Base64 Encode a File on Linux, macOS and Windows, and Decode It Back

To Base64 encode a file on Linux, pass its path to `base64`; to turn Base64 back into a file, add `-d` and redirect the output. The details that matter are line wrapping, which breaks single-line consumers, the macOS and Windows equivalents, and proving that the decoded file is byte for byte the original.

Linux and macOS

# encode / decode
base64 keystore.jks > keystore.b64
base64 -d keystore.b64 > keystore.jks

# single line, which is what most consumers need
base64 -w 0 keystore.jks > keystore.b64      # GNU / Linux
base64 -i keystore.jks | tr -d '\n'          # macOS / BSD

Wrapping is the only portability problem in these lines: GNU needs -w 0, macOS needs tr -d '\n', and decoding accepts wrapped input on both. macOS base64 also takes -i and -o for the input and output files, which is handy under sudo, where a shell redirection would run with your own permissions rather than root's.

Check the round trip instead of trusting it. sha256sum keystore.jks before encoding and after decoding must print the same hash (on macOS, shasum -a 256). If the hashes differ, the Base64 changed on the way, most often through a line break or a character lost when pasting into a web form. file on the decoded output is a quicker sanity check: it should name the format, such as PNG image data, not ASCII text.

Windows

certutil is present on every Windows install and does both directions, though it adds header lines that must be stripped for a raw value:

certutil -encode input.bin encoded.txt
certutil -decode encoded.txt output.bin

# PowerShell, no header lines
[Convert]::ToBase64String([IO.File]::ReadAllBytes("input.bin"))

The PowerShell form is cleaner for scripting since it returns exactly the encoded string. Note it loads the whole file into memory.

Why you would do this

Environment variables and CI secret stores cannot hold newlines reliably, so binary credentials — keystores, service account keys, certificates — are stored Base64-encoded as one line and decoded at deploy time.

It is also how you move a small binary through a text-only channel: a chat message, a ticket comment, a config file. Remember the 33% size increase, and that encoding provides no confidentiality whatsoever — an encoded keystore in a public repository is an exposed keystore.

Frequently asked questions

How do I decode a Base64 file back to binary?

Run `base64 -d file.b64 > file.bin` on Linux, `base64 -d -i file.b64 -o file.bin` on macOS, or `certutil -decode file.b64 file.bin` on Windows. Compare checksums of the original and the result to confirm nothing changed.

Is there a file size limit?

The command streams, so it handles files far larger than memory. Browser-based tools do not.

Why does certutil add BEGIN and END lines?

`certutil -encode` wraps its output in `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines even when the file is not a certificate. Delete them before using the value elsewhere, or use the PowerShell `[Convert]::ToBase64String` form, which returns the bare string.