Why do people convert files to base64 at all?
Usually because something in the chain only takes text. You are posting JSON to an API that has no file field, saving a small image in localStorage, or pasting an icon straight into CSS. Base64 turns any bytes into letters, digits, +, / and =, so the file fits anywhere a string fits.
The trouble starts when the same trick is used for an upload form. A visitor picks a 3 MB photo, your script turns it into a 4 MB string, and the backend refuses it or stores it as a wall of text, depending on the size. Before you write the conversion, it is worth knowing which method is safe for big files and what the string costs you on the wire. We measured both on 3 November 2026 in Chromium 153, Firefox 155 and WebKit 26.6.
How do you convert a file to base64 in JavaScript?
Pick a file with <input type="file"> and you get a File object. From there we tried the six methods that turn up most often in tutorials, on random files of 1 KiB, 100 KiB, 1 MiB and 5 MiB. Each result was compared with the base64 Node.js produced for the same file, and each time is the middle of three runs.
| Method | What happened |
|---|---|
FileReader.readAsDataURL(), then the part after the comma | Correct for all 4 sizes in 3 of 3 browsers. 75–139 ms for 5 MiB |
Uint8Array.prototype.toBase64() | Correct for all 4 sizes in 3 of 3 browsers. 60–84 ms for 5 MiB |
readAsBinaryString(), then btoa() | Correct, 3 of 3 browsers. 88–129 ms for 5 MiB |
Bytes in chunks of 32 KiB through String.fromCharCode, then btoa() | Correct, 3 of 3 browsers. 106–158 ms for 5 MiB |
reduce() over every byte into one string, then btoa() | Correct, but the slowest in 3 of 3 browsers. 412–842 ms for 5 MiB |
String.fromCharCode(...bytes), then btoa() | Worked at 1 KiB and 100 KiB. At 1 MiB it threw a RangeError in 3 of 3 browsers |
readAsDataURL() is the one to reach for first, because every browser has had it for years and it turned 5 MiB into base64 in under a fifth of a second. It gives you a data URL such as data:image/png;base64,iVBOR…, so drop everything up to the comma if the receiver wants plain base64. toBase64() is newer and was as quick or quicker; all three browsers we tested had it, but older ones do not, so feature-check it.
The last row is the one that bites people later. Spreading the bytes into String.fromCharCode passes every byte as a separate argument, and at 1 MiB that was too many arguments in every browser. The code works on your test icon and fails on a customer's scanned PDF. If you need the btoa() route, feed it in chunks, as in the fourth row. If you only need to send the file with a form, you can skip all of this; our article on the HTML file input shows what the browser already gives you.
How much bigger does base64 make a file?
About a third. Base64 writes every 3 bytes as 4 characters, so our 100 KiB file became 136,536 characters in all three browsers, 1.333 times the original. How you send that string adds a little more.
| How the file was sent | Request body |
|---|---|
The file itself in FormData (multipart) | 102,708 bytes, 1.003 times the file |
| Base64 in JSON | 136,569 bytes, 1.334 times |
| A data URL in JSON | 136,606 bytes, 1.334 times |
Base64 as a text field in FormData | 136,778 bytes, 1.336 times |
| Base64 in a hidden field of a normal form (URL-encoded) | 145,175 bytes, 1.418 times |
The worst row is the plain HTML form. A hidden field is sent URL-encoded, and every +, / and = in the base64 becomes a three-character escape, so the post grew to 1.418 times the file. The best row is no base64 at all: FormData with the file in it sent 308 bytes more than the file, which is the multipart wrapping and the name field.
That row also settles a claim that comes up in tutorials. Formspree's “How to Convert an Image URL to Base64” (28 August 2024) says multipart uploads often convert files to base64 on the client side. In our test they did not. The receiver found the file's raw bytes, unchanged, inside the request body in 3 of 3 browsers. The JavaScript FormData article covers why you should let the browser write that request's Content-Type header.
Should you send base64 to a form backend?
