Encode and Decode Base64 with OpenSSL

openssl base64 converts files and streams to and from Base64 — the same command that arms openssl enc output for text transport works standalone on any data.

Encode and decode

openssl base64 -in file.bin -out file.b64
openssl base64 -d -in file.b64 -out file.bin

Stdin/stdout are the default, so it pipes like any filter:

printf %s 'hello world' | openssl base64
# aGVsbG8gd29ybGQ=

Line wrapping and -A

Output is wrapped with a newline every 64 characters by default. -A produces a single unwrapped line — what you want when embedding the result in a URL, JSON document, environment variable, or config file:

printf %s 'hello' | openssl base64 -A
# aGVsbG8=

On decode, -A also accepts input without newlines. The OpenSSL docs recommend it when decoding unknown input, since wrapped decode expects a newline within the first 1024 bytes.

Base64 alongside encryption

openssl enc takes the same -a/-base64 (process as Base64) and -A (unwrapped) flags, so ciphertext is armored in the same step. See openssl-file-encryption for the encryption side:

openssl enc -aes-256-cbc -pbkdf2 -a -in file.txt -out file.enc

Common pitfalls

• Base64 is not encryption. It is a text encoding — anyone can openssl base64 -d the result back to the original bytes.
• Decoded output is binary. Redirect it to a file; dumping it to a terminal produces garbage and can corrupt the terminal state.
• Newlines are part of the format. Pasting wrapped output into a single-line context (URL, JSON string, env var) without -A bakes in line breaks that break the containing syntax.

Related

• openssl-file-encryption — symmetric file encryption with openssl enc
• openssl-hashing — digests, HMACs, and password hashes from the same toolkit
• basenc-base64-url-safe-encoding — URL-safe Base64 (-_ instead of +/)
• powershell-base64-encoding — the same job on Windows
• jq-format-strings — @base64/@base64d from the shell
• xxd — hex dumps as the other classic transport encoding

Sources

• 2000 — openssl-enc