Base64 encode and decode files with certutil
The built-in Windows tool that quietly handles base64 — certutil -encode / -decode.
01Command
$ certutil -encode in.txt out.b64 ; certutil -decode out.b64 restored.txt02What it does
certutil's -encode/-decode operate on whole files, not strings, and the decoder also accepts output produced by other tools. Add -f to overwrite an existing output file. For hex dumps there's -encodehex/-decodehex, and within PowerShell a single string can also be encoded with [Convert]::ToBase64String when file round-trips are overkill.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- certutil | Microsoft LearnEvidence: Microsoft documents certutil -encode and -decode converting files to and from base64, plus -encodehex/-decodehex for hexadecimal.
- CERTUTIL - Windows CMDEvidence: SS64 lists -encode/-decode base64 conversion and -decodehex, noting the -f flag to force overwrite of output files.
Last verified: 2026-09-17 · Category: Developer
06Related solutions
Use Windows Package Manager to install, search, and upgrade thousands of applications from the community repository in one command.
Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.
One pipeline that renames every matching file in a folder using regular expressions — safer and far more flexible than third-party renamers.