonsense
Base64.toUint8Array('ZGFua29nYWk=');// u8s above
Base64.decode( '5bCP6aO85by+');// 小飼弾
// note .decodeURI() is unnecessary since it accepts both flavors
Base64.decode( '5bCP6aO85by-');// 小飼弾
Base64.isValid(0); // false: 0 is not string
Base64.isValid(''); // true: a valid Base64-encoded empty byte
Base64.isValid('ZA=='); // true: a valid Base64-encoded 'd'
Base64.isValid('Z A='); // true: whitespaces are okay
Base64.isValid('ZA'); // true: padding ='s can be omitted
Base64.isValid('++'); // true: can be non URL-safe
Base64.isValid('--'); // true: or URL-safe
Base64.isValid('+-'); // false: can't mix both
By default Base64 leaves built-in prototypes untouched. But you can extend them as below.
// you have to explicitly extend String.prototype
Base64.extendString();
// once extended, you can do the following
'dankogai'.toBase64(); // ZGFua29nYWk=
'小飼弾'.toBase64(); // 5bCP6aO85by+
'小飼弾'.toBase64(true); // 5bCP6aO85by-
'小飼弾'.toBase64URI(); // 5bCP6aO85by- ab alias of .toBase64(true)
'小飼弾'.toBase64URL(); // 5bCP6aO85by- an alias of .toBase64URI()
'ZGFua29nYWk='.fromBase64(); // dankogai
'5bCP6aO85by+'.fromBase64(); // 小飼弾
'5bCP6aO85by-'.fromBase64(); // 小飼弾
'5bCP6aO85by-'.toUint8Array();// u8s above
// you have to explicitly extend Uint8Array.prototype
Base64.extendUint8Array();
// once extended, you can do the following
u8s.toBase64(); // 'ZGFua29nYWk='
u8s.toBase64URI(); // 'ZGFua29nYWk'
u8s.toBase64URL(); // 'ZGFua29nYWk' an alias of .toBase64URI()
// extend all at once
Base64.extendBuiltins()
.decode() vs .atob (and .encode() vs btoa())Suppose you have:
var pngBase64 =
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=";
Which is a Base64-encoded 1x1 transparent PNG, DO NOT USE Base64.decode(pngBase64). Use Base64.atob(pngBase64) instead. Base64.decode() decodes to UTF-8 string while Base64.atob() decodes to bytes, which is compatible to browser built-in atob() (Which is absent in node.js). The same rule applies to the opposite direction.
Or even better, Base64.toUint8Array(pngBase64).
base64.mjs is compiled from base64.ts then base64.js is generated from base64.mjs.base64.js is ES5-compatible again (hence IE11-compatible).js-base64 switch to ES2015 module so it is no longer compatible with legacy browsers like IE (see above)The btoa package provides a polyfill for the btoa() function, which converts binary data to a Base64-encoded string. It is primarily intended for use in environments where the window.btoa function is not available, such as Node.js. It does not offer decoding functionality.
The atob package is the counterpart to btoa, providing a polyfill for the atob() function, which decodes a Base64-encoded string. Like btoa, it is intended for environments where the window.atob function is not available, and it only offers decoding functionality.
The base64-js package provides functions to encode and decode Base64 in a way that is highly compatible with the browser's built-in btoa and atob functions. It is designed to be more efficient by working with Typed Arrays, making it suitable for performance-critical applications that handle binary data.
The buffer package is a Node.js module that provides additional functionalities for manipulating binary data. It includes methods for encoding and decoding Base64 as part of its API. While it is more comprehensive than js-base64, it is also more complex and Node.js specific.
FAQs
Yet another Base64 transcoder in pure-JS
The npm package js-base64 receives a total of 9,863,899 weekly downloads. As such, js-base64 popularity was classified as popular.
We found that js-base64 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.