Usually not, and our test against Formgong shows why. Formgong is a form backend that sends each submission to your email or Telegram. We ran its own code locally and sent it the same PDFs both ways.
| What was sent | What Formgong did |
|---|---|
| 30 KiB PDF as a file (multipart) | Accepted. Stored as a 30,720-byte PDF attachment |
| The same PDF as a base64 data URL in JSON | Accepted as text. No attachment; the row held 41,023 characters of base64 |
| 47 KiB PDF as base64 in JSON | Accepted as text, 64,235 characters, no attachment |
| 49 KiB PDF as base64 in JSON | Refused with 413: over the 64 KB text limit |
| 4 MiB PDF as a file (multipart) | Accepted. Stored as a 4,194,304-byte PDF attachment |
A file sent as a file arrived as a PDF you can download. The same file as base64 arrived as 41,023 characters of text in the submission, which is what the owner would see in the message instead of an attachment. A slightly bigger file, 49 KiB, crossed the 64 KB limit for text and was refused. Formgong takes files only from multipart posts, up to 5 MiB each in a plain post, and it reads the bytes to check that a .pdf really is a PDF before it keeps it. None of that can happen to a string.
So keep base64 for what it is good at, such as small images inside JSON, CSS or a canvas preview, and send uploads as files. The contact form with file upload guide has a complete form, and the HTML forms docs list the fields Formgong reads.
// Two ways that worked for every file size in all three browsers.
function fileToBase64(file) {
return new Promise((resolve, reject) => {
const reader = new FileReader();
reader.onload = () => {
const dataUrl = reader.result; // "data:image/png;base64,iVBOR..."
resolve(dataUrl.slice(dataUrl.indexOf(",") + 1));
};
reader.onerror = () => reject(reader.error);
reader.readAsDataURL(file);
});
}
async function fileToBase64Native(file) {
// Newer built-in; check for it before you rely on it.
const bytes = new Uint8Array(await file.arrayBuffer());
return bytes.toBase64();
}
// Sending the file to a form backend? Skip base64 and send the file itself.
const form = document.querySelector("form");
form.addEventListener("submit", async (event) => {
event.preventDefault();
const response = await fetch(form.action, {
method: "POST",
body: new FormData(form), // the file goes as raw bytes
headers: { Accept: "application/json" },
});
console.log(response.status);
});Which form backends accept base64 files?
Some do. Formcarry's guide “How to upload files from your HTML form using Base64 encoding” (16 September 2021, updated 6 January 2023) says Formcarry accepts files sent as base64 data URLs and turns them into downloadable files, and it calls that a Pro feature. Formgong does not do this; a data URL sent to Formgong stays text, as the table above shows. If your stack can only produce base64, that is a real reason to pick a service that decodes it. What Formgong offers instead is the ordinary route done properly: real files over multipart on every plan, including Free, up to 3 per post, each checked by its first and last bytes against its extension before anyone downloads it. For most sites the file input already in your form is the better path anyway, because the request is a quarter smaller and the attachment arrives as an attachment.
Did base64 behave differently for you?
If one of these methods failed on a browser or file size we did not try, or your backend handles base64 in a way we did not cover, write to support@formgong.com. We will rerun the test with your case and add it here.
Frequently asked questions
How do I get base64 from a file input?
Read input.files[0] with FileReader.readAsDataURL() and keep the text after the comma. It worked for files up to 5 MiB in Chromium, Firefox and WebKit.
How much bigger is base64 than the file?
About 33%. Our 100 KiB file became 136,536 characters; in a URL-encoded form field the post grew to 1.42 times the file.
Why does String.fromCharCode(...bytes) throw a RangeError?
Spreading passes every byte as a separate argument. At 1 MiB that was too many in all three browsers. Convert in chunks or use readAsDataURL().
Do multipart uploads use base64?
No. In our test the file's raw bytes appeared unchanged in the request body in 3 of 3 browsers, with about 300 bytes of overhead.
Can I send base64 files to Formgong?
Not as files. Base64 arrives as text and is refused above the 64 KB text limit. Send the file itself in a multipart post instead.
