openssl enc -base64: Encode and Decode
openssl enc -base64 base64-encodes or decodes data, available wherever OpenSSL is installed.
When base64 the coreutil is missing or behaves differently across distros, openssl enc gives a consistent encoder. Mind the line wrapping.
What it does
openssl enc -base64 reads input and writes its base64 encoding; with -d it decodes. By default it wraps output at 64 characters; -A keeps it on a single line.
Common usage
echo -n "hello" | openssl enc -base64
echo "aGVsbG8=" | openssl enc -base64 -d
# single-line output (no 64-char wrapping)
echo -n "hello" | openssl enc -base64 -AOptions
| Flag | What it does |
|---|---|
| -base64 / -a | Base64 encode (or decode with -d) |
| -d | Decode instead of encode |
| -A | Do not wrap; emit on one line |
| -in <file> / -out <file> | Read from / write to a file |
In CI
Secrets and tokens must be single-line, so always add -A when encoding values for env vars or headers. Without -A the 64-char wrap injects newlines that break the consumer.
Common errors in CI
"error reading input file" or a silent empty result on decode usually means wrapped input that the decoder mishandled; pass -A consistently. A trailing newline from echo (without -n) changes the encoded value; use printf or echo -n.