How to Use the basenc Command in Linux to Encode and Decode Data in Multiple Base Formats

In modern Linux administration, web development, and cryptographic scripting, converting binary streams into ASCII strings is a routine requirement. While legacy Unix systems relied on separate individual tools like base64 and base32, GNU Coreutils (version 8.31 and newer) includes basenc. This versatile utility consolidates multiple encoding and decoding algorithms—including Base64, URL-safe Base64, Base32, Hexadecimal (Base16), binary bitstreams, and ZeroMQ Z85—into a unified, high-performance command-line interface.

Supported Encoding Standards in basenc

The basenc utility supports an expansive roster of standard encoding specifications:

Encoding Option	Specification Standard	Common Use Case
--base64	RFC 4648 §4	Standard MIME email attachments, inline web images, and data storage.
--base64url	RFC 4648 §5	Web URLs, query parameters, and JSON Web Tokens (JWT) where + and / are replaced with - and _.
--base32	RFC 4648 §6	Two-factor authentication (TOTP) secret keys and case-insensitive environments.
--base32hex	RFC 4648 §7	Extended hex alphabet (0-9, A-V) used in DNSSEC and DNS labels.
--base16	RFC 4648 §8	Standard uppercase hexadecimal representations of binary data.
--base2msb	Custom bitstream	Outputs raw binary bits (0s and 1s) starting with the most significant bit.
--z85	ZeroMQ Spec:32/Z85	Compact 85-character ASCII representation for messaging architectures and wire protocols.

How to Encode Data Using basenc

The standard syntax for encoding requires specifying the desired encoding flag followed by an input string piped via standard input or passed through a file:

1. Standard Base64 Encoding

echo -n "Antigravity Engineering" | basenc --base64

This generates standard RFC 4648 Base64 output:

QW50aWdyYXZpdHkgRW5naW5lZXJpbmc=

2. URL-Safe Base64 Encoding

When generating tokens for web queries or API payloads, standard Base64 characters like + and / cause URL parsing conflicts. Using --base64url guarantees safe strings without URL encoding:

echo -n "Subject?Action=Verify&Status=OK" | basenc --base64url

3. Hexadecimal (Base16) and Binary Bitstreams

To inspect the raw byte representation of a character sequence or file header:

echo -n "HELLO" | basenc --base16

Output appears as uppercase hexadecimal:

48454C4C4F

To view the literal binary bitstream of the same string:

echo -n "A" | basenc --base2msb

Output:

01000001

How to Decode Encoded Strings with basenc

To restore encoded text back to its original raw representation, pass the -d (or --decode) flag along with the matching encoding format:

echo -n "QW50aWdyYXZpdHkgRW5naW5lZXJpbmc=" | basenc -d --base64

The terminal immediately decodes and outputs the original text:

Antigravity Engineering

Similarly, to decode hexadecimal bytes back to plain text:

echo -n "48454C4C4F" | basenc -d --base16

Output:

HELLO

Formatting Output and Handling Whitespace

When working with large files or transmission pipelines, use these essential command modifiers:

• Disabling Line Wrapping: By default, basenc wraps long output strings at 76 columns. In automated scripts, you should disable wrapping entirely using -w 0:

  basenc --base64 -w 0 archive.tar.gz > archive.b64

• Ignoring Non-Alphabet Characters: When decoding data copied from formatted text or emails that include line breaks or spaces, use the -i (--ignore-garbage) flag to discard non-alphabet characters and prevent decoding failure:

  echo "QW50 aWdy YXZp" | basenc -d -i --base64

Practical Scripting Example: Creating URL-Safe API Tokens

Here is how you can use basenc within a Bash script to generate cryptographically random, URL-safe session identifiers without relying on external Python or Node.js packages:

#!/usr/bin/env bash
set -euo pipefail

# Generate 32 bytes of high-entropy random data and encode as URL-safe string
SESSION_TOKEN=$(head -c 32 /dev/urandom | basenc --base64url -w 0 | tr -d '=')

echo "Generated URL-Safe Token: ${SESSION_TOKEN}"