diff --git a/package-lock.json b/package-lock.json
index c841b521b9..e7c55bff58 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2854,6 +2854,14 @@
       "dev": true,
       "requires": {
         "pako": "~1.0.5"
+      },
+      "dependencies": {
+        "pako": {
+          "version": "1.0.11",
+          "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
+          "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
+          "dev": true
+        }
       }
     },
     "browserslist": {
@@ -9299,7 +9307,6 @@
       "optional": true,
       "requires": {
         "lie": "~3.3.0",
-        "pako": "~1.0.2",
         "readable-stream": "~2.3.6",
         "set-immediate-shim": "~1.0.1"
       }
@@ -13606,9 +13613,10 @@
       "dev": true
     },
     "pako": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/pako/-/pako-2.0.4.tgz",
+      "integrity": "sha512-v8tweI900AUkZN6heMU/4Uy4cXRc2AYNRggVmTR+dEncawDJgCdLMximOVA2p4qO57WMynangsfGRb5WD6L1Bg==",
+      "dev": true
     },
     "parallel-transform": {
       "version": "1.2.0",
@@ -18381,7 +18389,6 @@
         "commander": "5.1.0",
         "gl-matrix": "3.3.0",
         "jszip": "3.4.0",
-        "pako": "1.0.11",
         "seedrandom": "3.0.5",
         "shelljs": "0.8.4",
         "webvr-polyfill": "0.10.11",
diff --git a/package.json b/package.json
index ad6da3cd79..7b9aee545c 100644
--- a/package.json
+++ b/package.json
@@ -79,7 +79,7 @@
     "karma-spec-reporter": "^0.0.32",
     "karma-webpack": "^3.0.5",
     "nib": "^1.1.2",
-    "pako": "^1.0.11",
+    "pako": "^2.0.4",
     "phantomjs-prebuilt": "^2.1.5",
     "pug": "^3.0.2",
     "pug-lint": "^2.6.0",
@@ -147,8 +147,8 @@
     "test-headed-xvfb": "GEOJS_TEST_CASE=tests/test-headed.js xvfb-run -s '-ac -screen 0 1280x1024x24' karma start karma-cov.conf.js --single-run --browsers ChromeFull",
     "test-webglheadless": "GEOJS_TEST_CASE=tests/test-gl.js karma start karma-cov.conf.js --single-run --browsers ChromeHeadlessTouch",
     "test-webglheadless-all": "GEOJS_TEST_CASE=tests/test-gl.js karma start karma-cov.conf.js --single-run --browsers ChromeHeadlessTouch,FirefoxHeadlessTouch",
-    "test-tutorials": "GEOJS_TEST_CASE=tests/tutorials.js karma start karma-cov.conf.js --single-run --browsers ChromeHeadlessTouch,PhantomJS",
-    "test-tutorialsci-all": "GEOJS_TEST_CASE=tests/tutorials.js karma start karma-cov.conf.js --single-run --browsers ChromeHeadlessTouch,FirefoxHeadlessTouch,PhantomJS",
+    "test-tutorials": "GEOJS_TEST_CASE=tests/tutorials.js karma start karma-cov.conf.js --single-run --browsers ChromeHeadlessTouch",
+    "test-tutorialsci-all": "GEOJS_TEST_CASE=tests/tutorials.js karma start karma-cov.conf.js --single-run --browsers ChromeHeadlessTouch,FirefoxHeadlessTouch",
     "get-data-files": "node scripts/datastore.js dist/data",
     "ci-clean": "git clean -fxd dist -e dist/data jsdoc/tmpl jsdoc/static images lcov",
     "ci": "npm run ci-build && npm run ci-test",
diff --git a/tutorials/common/tutorials.js b/tutorials/common/tutorials.js
index 7fd54aca16..cc10f649c0 100644
--- a/tutorials/common/tutorials.js
+++ b/tutorials/common/tutorials.js
@@ -248,7 +248,7 @@ function fill_codeblocks(query) {
         /* Strip out white space and pluses, then convert ., -, and _ to /, +,
          * =.  By removing whitespace, the url is more robust against email
          * handling.  The others keep things short. */
-        var src = atob(query[key].replace(/(\s|\+)/g, '').replace(/\./g, '/').replace(/-/g, '+').replace(/_/g, '='));
+        let src = query[key].replace(/(\s|\+)/g, '').replace(/\./g, '/').replace(/-/g, '+').replace(/_/g, '=');
         src = pako.inflate(src, {to: 'string', raw: true});
         if ($('.CodeMirror', block).length) {
           $('.CodeMirror', block)[0].CodeMirror.setValue(src);
@@ -287,7 +287,8 @@ function start_keeper(alwaysKeep) {
         var src = $('.CodeMirror', block).length ? $('.CodeMirror', block)[0].CodeMirror.getValue() : $('textarea', block).val();
         src = src.trim().replace(/ [ ]*\n/g, '\n');
         if (src !== defaultSrc) {
-          var comp = btoa(pako.deflate(src, {to: 'string', level: 9, raw: true}));
+          let comp = pako.deflate(src, {to: 'string', level: 9, raw: true});
+          comp = btoa(String.fromCharCode.apply(null, comp));
           /* instead of using regular base64, convert /, +, and = to ., -, and _
            * so that they don't need to be escaped on the url.  This reduces the
            * average length of the url by 6 percent. */