Sources and documentation
Official references for this guide: Formgong: HTML file input: accept, multiple, capture and size checks, Formgong: JavaScript FormData and what fetch actually sends. HTML forms, where data is stored.
Related guides
- Lovable form submissions to email and Telegram
- HTML contact form without a backend: a working example
- How to send website form submissions to Telegram
- Contact form not sending email? Check where it stops
- Managing website leads in Telegram without a CRM
- Form backend for Lovable, Bolt, v0, Cursor
- Telegram bot for a contact form: build or skip?
- GDPR form backend: 7 checks before you choose
- Lovable form not sending email? 6 fixes
- Netlify Forms not working? React and Bolt fixes
- Stop contact form spam without a CAPTCHA
- GitHub Pages contact form: a working setup
- Mailto Form in HTML: Why It Fails and What to Use
- HTML form to Google Sheets: 2 free methods
- Webflow form submission limit: what to do at 50
- Turnstile vs reCAPTCHA vs hCaptcha for forms
- Contact Form 7 and Elementor forms to Telegram
- Squarespace contact form not sending email?
- Shopify contact form: where do messages go?
- Google Form to Telegram: free Apps Script way
- Wix contact form not sending email? Fixes
- EU / GDPR Formspree alternatives compared
- HTML form action attribute explained
- How do HTML forms work? The HTTP request
- Types of Injection Attacks on Web Forms (2026)
- Indirect Prompt Injection in MCP
- MCP Rug Pull Attack: Detect Tool Changes
- Form without a backend: 7 ways that work
- Thank-you page after form submission (HTML)
- Indirect Prompt Injection Examples (2023–2026)
- Indirect Prompt Injection via Email
- What Is Tool Poisoning in MCP?
- WordPress contact form without a plugin
- Send email from frontend JavaScript
- How to Prevent Indirect Prompt Injection
- Honeypot Form Field: How to Add One That Works
- Contact Form with File Upload (HTML, No PHP)
- Angular contact form without a backend
- Send form submissions to Slack or Discord without Zapier
- Verify a form webhook signature (HMAC-SHA256)
- Contact forms that send nothing: 793 AI-built sites tested
- v0 contact form that actually sends: 3 ways
- How we tested AI-built contact forms, and 12 bugs we hit
- Cloudflare vs Netlify free plan: hosting that never pauses
- EmailJS 412 “Gmail_API: Invalid grant”: reconnect Gmail
- Resend “You can only send testing emails”: verify a domain
- Supabase Edge Function blocked by CORS policy: 3 causes
- Formspree “Form not found” and other errors: fixes
- Web3Forms errors: “Invalid access key” and 403 explained
- How to add customer reviews to your website for free
- Getform not working? “This form has been deleted” and more
- Next.js contact form not working? 6 errors, reproduced
- Webflow form not sending email? What to check, tested
- FormSubmit not working? “This form needs Activation” fix
- Contact form “TypeError: Failed to fetch”: causes and fixes
- WooCommerce product enquiry form
- Contact Form 7 vs WPForms
- Gravity Forms alternative free
- WordPress contact form block
- 535-5.7.8 Username and Password not accepted (Gmail)
- 535 5.7.3 Authentication unsuccessful: Office 365 SMTP
- Nodemailer “Missing credentials for "PLAIN"”: the fix
- Nodemailer “Greeting never received”: port 465 fix
- Nodemailer SSL “wrong version number”: the port fix
- Nodemailer “self-signed certificate in certificate chain”
- Nodemailer ECONNREFUSED 127.0.0.1:587: missing SMTP host
- SendGrid “authorization grant is invalid”: 401 fix
- Mailgun 401 Forbidden: why the API rejects your key
- “Edge Function returned a non-2xx status code”: the fix
- Next.js “Body exceeded 1 MB limit”: Server Action fix
- Unexpected token '<', "<!DOCTYPE "... is not valid JSON
- “TypeError: Body is unusable”: body has already been read
- Turnstile “timeout-or-duplicate” and other siteverify errors
- Turnstile vs hCaptcha vs reCAPTCHA: speed and size tested
- Judge.me reviews not showing on Shopify: how to fix it
- Judge.me review carousel not showing: how to fix it
- Yotpo reviews not showing on Shopify? Check the app embed
- Loox reviews not showing on product page: how to fix
- Shopify reviews not showing: what to check first
- How to show reviews on Shopify
