base64 Command Reference for CI Scripts

base64 encodes binary data into ASCII text and decodes it back.

base64 is how CI moves binary secrets (keys, certs) through text-only channels like environment variables. The wrapping default is a frequent source of corrupted output.

Common flags/usage

• -d / --decode: decode base64 back to bytes
• -w0: do not wrap encoded output into lines (GNU)
• reads stdin or a file argument
• pipe in and out to encode/decode streams
• macOS uses -b 0 instead of -w 0 for no wrapping

Example

echo -n "${SSH_KEY_B64}" | base64 -d > "${HOME}/.ssh/id_ed25519"
chmod 600 "${HOME}/.ssh/id_ed25519"
KUBECONFIG_B64=$(base64 -w0 < ~/.kube/config)

In CI

GNU base64 wraps output at 76 columns by default, and an embedded newline can break a single-line environment variable or secret; encode with -w0 (or BSD -b0). When decoding a secret stored in a variable, avoid an extra trailing newline from echo by using echo -n or printf %s. Storing decoded keys still needs chmod 600.

Key takeaways

• Encode with -w0 so wrapped newlines do not corrupt a single-line secret.
• macOS uses -b0 instead of -w0 to disable line wrapping.
• Use echo -n or printf %s when decoding so no stray newline is added.

Related guides