Encode and decode Base64 on a Mac
Base64 is an encoding, not encryption. Anything encoded in it is readable by anyone who bothers, which is exactly why it should not be handed to a website.
The variant that breaks decoders
Standard Base64 uses + and / as its last two characters and = for padding. That is unsafe inside a URL, so RFC 4648 defines a URL-safe alphabet using - and _ instead, usually with the padding stripped.
JWTs use the URL-safe variant. So do many signed URLs and session cookies. A decoder that only understands the standard alphabet reports valid input as corrupt, which sends people looking for a problem in their data that is really a problem in their tool.
Why base64 in Terminal sometimes refuses
macOS ships the base64 command, and it works well for the standard alphabet. It does not translate - and _, and it is strict about padding, so URL-safe input has to be repaired first:
# URL-safe input, padding restored, then decoded
echo "$T" | tr '_-' '/+' | base64 -DEven this fails when the length is not a multiple of four, because the padding was stripped and has to be added back.
What Base64 is for, and what it is not for
- It exists to carry binary data through channels that only handle text — email attachments, JSON strings, data URIs.
- It adds roughly a third to the size of whatever it encodes.
- It provides no confidentiality whatsoever. A credential in a Base64 string is a credential in plain text with an extra step.
Detecting which way to go
Most of the time the direction is obvious from the input, and Bellows detects it: paste something that decodes cleanly to text and it decodes; paste anything else and it encodes. Both directions remain available explicitly for the cases where the guess is wrong — such as text that happens to be valid Base64.
How to check the claim rather than trust it
Bellows is signed without a network entitlement. That is not a policy someone wrote down — it is a permission the binary does not have, and macOS enforces it whether the app wants to connect or not. You can read the entitlements it was signed with:
codesign -d --entitlements - /Applications/Bellows.appNeither com.apple.security.network.client nor com.apple.security.network.server appears in the output. Without them the sandbox refuses to open a socket.
Base64 Encode/Decode is one of 41 tools in Bellows
A native Mac app that ships with no network entitlement, so macOS blocks it from connecting at all. One-time purchase, every future update included.
What Bellows is →Questions
Is Base64 encryption?
No. It is a reversible encoding with no key. Anyone can decode it, so it protects nothing and should never be used to hide a secret.
Why does my Base64 string fail to decode?
Usually because it is the URL-safe variant, which uses - and _ in place of + and /, and often has its = padding stripped. A decoder expecting the standard alphabet will reject it.
How do I decode Base64 in macOS Terminal?
echo 'aGVsbG8=' | base64 -D works for standard Base64. For the URL-safe variant you have to translate the characters and restore the padding first.