base64

Updated

September 4, 2026

Overview

base64 encodes binary data to ASCII text, or decodes it back. Common uses: paste small secrets into YAML/JSON, embed short binaries in scripts, and read tokens from cloud/K8s manifests. It is encoding, not encryption — anyone can decode it.

Syntax

base64 [options] [file]
base64 --decode [options] [file]

Default reads stdin or a single file and writes encoded text to stdout (GNU coreutils).

Common Options

Option Description
-d, -D, --decode Decode
-w COLS, --wrap=COLS Wrap encoded lines at COLS (0 = no wrap; GNU default often 76)
-i, --ignore-garbage When decoding, ignore non-alphabet characters
(file) Input file; omit or - for stdin

macOS base64 flags differ slightly (-D vs -d); this page targets GNU/Ubuntu.

Examples with Explanations

Encode a file

base64 secret.key
base64 -w0 secret.key > secret.b64     # single line (scripts/YAML)

-w0 avoids line breaks that break some config parsers.

Decode to a file

base64 -d secret.b64 > secret.key
base64 --decode -i pasted.txt > out.bin

Encode/decode stdin pipelines

echo -n 'hello' | base64
echo 'aGVsbG8=' | base64 -d
printf 'hello' | base64 -w0

Prefer printf when you must control trailing newlines precisely.

Small binary in a shell variable (careful)

B64=$(base64 -w0 icon.png)
echo "$B64" | base64 -d > icon-copy.png
cmp icon.png icon-copy.png && echo identical

Large blobs belong in files, not shell variables.

Kubernetes-style secret (illustrative)

echo -n 's3cr3t' | base64 -w0
# put result in Secret data: fields — still not encryption at rest without cluster config

Anyone with API read access can base64-decode Secret data unless encryption-at-rest is configured.

PEM / cert peek

# Intermediate: binary DER to base64 lines is what PEM body is
base64 -w64 cert.der
openssl x509 -in cert.pem -noout -subject   # prefer openssl for real cert work

Ignore whitespace garbage when decoding

base64 -d -i email-attachment.b64 > file.bin

Helpful when copy-paste introduced spaces or headers.

Notes

  • Encoded size ≈ 4/3 of input (plus newlines if wrapping).
  • Base64 is reversible and not a confidentiality control.
  • Wrong alphabet/variants (URL-safe base64) may need tr -- '+/' '-_' transforms or other tools.
  • Always use -w0 for single-line config values unless the format requires classic MIME wrap.
  • Decoding invalid input may produce partial garbage — verify with length checks or hashes when it matters.

Additional Resources

  • man base64