REGEXVAULTv2.0
Web & Network/URL
Verified Safe

Data URI (Base64) Regex for Python

/^data:([a-zA-Z][a-zA-Z0-9!#$&\-^_]{0,59}/[a-zA-Z][a-zA-Z0-9!#$&\-^_+.]{0,59});base64,([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/

What this pattern does

This page provides a comprehensive, battle-tested regular expression for matching data uri (base64), ported and verified for Python. A rigorously tested regex reduces debugging time and protects your application from edge-case failures. The snippet below is ready to drop into your Python project — whether you're validating in a Django view, a FastAPI endpoint, or a standalone data processing script.

Python Implementation

Python
# Data URI (Base64)
# ReDoS-safe | RegexVault — Web & Network > URL

import re

data_uri_base64_pattern = re.compile(r'^data:([a-zA-Z][a-zA-Z0-9!#$&\-^_]{0,59}/[a-zA-Z][a-zA-Z0-9!#$&\-^_+.]{0,59});base64,([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$')

def validate_data_uri_base64(value: str) -> bool:
    return bool(data_uri_base64_pattern.fullmatch(value))

# Example
print(validate_data_uri_base64("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="))  # True

Test Cases

Matches (Valid)
Rejects (Invalid)
data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==data:image/png,notbase64
data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==data:;base64,SGVsbG8=
data:image/gif;base64,R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs=https://example.com/image.png
data:image/png;base64,!!!invalid!!!

When to use this pattern

This pattern is drawn from the Web & Network > URL category and carries a ReDoS-safe certification. That matters for Python developers because particularly important in Python web servers where CPU-bound regex operations can stall concurrent request handling. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

Large data URIs inflate HTML size significantly. The base64 character class [A-Za-z0-9+/] does not allow URL-safe base64 variants (which use - and _ instead of + and /).

Technical Notes

Base64 padding (= or ==) is structurally validated. The MIME type is captured in group 1. Maximum practical data URI size is ~2MB for browser compatibility.

Have a pattern that belongs in the vault?

Submit it for review — community-verified patterns get credited to your GitHub handle. Free submissions join the queue. Priority review available for $15.

Submit a Pattern