Node.js Buffer

Node.js Buffer: Working with Raw Binary Data

JavaScript strings use UTF-16 text encoding, which cannot cleanly represent raw TCP packets, PNG images, or cryptographic hashes. Node.js provides the global Buffer class—a fixed-length chunk of memory backed by Uint8Array—to read, convert, and manipulate raw binary bytes directly.

Creating and Converting Buffers

Always use the safe factory methods Buffer.from(), Buffer.alloc(), and Buffer.concat(). Never use the deprecated new Buffer() constructor, which had security leaks on uninitialized memory.

// 1. Convert UTF-8 text to a Buffer and encode as Base64 or Hex
const textBuf = Buffer.from('Node.js Binary Data', 'utf8');
console.log('Byte length:', textBuf.length);
console.log('Base64:', textBuf.toString('base64'));
console.log('Hex:', textBuf.toString('hex'));

// 2. Decode Base64 back into UTF-8 text
const decoded = Buffer.from(textBuf.toString('base64'), 'base64').toString('utf8');
console.log('Decoded:', decoded);

// 3. Allocate a zero-filled 8-byte buffer
const emptyBuf = Buffer.alloc(8);
emptyBuf.writeUInt16BE(404, 0);
console.log('First 2 bytes:', emptyBuf.readUInt16BE(0));

Checking Byte Length vs String Character Length

Because multi-byte UTF-8 characters like emojis or Bangla letters use 2 to 4 bytes each, 'Hi 🚀'.length is 5 UTF-16 code units, whereas Buffer.byteLength('Hi 🚀', 'utf8') is 7 actual bytes. Always use Buffer.byteLength() when setting HTTP Content-Length headers or checking payload limits.

Common Mistakes to Avoid

• Using Buffer.allocUnsafe() without overwriting every byte: allocUnsafe() skips zeroing RAM for speed and may contain leftover data from earlier memory allocations. Stick to Buffer.alloc() unless writing performance-critical low-level parsers.
• Splitting multi-byte UTF-8 chunks across stream packets naively: Calling chunk.toString('utf8') on arbitrary TCP chunks can split a 4-byte emoji in half and produce `` replacement characters. Use StringDecoder or collect chunks with Buffer.concat() first.
• Comparing secret tokens with === on strings: Use crypto.timingSafeEqual(bufA, bufB) on equal-length Buffers to prevent timing attacks.

Frequently Asked Questions

Is Buffer a subclass of Uint8Array?

Yes. Every Node.js Buffer is an instance of Uint8Array, so standard typed-array methods and Web APIs like TextEncoder interoperate cleanly.

How do I combine an array of Buffer chunks from a stream?

Call Buffer.concat(chunks) once the stream emits 'end', which allocates one combined Buffer efficiently.

Do I need to import Buffer in Node.js?

Buffer is available globally, though importing import { Buffer } from 'node:buffer' makes dependencies explicit in TypeScript and ESM codebases.