- GDPR for website forms: what each type of form needs
- WooCommerce reviews not showing: how to fix it
- Stamped.io reviews not showing on Shopify: how to fix it
- Etsy reviews not showing: why and what to do
- Trustpilot widget not loading: how to fix TrustBox
- Yotpo problems in 2026: what merchants report
- Contact Form 7 “error trying to send your message” fix
- Elementor form “Your submission failed because of an error”
- Framer form not sending email or not working: what to check
- Carrd contact form not working: plans, spam and errors
- Google review link not working: what customers see and why
- tawk.to widget not showing on your website: causes and fixes
- How to add questions and answers to your product page
- “Failed to send a request to the Edge Function”: fixes
- Next.js “Failed to find Server Action”: what it means
- Brevo “unauthorized: Key not found” 401: the fix
- Amazon SES “Email address is not verified”: the fix
- Shopify contact form not working: how to fix it
- Judge.me alternative for WooCommerce after the 2025 shutdown
- Free WooCommerce review plugins compared on the free version
- WooCommerce review reminder emails without a paid plugin
- Add Voice Recording to a Website Form
- Contact Form 7 spam: how to stop it
- WPForms not sending email: how to fix it
- Contact form emails going to spam: how to fix it
- HTML form not submitting: how to fix it
- Contact form not working: how to find the fault
- Webflow form spam: how to stop it
- Website form to Notion: how to set it up
- Website form to WhatsApp: what works and what does not
- What 1-star reviews say about AI support chatbots
- Which free form backend gives you the most submissions?
- Elfsight reviews widget not showing? Check the view limit
- Next.js contact form backend vs Server Actions
- Review stars not showing in Google search results
- How to stop duplicate form submissions
- How to see which form leads came from ChatGPT
- What happens when a form webhook fails
- When to send a review request email after an order
- How to collect video testimonials for free
- Add contact form sign-ups to Mailchimp or Klaviyo
- How to migrate from Formspree without losing submissions
- How to get a Google review link for your business
- What is a headless form backend?
- Is it safe to put a form access key in your HTML?
- AI chatbot that answers only from your website
- Minified React error #441 in Next.js
- Squarespace product reviews after Judge.me
- Accessible contact form checklist for WCAG 2.2
- How to ask a client for a testimonial by email
- How to respond to negative reviews, with examples
- 429 Too Many Requests on a contact form
- MCP server for forms in Cursor and Claude
- Can you offer a discount for a review?
- Do EU stores have to say if reviews are verified?
- Webflow form backend options compared
- How to add review schema JSON-LD to a product page
- How to turn a customer review into an Instagram post
- How to make a QR code for Google reviews
- Live chat or chatbot for a small business website
- Why people abandon your contact form halfway
- Which form backend do AI assistants pick? 54 answers
- PHP mail() not sending email, even when it returns true
- What “Failed to fetch” means, tested in three browsers
- 405 Method Not Allowed when you submit a form
- Send a contact form to more than one email address
- What is review syndication, and who needs it?
- How to save HTML form data to a database
- NetworkError when attempting to fetch resource
- Send product reviews to Google Merchant Center
- PHPMailer not working on a live server
- AI review reply generator: does it help?
- React 19 contact form with useActionState
- Astro Actions or a form backend?
- Is no-reply@wixsiteautomations.com legit?
- Where to find the Judge.me review widget code
- AI review summaries: what shoppers actually see
- Photo reviews for WooCommerce, and the GPS inside them
- Review request email templates you can copy
- Reviews in AI search: what ChatGPT and Perplexity cite
- Lead capture form with UTM tracking, built and tested
- Form design best practices, with our own form data
- Client intake form template with file upload
- What is social proof? Meaning and examples
- What is user-generated content (UGC)?
