Base64 on the command line

Linux (GNU coreutils)

echo -n 'Hello' | base64          # SGVsbG8=
echo 'SGVsbG8=' | base64 -d       # Hello
base64 -w0 image.png > image.b64  # no line wrapping
base64 -d image.b64 > image.png

Always use echo -n (or printf). Plain echo appends a newline, so echo 'Hello' | base64 gives SGVsbG8K, the encoding of Hello\n.

By default GNU base64 wraps output at 76 characters. Use -w0 to get a single line, which is what you want for JSON, environment variables and HTTP headers.

Decode ignores newlines but fails on other junk unless you add -i (--ignore-garbage).

macOS (BSD)

base64 -i image.png -o image.b64   # encode, no wrapping by default
base64 -D -i image.b64 -o image.png
pbpaste | base64 -D                # decode the clipboard

Newer macOS versions accept -d as well.

OpenSSL (works everywhere)

openssl base64 -A -in file.bin -out file.b64   # -A = single line
openssl base64 -d -A -in file.b64 -out file.bin

Without -A, OpenSSL wraps at 64 characters and, when decoding, expects lines of at most 64 characters.

Windows

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\img.png"))
[IO.File]::WriteAllBytes("C:\out.png", [Convert]::FromBase64String($b64))

# cmd.exe
certutil -encode in.bin out.b64   # adds BEGIN/END CERTIFICATE lines
certutil -decode out.b64 in.bin

Useful one-liners

# Basic auth header
printf '%s' 'user:pass' | base64

# Kubernetes secret values
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 -d

# Data URI for an image
echo "data:$(file -b --mime-type logo.png);base64,$(base64 -w0 logo.png)"

# Decode Base64URL (JWT payload)
cut -d. -f2 <<<"$JWT" | tr '_-' '/+' | base64 -d 2>/dev/null

The last command may complain about missing padding; the JWT decoder handles that for you.