How to Base64 Decode on the Command Line (Linux, Bash, PowerShell)

Base64 decoding is something every developer and sysadmin runs into regularly — reading Kubernetes secrets, inspecting JWT tokens, decoding certificate data, unpacking API responses. Here is a complete reference for doing it on the command line across Linux, macOS, Bash, and PowerShell, including the edge cases that trip people up.

If you want to decode interactively without a terminal, the Base64 Encoder/Decoder tool handles it in the browser with no installation required.

Linux and macOS: `base64 -d`

The base64 command is available on virtually every Linux distribution and macOS out of the box.

Decode a string:

echo "SGVsbG8sIFdvcmxkIQ==" | base64 -d
# Output: Hello, World!

Important gotcha on macOS: The macOS base64 command uses -D (uppercase) instead of -d for decode:

# macOS
echo "SGVsbG8sIFdvcmxkIQ==" | base64 -D

# Linux (GNU coreutils)
echo "SGVsbG8sIFdvcmxkIQ==" | base64 -d

Decode a file:

base64 -d encoded.txt > decoded_output.bin

Bash One-Liners for Common Tasks

Decode and print without a trailing newline:

printf '%s' "SGVsbG8sIFdvcmxkIQ==" | base64 -d

Using echo adds a newline before encoding, which can cause issues with binary data. printf '%s' is safer for scripting.

Decode a Kubernetes secret:

kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 -d

This is the most common real-world use case — Kubernetes stores all secret values as Base64-encoded strings.

Decode ignoring whitespace/newlines:

Some encoded strings arrive with line breaks inserted every 76 characters (standard MIME formatting). The --ignore-garbage flag on Linux handles this:

echo "SGVsbG8s
IFdvcmxkIQ==" | base64 -d --ignore-garbage

Decoding JWT Tokens on the Command Line

A JWT has three Base64URL-encoded sections separated by dots. Here is how to decode the payload (the middle section) in Bash:

TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature"

# Extract payload (second segment)
PAYLOAD=$(echo "$TOKEN" | cut -d'.' -f2)

# Base64URL to standard Base64: replace - with + and _ with /
PAYLOAD_FIXED=$(echo "$PAYLOAD" | tr '_-' '/+')

# Add padding and decode
echo "$PAYLOAD_FIXED==" | base64 -d 2>/dev/null | python3 -m json.tool

For a cleaner JWT inspection experience without the shell gymnastics, use the JWT Decoder directly.

The Base64URL Variant

Standard Base64 uses +, /, and = as special characters. Base64URL (used in JWTs, OAuth tokens) replaces:

+ → - (hyphen)
/ → _ (underscore)
= padding is often omitted

To decode Base64URL on the command line:

decode_base64url() {
  local input="$1"
  input="${input//-/+}"
  input="${input//_//}"
  local mod=$(( ${#input} % 4 ))
  if [ $mod -eq 2 ]; then input="${input}=="
  elif [ $mod -eq 3 ]; then input="${input}="
  fi
  echo "$input" | base64 -d
}

decode_base64url "SGVsbG8sIFdvcmxkIQ"

The Base64URL Decoder tool handles this automatically without the manual substitution.

PowerShell: Base64 Decode

PowerShell does not have a base64 command, but the .NET standard library makes it straightforward.

Decode a string:

$encoded = "SGVsbG8sIFdvcmxkIQ=="
$bytes = [System.Convert]::FromBase64String($encoded)
[System.Text.Encoding]::UTF8.GetString($bytes)
# Output: Hello, World!

One-liner:

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("SGVsbG8sIFdvcmxkIQ=="))

Decode a file:

$encoded = Get-Content "encoded.txt" -Raw
$bytes = [System.Convert]::FromBase64String($encoded.Trim())
[System.IO.File]::WriteAllBytes("decoded_output.bin", $bytes)

Decode Base64URL in PowerShell:

function ConvertFrom-Base64Url {
  param([string]$input)
  $input = $input -replace '-', '+' -replace '_', '/'
  switch ($input.Length % 4) {
    2 { $input += '==' }
    3 { $input += '=' }
  }
  $bytes = [System.Convert]::FromBase64String($input)
  [System.Text.Encoding]::UTF8.GetString($bytes)
}

ConvertFrom-Base64Url "SGVsbG8sIFdvcmxkIQ"

Using Python for Cross-Platform Decoding

When you need a script that works on Linux, macOS, and Windows:

python3 -c "import base64, sys; print(base64.b64decode(sys.argv[1]).decode())" "SGVsbG8sIFdvcmxkIQ=="

For Base64URL:

python3 -c "import base64, sys; print(base64.urlsafe_b64decode(sys.argv[1] + '==').decode())" "SGVsbG8sIFdvcmxkIQ"

Common Gotchas

Newlines in encoded strings. When you echo a string in Bash, it appends a \n. Use echo -n or printf '%s' to prevent this:

# Wrong — encodes "hello\n"
echo "hello" | base64

# Correct — encodes "hello"
echo -n "hello" | base64
printf '%s' "hello" | base64

Padding characters. Standard Base64 pads output to a multiple of 4 characters with =. If you get a decode error, try appending == to the input.

Binary vs text output. If decoding binary data (images, certificates, compressed files), redirect to a file with > rather than printing to the terminal.

The macOS vs Linux flag difference. -d on Linux, -D on macOS — the single most common cross-platform issue with Base64 on the command line.

For one-off decoding where you don't want to think about these edge cases, the Base64 Encoder/Decoder handles all of them automatically. For files, the Base64 File Encoder supports drag-and-drop with binary-safe handling.