- Benefits of negative reviews for your store
- How to get your first reviews as a new store
- How to use customer reviews in your marketing
- How to get more customer reviews
- React form validation without a library, tested
- jQuery submit form with validation
- reCAPTCHA v3 setup with the server score check
- Shopify social proof that shoppers can check
- HTML file input: accept, multiple, capture and size checks
- How to add hCaptcha to a form, with the server check
- How to add invisible reCAPTCHA to a form
- Bug report form template with browser details
- What the FTC fake reviews rule bans for online stores
- How to show reviews on your homepage
- Do reviews increase sales? What the studies show
- HTML input types and what each one sends
- HTML textarea, tested in a real form
- HTML dropdown menu in a form, tested
- Do reviews help SEO? What Google says and shows
- How to add a review carousel people can read
- Product review examples that help shoppers decide
- Which trust badges actually mean something
- Customer satisfaction survey with CSAT and NPS
- JavaScript FormData and what fetch actually sends
- JavaScript form validation without a library
- Server-side form validation and what it catches
- Email validation in JavaScript, tested on 33 addresses
- Zod form validation with FormData, tested
- Store reviews vs product reviews
- How to send review requests through Klaviyo
- How to tag customer reviews by topic and mood
- Custom review form questions worth asking
- Online reputation management for small businesses
- HTML radio button groups and what they send
- HTML label tag and what screen readers hear
- HTML autocomplete attribute, tested with Chrome autofill
- HTML fieldset and legend, and what disabled leaves out
- HTML button tag and what a form button sends
- Vite contact form that still works after the build
- How to test a contact form, end to end
- How to embed a Google Form, and what it loads
- Customer feedback questions that get real answers
- FilePond with a form backend, and when to skip it
- Bootstrap form validation and server errors
- Tailwind form validation, tested in three browsers
- Donation form in HTML, and where the payment goes
- How to ask for a review in person or by text
- Which review sites matter for your business
- What are customer reviews, and which kinds count
- Online review statistics, checked at the source
- Best review app for Shopify and WooCommerce
- Why Gmail sends your self-hosted mail to spam
- htmx contact form that sends to another domain
- AI form builders tested, from prompt to sent form
- Headless WordPress forms with Contact Form 7, tested
- React Hook Form watch vs useWatch, and what gets sent
- Elfsight widget not working? It vanishes when views run out
- Jotform not sending emails? Check Jotform's bounce list
- Typeform not working? A white box means a blocked script
- Positive review response examples that don't sound copied
- How to remove a Google review when you can't delete it
- Google reviews not showing up? 8 causes to check in order
- Is buying Google reviews illegal? Even a review swap counts
- Which reviews can you hide? A review moderation checklist
- Average star rating: what 4.8 from 5 reviews means
- Reviews on a product page: where and how many to show
- SaaS testimonials: 3 of 27 had a number in them
- Do reviews reduce returns? Not when they're too good
- Testimonial examples for business: what makes one believable
- Testimonial questions to ask clients, by type of business
- Testimonial page design: a page or a section?
- Testimonial advertising rules: what the FTC requires
- Form submission canceled because the form is not connected
- Input type date format dd/mm/yyyy: what you can change
- How to disable textarea resize, or allow only vertical
- How to prevent Enter from submitting a form
- form.submit() vs requestSubmit(): what submit() skips
- Custom HTML checkbox CSS that doesn't break required
- How to reset a form after submit, and what reset() keeps
- Input type number maxlength not working? What to use
- How to create an HTML form, step by step
- Best form builder: free plans and branding, checked
- Best WordPress contact form plugin: 10 free ones compared
- How to increase form conversion rate: start with the count
- Form backend vs form builder: which one do you need?
- WordPress contact form not sending email? 3 plugins tested
- Contact Form 7 webhook? Turning it on switched our email off
- Gravity Forms webhook: what it sends and the URLs it rejects